Your data, protected

We never sell your personal data to third parties.

We never show your address publicly. It is used to verify your neighborhood and match you with people on your block, and it is released to a single buyer only once a hold is on their card for one of your orders — never on the map, never in search, never to anyone else. The one exception is your choice: a seller who publishes a storefront makes that storefront's business address public (see below).

We never use your email for marketing without your consent.

We do not run advertising or third-party analytics or tracking SDKs in the app, and we do not sell personal information. This website counts its own page views so we can see which pages people read and whether they had read the site before. To tell one reader from another your browser stores a random value for itself — no cookie is sent, nothing identifies you by name, it is hashed before we save it, it is never shared with anyone, and clearing this site's data ends it.

Storefronts count how often they are viewed and how often visitors tap for directions, call, open the website or save the store to plan a visit. These are totals per store per day; they do not record who looked. The store's owner sees the totals and gets them in a monthly email.

A seller's exact address is never on the public map. Sellers appear as a sector roughly 500 meters across, centered away from their door, so browsing the map cannot identify anyone's home.

The exact address, porch instructions and driveway notes are released to one buyer, for one order, at one moment: when the hold is placed on their card. That buyer can see it, in that order's chat, until the pickup is complete. If the order is never picked up, it closes 7 days after the order is set out, or 7 days after the hold is placed if the order is never set out. It also closes if the order is cancelled, refunded or goes to a dispute. If the card hold is never placed, no address is ever shown.

Storefronts are different by design. A seller on the Storefront plan can publish a storefront for a shop, farm stand or butcher that customers visit in person, and its address is shown to everyone, on the Storefronts map, in search and on the web. Only the address the seller enters for the storefront is shown; their porch address stays private. Unpublishing the storefront, or ending the Storefront plan, takes it off the map.

Sellers take a GPS reading during verification to confirm they are at the address they listed, and can place the pin for their porch from their current location. Anyone may share location so the map, search and pickup radius can center on where they are, and to fill in their ZIP code — that reading is used for the request and not stored. We do not track location in the background, and the app never reads your location while it is closed.

Only with the people and services an order needs. Your counterparty in an order sees your display name, your verification badge, your reviews, and — once the hold is on the buyer's card — the seller's address. Nobody else on the marketplace sees any of that.

We use service providers to run the product: Supabase (hosting, database and file storage); Expo, Apple and Google (push notifications and app updates); Apple Maps and Google Maps (map rendering); Stripe (payments, seller payouts and identity checks); Google Gemini (reading food handler certificates); MailerLite (our newsletter, only if you sign up for it); and Resend (support email). They process data on our instructions and for no purpose of their own.

We disclose information to law enforcement only where the law requires it, and to an acquirer if the business is ever sold, in which case this policy travels with it.

Order records, including the address that was revealed, are kept while the order is open and afterwards for as long as tax and cottage-food record-keeping require. Sales tax records for completed purchases are kept for at least four years, as tax law requires, even after an account is deleted. Messages stay with their order. Reviews and posts stay until you delete them or you delete your account. Push tokens are dropped as soon as a device stops accepting them.

Some files are deleted on a schedule, checked every day:

• Your photo ID, selfie and face scan: 30 days after the ID check is decided, whether it passed or not, we have Stripe delete them. A utility bill you upload to confirm your address is deleted 30 days after it is checked. We keep only the result of each check and the date it was decided.
• Food handler certificates, licenses and permits: the file is kept while the document is current, and deleted one year after it expires, is rejected, or is replaced by a newer one. We keep the record of what we verified — the type of document, its number and its dates — but not the image.
• Label sheets you print from the app: deleted 90 days after they are made. You can print them again at any time.

When you delete your account, all of these go with it: your ID images are deleted at Stripe, and your uploaded files and label sheets are deleted from our storage within a day of the account being removed.

If an email address bounces or reports our mail as spam, or we are asked to stop emailing it, we keep that address on a do-not-email list, even after the signup or account is deleted, so that we never mail it again.

Inviting neighbors: when you choose "Pick from contacts", your phone shows its own contact picker. Only the one person you pick is used, to fill in a text or email that you send yourself. Your contacts are never uploaded to Plut or stored by us.

You can edit your profile, change your radius, turn any notification category off, set quiet hours, and delete your listings or posts at any time from the app.

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account by writing to support@theplut.com. We answer within 30 days. You can also delete your account yourself in the app, under Profile → Settings, or at theplut.com/delete-account. Deleting your account removes your profile, addresses, listings, posts, comments, points, verification records and the files you uploaded, takes you off our mailing lists, and replaces the text of messages you sent; order records that we are required to retain are kept without your profile attached to them.

If you are in California, the EEA or the UK, you have rights over your personal information under your local law — access, correction, deletion, portability, and objection to certain processing. Write to the same address and we will honor them without charging you or treating you differently for asking.

Plut is not for children. You must be 18 or older to buy or sell here, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to us and we will remove it.

Data is encrypted in transit and at rest. Access to a row in our database is decided by the database itself rather than by the app asking nicely: a buyer cannot read another buyer's order, and an address cannot be read before the hold is on the buyer's card. Operators who resolve disputes work in an audited console.

If this policy changes in a way that affects what we collect or who sees it, we will say so in the app before the change takes effect, and the date at the top of this page will move.

Plut LLC — support@theplut.com