← Back to app

This Privacy Policy explains how PlopIt Pte. Ltd. collects, uses, discloses and protects your Personal Data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). By accessing or using the Service, you agree to the collection, use and disclosure of your Personal Data as described in this Policy. We may update this Privacy Policy from time to time — the current version will always be available at this URL with a revised date at the top.

1. Organisation and Data Protection Officer

PlopIt is operated by PlopIt Pte. Ltd. ("we", "us", "our"), a company incorporated in Singapore. In accordance with the PDPA, we have designated a Data Protection Officer (DPO) responsible for ensuring compliance with our data protection obligations.

For all data protection queries, access requests, correction requests, or complaints, please contact the DPO directly. We will respond within 30 calendar days as required under the PDPA.

2. Scope and Applicability

This Privacy Policy applies to all users of PlopIt, including the website at plopit.co, the PlopIt mobile app and its share pop-up (the PlopIt option in your phone's share menu). It governs the collection, use, disclosure and storage of personal data in accordance with the PDPA and its amendments.

3. Personal Data We Collect

We collect only what is necessary to provide the Service:

• Google account information — When you sign in with Google, we receive your name, email address, Google account ID and profile picture via Google's OAuth 2.0 protocol. We store your name, email address and Google account ID in our database to run your account. Your profile picture is shown to you during your session but is not stored by us.
• Staying signed in (phone app) — When you sign in on the phone app, Google also gives PlopIt a long-lasting permission (known as a "refresh token") so that the app and its share pop-up can keep working without asking you to sign in again. We store this permission in our database in encrypted form, together with a random PlopIt session key that we store only in scrambled ("hashed") form. We use it only to get short-lived Google sign-in passes for the features you use. It is deleted, and cancelled with Google, when you sign out or delete your account.
• Account and usage records — We store your scan balance, any credits you have purchased, your subscription status, the date you accepted our policies, and a basic log of your scans (the date and time, the file type, and the number of events found). This log never includes the contents of your files or messages, or the events extracted from them.
• Home country and place searches (phone app) — If you set a home country, we store it with your account and use it to choose where to search for places and which time zone to use for your events. When you use "Pick exact place", the place name you search for and the country are sent to Google Places to find matching places; we do not store your searches. We keep short-lived counters to enforce daily place-search limits.
• Google Calendar access — With your explicit consent, PlopIt can create events in your Google Calendar when you choose to push them. After a scan, PlopIt also checks whether you already have events on the dates it found, so it can warn you about possible clashes ("Already something this day"). This check only looks at whether events exist on those dates; we do not store your calendar events. PlopIt does not edit or delete your existing calendar events.
• Uploaded files and shared messages — When you scan a file (PDF, Excel, Word, CSV, text or image), or a message you paste in or share to PlopIt from another app (such as WhatsApp or Telegram), its contents — the text, the image, or the PDF itself — are sent to Anthropic's AI service to extract calendar events. These contents and the extracted events are not stored on our servers at any point.
• Payment information — Payments on the website are processed by Stripe. Purchases in the PlopIt iPhone app are made through Apple's App Store and processed by Apple, and we use RevenueCat to confirm them. We do not receive or store your card details. We receive confirmation of payments, your subscription status, and an identifier linking your PlopIt account to Stripe. For iPhone purchases, your PlopIt account email is shared with RevenueCat so your purchases can be linked to your account, and we receive the purchase, renewal, cancellation and refund details needed to keep your scans and subscription up to date.
• Abuse-prevention data — To enforce usage limits (such as scans per hour, scans per day that find no events, and place searches per day), we store short-lived counters linked to a one-way scrambled ("hashed") version of your IP address or account. The original IP address is not stored in our database. These counters are automatically deleted, generally within 2 days.
• Communications — If you contact us, we receive the name, email address and message you send. If you subscribe, we may send you service emails, such as a notice when you are close to your fair use limit.

4. Purposes for Which We Use Personal Data

We use your personal data only for the following purposes:

• To sign you in with Google and keep you signed in, including in the phone app's share pop-up
• To process your uploaded files and shared messages, and extract calendar events using AI
• To create calendar events in your Google Calendar when you choose to, and to warn you about possible clashes
• To find the exact place for an event when you ask, and to use the right time zone for your events
• To manage your scan balance, purchases, subscription and fair use limit
• To send you service emails about your account
• To prevent abuse of the Service and keep it secure
• To respond to your support requests

We do not use your personal data for marketing, profiling, advertising, or sale to third parties.

