Privacy Policy

Last updated: October 2, 2026 (rev 5)

Who We Are

Plonkus is operated by Montis UX AB, based in Sweden.

Contact: support@plonkus.fun

Address: Montis UX AB, Trozelligatan 1C, 60235 Norrköping, Sweden

What Data We Collect

When you use Plonkus, we collect:

Information You Provide

• Account information: Email address, plus either (a) name and profile photo from Google sign-in, or (b) a password if you sign up with email and password. Passwords are never stored in plain text, only as one-way cryptographic hashes managed by Supabase.
• User content: Game boards, categories, questions, and answers you create
• Game data: Player names, scores, and game history

Information Collected Automatically

• Analytics data: We use Vercel Analytics to collect anonymous, aggregated usage data including page views, visitor counts, referrers, browser/device type, and anonymous product events (like starting a game or opening the pricing page). Page addresses are reduced to the type of page (for example, "a shared board"), so no board, room, or share link identifiers are recorded. This data is not personally identifiable and does not use cookies.
• Technical data: Our hosting provider (Vercel) and database provider (Supabase) may collect standard server logs including IP address, browser type, and access times as part of normal service operation
• Error monitoring: When something goes wrong in the app, we use Sentry to capture the error along with limited technical context (page URL, browser, OS, stack trace). IP addresses are not sent. Errors are stored in the EU.
• Payment data (when you subscribe to Plus): See "Payment Data" section below.
• Cookies: Session cookies to keep you logged in (set by Supabase authentication)

How We Collect Data

• Directly from you: When you sign up or log in (with Google, email and password, or a magic link) and create boards
• Automatically: Standard server logs collected by our hosting and database providers
• From Google: Your basic profile information when you authenticate via Google sign-in

How We Use Your Data

We use your data to:

• Provide and maintain the Plonkus service
• Authenticate your account and keep you logged in
• Save your boards across devices
• Enable multiplayer features (buzzer mode, sharing)
• Improve our service and develop new features
• Send important service updates and system notifications
• Respond to your support requests

We never:

• Sell your personal data to third parties
• Share your data with advertisers
• Use your data for marketing purposes (unless you opt in)
• Access your boards without permission (except for technical support when requested)

Third-Party Services

We use these services to operate Plonkus:

Supabase (Database & Authentication)

• Stores your account information and boards
• Servers located in the European Union
• Supabase Privacy Policy

Vercel (Website Hosting & Analytics)

• Hosts the Plonkus website
• Provides content delivery
• Provides anonymous, privacy-friendly website analytics (no cookies, no personal data)
• Vercel Privacy Policy

Google OAuth (Optional Authentication)

• Handles sign-in if you choose to use your Google account
• We only receive basic profile information (name, email, photo)
• Google Privacy Policy

Resend (Transactional Email)

• Delivers account-related emails on our behalf: sign-up confirmation, magic links, password resets, and email-change confirmations
• Receives only the recipient's email address and the message contents
• Does not use your email for marketing or share it with third parties
• Resend Privacy Policy

PartyKit (Real-Time Features)

• Powers real-time buzzer mode and multiplayer rooms
• Processes temporary connection data during active game sessions
• PartyKit Privacy Policy

Sentry (Error Monitoring)

• Captures application errors and limited technical context to help us debug and fix bugs
• We have configured Sentry to not send IP addresses or session recordings, only error events and stack traces
• Data is stored in the EU
• Sentry Privacy Policy

Google Gemini (AI Clue Generation)

• Powers the optional in-app AI clue and category generation feature
• When you generate with AI, we send only the inputs needed for that request (the board title, the category name and the board's other category names, the point value, round, any tone tags, notes you type, and the text of other clues already in that category) to Google's Gemini API. The board title, category names, and existing clues are sent so generated clues stay on-theme and don't repeat. We do not send your name, email, or account identifiers
• Google processes these inputs to return clue suggestions and handles them under the Gemini API Terms
• Gemini API Terms

Lemon Squeezy (Payment Processing & Merchant of Record)

• Processes Plonkus Plus subscriptions and acts as the Merchant of Record, meaning Lemon Squeezy is the seller of record for tax and compliance purposes, while Plonkus is the underlying service provider
• Collects your name, email, billing country, and payment method during checkout
• Handles VAT, sales tax, and refunds globally on our behalf
• Uses Stripe as its underlying payment processor. Card details are handled by Stripe and never reach us
• Lemon Squeezy Privacy Policy · Stripe Privacy Policy

These service providers have access to your data only to perform services on our behalf and are obligated not to disclose or use it for other purposes.

Payment Data

When you subscribe to Plonkus Plus, we never see or store your card details. Lemon Squeezy and Stripe handle the entire payment flow.

What we receive and store from Lemon Squeezy webhooks:

• Your Lemon Squeezy customer and subscription IDs
• Subscription plan (monthly or annual), status, and renewal dates
• Whether the subscription is set to cancel at period end

What we never receive or store:

• Card numbers, CVCs, or expiry dates
• Full billing addresses (Lemon Squeezy retains these for tax purposes)

Data Storage and Security

Where your data is stored:

• Primary database: European Union (Supabase servers)
• Website hosting: Global edge network (Vercel)

How we protect your data:

• All data encrypted in transit using HTTPS/TLS
• Data encrypted at rest in our database
• Industry-standard security measures
• Regular security updates and monitoring
• Access controls limiting who can view user data
• Secure authentication via Google OAuth, email-and-password (with hashed passwords), or magic-link sign-in

What we cannot guarantee:

• No system is 100% secure
• We implement reasonable security measures but cannot guarantee absolute security
• You're responsible for keeping your Google account or password secure

Your Rights Under GDPR

As a user in the European Union, you have the right to:

Right to Access

Request a copy of all personal data we hold about you. Email support@plonkus.fun to request your data.

