Privacy Policy

Last updated: July 5, 2026

PlopKit is a project operated by an individual based in Canada. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

By using PlopKit, whether as a site owner (publisher) or as a commenter on a site that embeds a PlopKit widget, you agree to the practices described in this policy.

1. Who This Policy Covers

This policy applies only to the hosted version of PlopKit at plopkit.com. If you run a self-hosted instance, this policy does not apply — you (the operator) are responsible for your own privacy practices and any applicable legal obligations regarding data collected through your instance.

This policy applies to two groups of people:

Publishers: people who sign up at plopkit.com to create and manage comment widgets for their websites.
Commenters: people who post comments through a PlopKit widget embedded on a publisher’s website. Commenters do not need to have a PlopKit account and may never visit plopkit.com directly.

2. Information We Collect

Publishers

When you create a PlopKit account, we collect:

Your email address, collected either via Google OAuth or when you sign in using a magic link sent to your email
Your name and profile image, if you sign in via Google OAuth (not collected for magic link sign-in)
Your profile image if provided by your OAuth provider
Your session data (a session token stored in a cookie to keep you signed in)
The sites and widgets you create within PlopKit (site names, domains, widget configuration)
Your subscription plan (free, hobby, or pro) and monthly widget load counts for billing and quota purposes

We do not collect or store your OAuth provider password. Authentication is handled entirely through the OAuth provider (e.g. Google).

Payment information (such as credit card details) is collected and processed directly by Stripe. PlopKit never sees or stores your payment details.

Commenters

When someone posts a comment through a PlopKit widget, we collect:

The name (optional)
The comment body (the text of the comment)
The page URL where the comment was posted
The origin or referrer header from the request, used to verify the comment came from a legitimate source
A commenter display ID — a short identifier derived from a randomly generated browser ID, used to visually identify which comments belong to the same commenter and to authorize comment deletion. The underlying secret never leaves the browser; only the derived display ID is stored on our servers.

We do not collect commenter email addresses, or any account information. Comments are posted anonymously unless the publisher is commenting on their own site, in which case their comment is marked with an owner badge.

IP Addresses

We use IP addresses for rate limiting to prevent comment spam. IP addresses are held temporarily in server memory only and are never written to a database or stored on disk. They are cleared whenever the server restarts.

Analytics

We do not currently use any analytics tools. If we add analytics in the future, we will update this policy to disclose the specific tool(s) used, what data they collect, and how you can opt out where applicable.

3. Cookies

PlopKit uses a session cookie to keep publishers signed in. This cookie is set by Better Auth, our authentication library, and is strictly necessary for the platform to function. It does not track you across other websites.

The PlopKit widget does not set any cookies, but it does use browser localStorage to remember a commenter’s display name and commenter identity (a randomly generated ID used to identify comments made from the same browser and to allow commenters to delete their own comments). This data is stored locally in the commenter’s browser and is never transmitted to our servers unless they post a comment or request a deletion.

We do not use advertising cookies or third-party tracking cookies.

4. How We Use Your Information

We use the information we collect to:

Authenticate publishers and maintain their sessions
Operate the comment widget (store, moderate, and display comments)
Enforce rate limits to prevent spam and abuse
Track monthly widget loads for plan quota enforcement
Process subscription payments through Stripe
Respond to support or privacy inquiries

We do not sell your data. We do not use your data for advertising.

We do not sell or share your personal information with third parties for their own purposes. We do work with the following third-party services:

Google OAuth — used for publisher sign-in. Subject to Google’s Privacy Policy.
Stripe — used to process subscription payments. Your email address is shared with Stripe to create a billing account. Stripe may collect additional information directly from you during checkout. Subject to Stripe’s Privacy Policy.
Our email provider — used to send transactional emails to publishers, including magic link sign-in emails, welcome emails, and account deletion notices.
DigitalOcean — our hosting provider. Your data is stored on a DigitalOcean server located in a DigitalOcean data centre. Subject to DigitalOcean’s Privacy Policy.

6. Data Retention

Publisher account data: Kept until you delete your account

Sites and widgets: Kept until you delete them or your account

Approved comments: Kept until deleted by the publisher or you delete your account

Pending comments (awaiting moderation): Automatically deleted after 30 days if not approved

Soft-deleted comments: Permanently deleted after 7 days

Session cookies: Expire when you sign out or the session expires

IP addresses (rate limiting): In-memory only, cleared on server restart, never persisted

Billing and subscription data: Subscription records are managed by Stripe and retained according to Stripe’s data retention policy. Monthly widget load counts are reset on the 1st of each month.

When a publisher deletes their account, all associated data is permanently deleted in a cascade: sites, widgets, widget settings, and all comments are removed from our database. Stripe subscription and billing records are subject to Stripe’s own retention policies.

7. Your Rights (PIPEDA — Canada)

As a Canadian user, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):

Access: you can request a copy of the personal information we hold about you
Correction: you can ask us to correct inaccurate information
Withdrawal of consent: you can delete your account at any time, which permanently removes all your data
Complaint: if you believe we have mishandled your personal information, you can file a complaint with the Office of the Privacy Commissioner of Canada

Publishers can delete their account directly from the Account page in the PlopKit dashboard.

8. Children’s Privacy

PlopKit is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

10. Contact

If you have any questions or concerns about this Privacy Policy, please contact us at:

[email protected]