This policy explains what information Plotted collects when you use the map, create an account, or subscribe to Pro, and how that information is used, stored, and shared.
Plotted ("Plotted", "we", "us") operates the map and news-summarization service at app.plotted.live (the "Service"). This policy applies to everyone who visits the Service, whether or not you create an account.
Account information. When you sign up, our authentication provider (Supabase) stores your email, password credential, account identifier, and authentication metadata. Plotted separately keeps a record tied to your account for your email, subscription tier, reading activity, saved preferences, marketing choice, and Stripe customer and subscription identifiers. Supabase also records authentication events and related security metadata, such as your IP address and user agent.
Marketing preference. If you opt in at signup or in your account settings, we record that choice (and the time you made it) so we know who can be emailed product updates.
Payment information. If you subscribe to Pro, our payment processor (Stripe) collects and stores your card details directly — Plotted's servers never see or store your full card number. We keep only Stripe's customer and subscription identifiers, plus your subscription tier. When you view billing status, Plotted's server retrieves fields such as renewal date, amount, and card brand/last four digits from Stripe and returns them to you; Plotted does not persist those display fields in its application database.
Usage and analytics data. We record which map events you open or read and limited product events such as page, onboarding, story, source-link, sharing, and checkout interactions. We use a random reader-session identifier stored in browser or app storage and sent with API requests. Before sign-in, records can be associated with that identifier rather than an account. After you sign in, some session reading activity is merged into your account, and analytics requests can include both the session identifier and your account identifier. We also use Vercel's built-in analytics for aggregate page-view and performance metrics.
Location and map telemetry. If you choose the map's location control, the mobile app accesses your foreground precise or approximate location to center the map. Plotted does not retain those coordinates or send them to the Plotted API. The Mapbox mobile SDK separately sends de-identified location and usage telemetry to Mapbox by default when location is gathered. You can disable Mapbox telemetry from the attribution and information control shown on the map.
Diagnostics. When mobile diagnostics are enabled for a release, Sentry receives crash reports, performance traces, and technical context such as app and operating-system versions. Plotted configures the mobile SDK not to send default personal information, screenshots, view hierarchy, session replay, or profiling data.
Cookies and local storage. We use cookies to keep you signed in. These are not used for advertising or cross-site tracking. We also store a random session identifier in local storage for anonymous usage analytics, described above. If you complete a signup, login, or password reset, Cloudflare Turnstile (our bot-protection provider, described below) may set its own cookies and evaluate signals from your browser to verify you're not a bot. The mobile app stores session credentials in app-private secure storage and its random reader identifier in app-private local storage.
We do not sell your personal information. We share it only with the service providers that help us run Plotted, each acting under their own privacy and security obligations:
We may also disclose information if required by law, to protect the rights and safety of Plotted or our users, or in connection with a merger, acquisition, or sale of assets — in which case we'll make reasonable efforts to notify affected users.
We keep your account information for as long as your account is active. If you delete your account, Plotted deletes account-linked profile, preference, analytics, view, and reading records from its application database and requests deletion of the associated Supabase authentication and Stripe customer records. A provider may retain records where required for legal, tax, billing, security, or fraud-prevention purposes.
Usage records associated only with a random reader-session identifier are pseudonymous rather than anonymous. They may not be automatically matched to an account-deletion request unless they were previously linked to that account. Plotted deletes session-only reading records and raw product analytics events after 90 days. Account-linked reading records are kept while your account is active to synchronize read state and personalize your experience, and are deleted when you delete your account. Statistics that have been aggregated or de-identified so they can no longer be associated with a reader or account may be retained longer.
Depending on where you live, you may have additional rights under laws like the GDPR or CCPA, including the right to data portability or to object to certain processing. We'll honor applicable requests to the extent required by law — contact us and we'll respond.
Plotted is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we'll delete it.
We rely on industry-standard practices from our providers — encrypted connections, hashed passwords, and access-controlled infrastructure — to protect your information. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security.
Plotted's infrastructure is hosted with U.S.-based providers. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.
We may update this policy as the Service evolves. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly.
Questions about this policy or your data? Email us at useplotted@gmail.com.