What we keep, and what stays yours.

Plinn is a notebook for the places you love. The notebook lives on your phone and in your iCloud. Your places never touch our servers.

The short version.

Your places never touch our servers. Everything you save — places, photos, notes, trips, boards — is stored on your device and synced through your private iCloud account, which is encrypted by Apple. We can't see it. We don't sell it. We don't show ads. There is no analytics SDK following you around the app. We run exactly two small services of our own: a keyless flight-status proxy, which sees flight numbers and never places, and — only if you opt in — the newsletter service described below, which sees an email address and never places.

The few exceptions are listed below, plainly.

What Plinn collects, and why.

• Saved places & tripsThe reason the app exists. Stored locally, synced via iCloud. Never sent to us.
• Photos you attachOnly the photos you explicitly add to a place. Stored locally and in iCloud.
• Precise locationUsed while the app is open, to show what's nearby and to sort by distance. Never recorded as a history.
• Apple ID identifierProvided by Sign in with Apple. Used to identify your account in iCloud and to recognise friends you share boards with.
• Name & emailFrom your Apple ID, only if you choose to share them at sign-in. Used to display your name on shared boards and trips.
• ContactsOnly if you grant access. Used to suggest people when you share a board. Contacts are read on-device and never uploaded.
• CalendarOnly if you grant access. Used to add trip activities, flights, and check-ins to your calendar.

What Plinn does not do.

No tracking across apps or websites. No advertising identifiers. No analytics that profile you. No selling, sharing, or "monetising" your data with partners. The only services we operate are the keyless flight-status proxy described below, which stores nothing about you, and the newsletter service — which exists only if you ask for it and holds nothing but an address and the record of your consent.

iCloud and CloudKit.

Plinn syncs through Apple's CloudKit. That means your data is stored in your private iCloud container, end-to-end encrypted by Apple, and accessible only by devices signed into your Apple ID. Apple's iCloud privacy policy applies to that storage; it's available at apple.com/legal/privacy.

When you share with friends.

Sharing a board or trip with a friend creates a copy on their device through CloudKit. Your name and the content you shared become visible to them. We don't see this exchange — it happens directly between Apple's iCloud accounts. You can revoke access at any time from the share's settings.

Your places in your iPhone's search.

Place names, cities, and trip dates are added to your iPhone's own search index so Siri can find them and point back to Plinn. Your notes and the people you travel with are not. None of it goes to Plinn.

One switch turns this off — Me → Privacy → Siri & Spotlight — and flipping it empties the index, not just future additions. A Private flag on any place or trip keeps that item out of search and suggestions entirely. The complete field-by-field list of what the index receives — and what never enters it — is published at plinn.app/datamap, and the same list lives in the app under What Siri sees.

Intelligence.

Plinn's intelligence works with no key and no account. On capable iPhones it runs on the device itself; larger requests are handled by Apple's Private Cloud Compute, under Apple's terms. If you choose to bring your own API key instead, your requests go directly from your device to that provider — your relationship, your key, stored only in your device keychain. Either way, nothing about your places goes to Plinn. Older iPhones keep the built-in pipeline.

The flight-lookup feature.

When you add a flight to a trip, Plinn looks up the flight number you entered (e.g. "LH123") through our own flight-status proxy. The proxy is keyless — it exists so no API credential ever ships inside the app — and it sees flight numbers, never places. The flight number is the only thing that leaves your device for that single request.

The newsletter.

If — and only if — you opt in, the email address you type and your first name are sent to Mailchimp (Intuit), which does the mailing for us as our processor under its standard data-processing terms, including the transfer safeguards for data leaving the EU. Nothing is sent until you confirm: Mailchimp mails you a link first, and the subscription starts when you click it. Every mail carries a one-click unsubscribe, and you can turn it off any time in Me → Privacy → Email updates.

We keep a consent record at Cloudflare — the time, the IP address, which version of the consent sentence you agreed to, and a hashed copy of your address — because we have to be able to demonstrate that consent was given. It is the proof, not a second mailing list. Deleting your account erases the address from Mailchimp and strips the identifying fields from that record; a countable, anonymous row stays so the log itself remains verifiable.

No place, trip, board, photo or note is part of this. The address is the whole payload.

How to delete your data.

Delete the Plinn app from your device. To remove the iCloud copy as well, open Settings → [your name] → iCloud → Manage Account Storage → Plinn → Delete Data from iCloud. Once deleted from iCloud, the data is gone — we have no copy to restore.

Children.

Plinn is rated 4+ and contains nothing inappropriate for children, but the app's sharing features are designed for adults. We don't knowingly collect data from children under 13. If you believe your child has used the app, deleting the app deletes the data.

Changes to this policy.

If we change anything that materially affects what data Plinn handles, we'll update this page and bump the date below. Older versions are kept in our public Git history.

Contact.

Questions, concerns, or a bug to report: NadineAuer@icloud.com. We read every email.