5. Consent

Before using PlopIt, you confirm that you are 18 or older and agree to this Privacy Policy and our Terms of Service. Through your use of the Service — including signing in with Google, uploading files, sharing messages to PlopIt, searching for places, and pushing events to your calendar — you consent to us:

• Collecting, using, disclosing and processing your Personal Data for the purposes described in this Policy
• Sending the contents of your uploaded files and shared messages to Anthropic's AI service to extract calendar events
• Checking your Google Calendar for existing events on the dates found in your files, and creating calendar events when you choose to push them
• Storing an encrypted Google permission so the phone app can keep you signed in
• Sending your place searches to Google Places
• Disclosing your Personal Data to the service providers listed in Section 6, solely to operate the Service

6. Service Providers We Share Data With

We share data with the following providers solely to operate the Service. We do not sell, rent, or share personal data with anyone else.

Anthropic (AI processing, United States)
Receives the contents of the files and messages you scan, in order to extract calendar events. Your name, email address and Google account information are never sent to Anthropic. Under Anthropic's commercial terms, data sent through its API is not used to train its AI models. Anthropic automatically deletes API inputs and outputs within 30 days, except where content is flagged for violating its usage policies, in which case it may be kept for up to 2 years. See anthropic.com/legal/privacy.

Google LLC (sign-in, calendar and place search)
Provides Google Sign-In, Google Calendar and Google Places (used for "Pick exact place"). Your use of these is also governed by Google's Privacy Policy. See policies.google.com/privacy.

Google user data and Limited Use
PlopIt's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data (your Google account information, your Google Calendar access, and the permission that keeps you signed in) only to provide and improve the user-facing features of PlopIt described in this Policy. We do not sell Google user data, use it for advertising, or use it to train AI models, and we do not allow humans to read it unless you give us permission (for example, to help with a support request you send), it is necessary for security purposes, or it is required by law.

Vercel Inc. (hosting, United States)
Hosts the PlopIt website and servers. Your requests, including uploaded files and shared messages, pass through Vercel's servers while being processed, and Vercel collects technical data such as IP addresses and browser information as part of its hosting services. See vercel.com/legal/privacy-policy.

Neon (database, data stored in Singapore)
Stores your account and usage records described in Section 3, including your home country and the encrypted Google permission. Our database is hosted in Neon's Singapore region. See neon.com/privacy-policy.

Stripe (website payments)
Processes payments and subscriptions made on the website. Stripe receives the payment details you enter at checkout. See stripe.com/privacy.

Apple (iPhone app payments)
Processes purchases and subscriptions made in the PlopIt iPhone app through the App Store, under your Apple ID. Apple's handling of your payment information is governed by Apple's Privacy Policy. See apple.com/legal/privacy.

RevenueCat (iPhone purchase management, United States)
Confirms iPhone app purchases and subscriptions with Apple and tells our servers about them. RevenueCat receives your PlopIt account email (used as your purchase account ID), the products you buy, and purchase and subscription status from Apple. See revenuecat.com/privacy.

Resend (email delivery, United States)
Delivers service emails we send you, such as fair use notices. Resend receives your email address and the content of those emails. See resend.com/legal/privacy-policy.

Zoho (support email)
Hosts our support mailbox. If you email us, your message is stored in our Zoho mailbox. See zoho.com/privacy.html.

7. Overseas Data Transfers

Some of our providers process data outside Singapore, including Anthropic, Vercel, Resend and RevenueCat in the United States, Google, Apple, and Stripe, which may process payment data in the United States. Under the PDPA's Transfer Limitation Obligation, we take reasonable steps to ensure that overseas recipients provide a standard of protection comparable to the PDPA.

We use established providers whose terms include data protection and security commitments, and we limit what each one receives to what it needs: for example, Anthropic receives file and message contents but never your name or email address, and Google Places receives only the place name and country you search for. We have assessed these transfers to be reasonable given the limited data involved and the protections in place.

