Privacy Policy

Last updated: August 13, 2026

Plysh ("we," "us," or "our") is a consent and sexual health communication app. We understand that the data you share with us is deeply personal. This policy explains exactly what we collect, why, and how we protect it.

1. What We Collect

Account information: Email address and display name when you create an account.

Consent preferences: Your responses to the desires survey (Yes, Maybe, Ask First, No for each activity). These are stored securely and only shared with partners you explicitly connect with and, if you join a party, with that party's participants through the group consent matrix.

Health information: STI test results you choose to upload. You control whether these are shared with partners.

Partnership data: Records of partner connections and party memberships you create.

NDA signature records: If you sign a party non-disclosure agreement in the app, we store your display name, a drawn signature image, a timestamp, and the version of the agreement text you signed. This record is visible to the other participants of that party, as stated in the agreement itself.

Device information: We collect crash reports (via Sentry) and usage analytics (via PostHog) to improve the app. We configure these services to strip your consent preferences, health data, and partner information; they process an IP address and an anonymous device identifier as part of providing the service.

2. What We Never Do

• Never sell your data. Not to advertisers, data brokers, or anyone else.
• Never share consent or health data beyond the people you explicitly choose in the app: partners you connect with, and — for consent preferences and NDA records only — participants of a party you choose to join.
• Never use your data for advertising or targeted marketing.
• Never send your consent answers, health data, or partner details to crash reporting or analytics services.

3. How We Protect Your Data

Your data is stored in Supabase with row-level security (RLS) — meaning database queries are enforced at the server level to ensure users can only access their own data and data explicitly shared with them.

All data in transit is encrypted via TLS and encrypted at rest by our hosting provider. Authentication uses industry-standard JWT tokens.

4. Third-Party Services

We use the following third-party services:

• Supabase — database and authentication. Their privacy policy.
• Sentry — crash reporting. Receives device type, OS version, and stack traces, configured to exclude your content and network request data. Their privacy policy.
• PostHog — usage analytics. Receives which features are used and onboarding completion rates against an anonymous device identifier, configured to exclude your content. Their privacy policy.

Legal basis: Consent preferences, health information, and NDA signature records are processed on the basis of your explicit consent, which you give by entering them in the app and can withdraw at any time by deleting them or your account. Account and device data are processed to provide the service.

5. Your Rights

• Access: You can view all your data in the app at any time.
• Deletion: You can delete your account and all associated data directly in the app (Settings → Delete Account), or by contacting us at support@plysh.app.
• Portability: You can export your consent preferences from within the app.
• Control: You choose which partners see your consent preferences and health data. You can revoke access at any time.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, your personal data is deleted from our production systems immediately; residual copies in encrypted backups are purged within 30 days.

7. Children

Plysh is not intended for users under 18 years of age. We do not knowingly collect data from minors.

7a. Regional Rights

If you are in the EEA, UK, or California, you may have additional rights over your personal data (including access, correction, deletion, and portability). Contact us at support@plysh.app and we will respond to verified requests within the timelines required by applicable law. Our services are hosted on infrastructure provided by Supabase and Amazon Web Services.

8. Changes

We may update this policy as the app evolves. We will notify you of significant changes via in-app notification or email.

9. Contact

Questions about your privacy? Reach us at support@plysh.app.