Right to Rectification

Correct any inaccurate or incomplete data. Email support@plonkus.fun to request corrections.

Right to Erasure ("Right to be Forgotten")

Delete your account and all associated data. The fastest way is to sign in and use the "Delete my account" option on your Account page, which removes your account, boards, and any share links immediately. You can also email support@plonkus.fun if you'd prefer we handle it for you.

Right to Data Portability

Export your boards and data in a machine-readable format. Email support@plonkus.fun to request an export.

Right to Restrict Processing

Limit how we use your data while we investigate a concern. Email support@plonkus.fun.

Right to Object

Stop us from using your data for specific purposes. You can object by deleting your account.

Right to Withdraw Consent

Stop using the service at any time by deleting your account.

How to exercise your rights:

• Email support@plonkus.fun with your request
• We'll respond within 30 days (as required by GDPR)

Data Retention

Active accounts: We keep your data for as long as your account is active and you continue using Plonkus.

Deleted accounts: When you delete your account:

• Your account, boards, and any share links are permanently deleted from our active database immediately
• This action cannot be undone. There is no recovery window
• Encrypted database backups managed by our provider (Supabase) may retain a copy for up to 30 days before being purged

Legal obligations: We may retain certain data longer if required by law (fraud prevention, legal disputes).

Accounting and tax records: If you have ever subscribed to Plonkus Plus, Swedish accounting law (bokföringslagen) requires us to retain invoices, payment records, and related accounting data for seven (7) years after the end of the calendar year in which they were created. This data is kept in a restricted-access accounting system separate from the active product database. Deleting your account will not erase these records, but they are not used for any purpose other than legal compliance.

Cookies and Tracking

Essential Cookies (Always Active)

• Session cookies: Keep you logged in (set by Supabase authentication)
• Security cookies: Protect against attacks (CSRF protection)

These cookies are necessary for the service to work and cannot be disabled.

Local Storage

We use your browser's local storage (not cookies) to remember your preferences such as theme, sound settings, and game state. This data stays on your device and is not sent to our servers.

Analytics

We use Vercel Analytics to understand how Plonkus is used. It collects anonymous, aggregated data (page views, visitor counts, referrers, browser/device type, and anonymous product events). It does not use cookies, does not collect personal information, and does not track individual users across sessions.

We do not use advertising or tracking cookies.

Sharing Your Data

We share your data only in these situations:

With Service Providers

• Supabase (database hosting and authentication)
• Vercel (website hosting)
• Resend (transactional email delivery)
• PartyKit (real-time multiplayer features)
• Sentry (error monitoring)
• Lemon Squeezy (payment processing and merchant of record), with Stripe as their underlying card processor
• These providers can only use data to provide services to us

With Other Users (When You Choose)

• When you make a board public and share the link
• Other users can view and clone public boards
• Your name and profile photo may be visible on shared boards

For Legal Reasons

We may disclose data if required by law:

• To comply with legal obligations
• To protect our rights or property
• To prevent fraud or abuse
• To respond to valid legal requests from authorities

We never:

• Sell your data
• Share data with advertisers
• Provide data to third parties for their marketing

Children's Privacy

Plonkus is not intended for children under 16 years of age.

We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, please contact us at support@plonkus.fun and we will delete it immediately.

Parents: If you discover your child under 16 is using Plonkus, please contact us to have their account removed.

International Data Transfers

For EU/EEA users: Your data is primarily stored in the European Union (Supabase servers).

For users outside the EU: Your data may be transferred to and processed in the European Union where our primary servers are located. By using Plonkus, you consent to this transfer.

We ensure appropriate safeguards are in place for international transfers, including:

• Standard contractual clauses approved by the EU Commission
• Service providers with adequate data protection measures

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our data practices
• New features or services
• Legal or regulatory requirements

When we make changes:

• We'll update the "Last updated" date at the top
• For significant changes, we'll notify you via email
• We may also show a notice on the website

Your continued use after changes: Using Plonkus after we post changes means you accept the updated Privacy Policy.

Previous versions: You can request previous versions of this policy by emailing support@plonkus.fun.

Your Swedish Consumer Rights

If you're in Sweden, you have additional rights under Swedish consumer protection laws. This Privacy Policy does not limit those rights.

For questions about Swedish consumer rights, contact the Swedish Consumer Agency (Konsumentverket): konsumentverket.se

Data Protection Authority

If you believe we've mishandled your data, you have the right to file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the data protection authority in your country.

Contact Us

General inquiries: support@plonkus.fun

Data protection requests: support@plonkus.fun (Subject line: "Data Protection Request")

Postal address:
Montis UX AB
Trozelligatan 1C
60235 Norrköping
Sweden

Response time: We aim to respond to all inquiries within 48 hours (for urgent matters) and data protection requests within 30 days as required by GDPR.

This Privacy Policy was last updated on June 15, 2026 (rev 4).