8. Data Retention

We do not keep personal data longer than necessary for the purposes it was collected for:

• Uploaded files, shared messages and extracted events — Never stored on our servers. Anthropic deletes them within 30 days (or up to 2 years if flagged for violating its usage policies).
• Account and usage records, including your home country — Kept while your account exists. When you delete your account using the Delete Account option, your PlopIt account, credits and scan history are deleted from our database. Records that payment providers must keep for legal, tax or accounting reasons are retained by them under their own policies.
• The encrypted Google permission and PlopIt session keys (phone app) — Kept while you stay signed in on the phone app. Deleted, and cancelled with Google, when you sign out or delete your account. If you remove PlopIt's access in your Google account, we delete our stored copy the next time the app tries to use it.
• Purchase records — Kept while your account exists, and by Apple, Stripe and RevenueCat under their own policies, including for legal, tax and accounting reasons.
• Place searches — Not stored. Daily search-limit counters are automatically deleted, generally within 2 days.
• Abuse-prevention counters — Automatically deleted, generally within 2 days.
• Sign-in on the website — Kept in your browser's session storage until you sign out or close the browser tab.
• Support emails — Kept only as long as needed to resolve your request and keep a reasonable record of it.

9. Your Rights Under the PDPA

Under the PDPA, you have the following rights:

• Right of Access — You may request information about the personal data we hold about you and how it has been used or disclosed in the past 12 months. We may charge a reasonable administrative fee for processing access requests.
• Right of Correction — You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Withdraw Consent — You may withdraw consent for the collection, use, or disclosure of your personal data at any time. Withdrawal of consent may affect our ability to provide the Service to you.
• Deletion — You can delete your PlopIt account at any time using the Delete Account option in the app.

To exercise any of these rights, contact our DPO at keith@plopit.co. We will respond within 30 calendar days. If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

10. Revoking Google Access and Withdrawing Consent

You may revoke PlopIt's access to your Google account and Google Calendar at any time without contacting us. Go to myaccount.google.com/permissions, find PlopIt, and click Remove Access. Revocation takes effect immediately, and the permission PlopIt stores to keep you signed in stops working at once.

If you withdraw your consent, we may be unable to continue providing the Service to you. Withdrawal of consent does not affect processing carried out before the withdrawal.

11. Browser Storage, Device Storage and Cookies

The PlopIt website uses your browser's storage to keep you signed in during your session and to remember that you have accepted our policies. The phone app stores the same information on your device, keeps its PlopIt session key in your phone's secure storage (the iOS Keychain), and shares that key, your home country and your time zone with its own share pop-up through a private storage area on your phone that only PlopIt can access. Google Sign-In may set its own cookies, governed by Google's Privacy Policy. We do not use cookies or device storage for advertising, tracking you across other websites or apps, or any purpose other than running the Service.

12. Anonymised Data

We may use anonymised or aggregated data — data that cannot reasonably be used to identify any individual, such as the total number of scans per day — for service improvement and statistical analysis. Such data does not constitute Personal Data under the PDPA.

13. Data Security

We implement reasonable security arrangements as required under the PDPA's Protection Obligation:

• All data is transmitted over HTTPS/TLS encryption
• API keys and credentials are stored in secure server-side environment variables and are never exposed in the website or app code
• Short-lived Google sign-in passes are sent to our servers only to verify your identity and to work with your calendar at your request; they are not stored in our database
• The long-lasting Google permission used by the phone app is stored encrypted (AES-256), and PlopIt session keys are stored only in scrambled ("hashed") form
• Administrative access to our systems is protected by two-factor authentication where available
• Our source code repository is private
• Usage limits and abuse protection are in place across the Service

No method of data transmission over the internet is completely secure, and we cannot guarantee absolute security. In the event of a data breach that is likely to result in significant harm or affects 500 or more individuals, we will notify the PDPC within 3 calendar days of making that assessment, and notify affected individuals as required under the PDPA.

14. Age Requirement

PlopIt is only for users aged 18 and over, and is not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has used PlopIt or provided personal data to us, please contact our DPO and we will delete their account and data promptly.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will update the "Last updated" date at the top of this page when changes are made. For material changes, we will notify users by email or within the Service where possible. Continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

16. Governing Law and Complaints

This Privacy Policy is governed by the laws of Singapore. If you have a complaint about how we handle your personal data, please contact our DPO first. If you remain unsatisfied, you may lodge a formal complaint with the Personal Data Protection Commission of Singapore:

• Website: pdpc.gov.sg
• Hotline: 6377 3131

17. Contact

• Organisation: PlopIt Pte. Ltd.
• Data Protection Officer: Keith Lee
• Email: keith@plopit.co
• Location: Singapore