The stance
Plinn is a small app that keeps a list of places, on your phone. We built it so that almost everything that matters to you — the saved places, the loved ones, your taste — could live there and nowhere else. We collect what we need to make the product work and nothing more. We do not sell, share, or "enrich" your data with third parties.
Honest about the AI. When you ask Plinn to compose a trip or run a natural-language search, we send your prompt and the relevant subset of your saved places to a language model. We tell you each time we do, and we name which places we sent. The model provider does not train on your data — we have a no-retention contract.
What we collect
- Places you saved or loved, including any notes you wrote.
- Trips you composed, with the edits you made.
- Lists you shared, and the handle (not the contact card) of the friend you shared with.
- Your derived taste signals — walking pace, dinner timing, art-versus-nature lean — built from the places you save and the trips you take.
- Your email address, if you joined the waitlist or TestFlight.
- Your foreground location, while the app is open, to show your map. We never request background location.
What we don't
- Advertising identifiers (IDFA, GAID). Not collected. Not derived.
- Searches you ran and didn't act on. They never reach our servers.
- What time of day you open the app. No engagement clock.
- Who saw your shared list. Public lists are public; we do not log views.
- Third-party SDKs that read device state. Plinn ships with zero of them.
- Crash reports tied to your identity. Crashes are captured but stripped of user identifiers before they reach us.
How we use it
Your data is used to make Plinn work for you. We use saved places and trips to compose itineraries when you ask. We use taste signals to order suggestions inside the app. We use your email to send you the newsletter, if you asked for it, and TestFlight invites — and nothing else.
We do not use your data to build a profile for advertising. We do not use it to train any machine-learning model. We do not sell it, period.
Where it lives
Plinn data lives in two places. On your phone, in an encrypted local database. On our servers, in a Postgres database hosted in the EU (Frankfurt), encrypted at rest and in transit. Backups run nightly and are kept for 30 days, then permanently deleted.
The two places stay in sync. If you "forget everything" on your phone, we drop the server side within 24 hours and we drop the backup at the next 30-day boundary at the latest.
Sub-processors
We use a small number of third parties to run the service. They process your data on our behalf, under contract, never for their own purposes.
- Database hosting — Hetzner Cloud, Frankfurt, DE.
- Email — Postmark, EU region.
- Language model — Anthropic API, with no-retention enterprise contract.
- Map tiles — MapTiler, hosted in the EU.
- Error capture — Sentry, with user-id scrubbing enabled.
If we add or change a sub-processor we update this list, and email you if you have an account. There has never been an unannounced change.
Your rights
You can do all of this without writing to us. The app is the source of truth.
- See what we have on you — Profile → Memory → "What Plinn remembers." It is the entirety of your stored data.
- Export it — Profile → Memory → Export. JSON file, sent to your email within a minute.
- Edit or delete a single place, list, or trip — long-press it.
- Forget everything — Profile → Memory → Forget everything. We keep no copy.
You also have the rights granted by the GDPR (access, rectification, erasure, portability, restriction, objection, and the right not to be subject to automated decision-making). Write to privacy@plinn.app if you would rather exercise them by email — we reply within 5 business days.
Children
Plinn is not for children under 13. If you are a parent and believe your child has registered, write to us and we will delete the account immediately.
Terms, in brief
You own everything you put in Plinn. We don't claim a license to it beyond what we need to show it to you and to friends you explicitly share with. We can suspend an account that breaks the law or harms other users. If we ever shut Plinn down, we will give you 90 days' notice and export everything for you first.
Changes to this document
We will tell you in plain English when this changes. By email, in the app, and at the top of this page. We will tell you what changed, not just that it changed.