Privacy Policy

Last updated: 2026-10-20

This page explains what Plopino (plopino.com) stores when you use it, and why. It covers the person running the service (the “operator”) as well: the operator can see the data described here.

1. What is stored

If you create an account

• your username and email address;
• your password, stored only as a salted scrypt hash — never in readable form;
• your role, sign-up date, last login date, and last visit date;
• the IP address of your most recent login.

If you sign in with Google or GitHub

Those providers tell us your email address and a provider account identifier. We do not receive your password for those accounts, and we do not post anything on your behalf.

When you upload

• the files themselves, and the board they belong to;
• the IP address and browser (User-Agent) the upload came from;
• the upload time, and the times of any later updates or versions.

IP and browser are recorded on uploads so that abuse — phishing, malware, spam — can be traced and removed. A random first-party browser identifier also lets you claim anonymous uploads when you sign in.

We also record product actions such as entering a publishing flow, starting or failing an upload, successful publication, updates, registration and claiming a page. These records contain timestamps, a hashed browser identifier or account ID, board IDs, client type, a coarse entry name, campaign labels and error codes. They do not contain the uploaded content, passwords, claim credentials, raw IP addresses or complete referring URLs. When you claim a page, its recorded anonymous identity can be associated with your account so that one publisher is not counted twice. Internal testing is marked separately.

When you send feedback

The message you write, the email address you choose to provide, and the page you were on are stored so the operator can read and reply. If you are signed in, the message is also linked to your account and username. Feedback does not store your IP address or User-Agent. To limit spam, the server keeps only a daily counter keyed by IP address; it resets the next day.

When you visit

The service uses a self-hosted Umami instance to count visits. It receives the page address, referrer, IP address and User-Agent, plus the screen size and browser language reported by the page’s own script. Known bots are filtered out. There are no third-party advertising or cross-site tracking scripts on this site.

2. Cookies

Plopino uses first-party cookies and browser storage:

• gw_session — keeps you signed in. HttpOnly, SameSite=Lax, and sent only over HTTPS.
• boards_lang — remembers the language you picked. No identifier inside.
• boards_anon — a random value used to connect publishing steps and anonymous uploads, so they can be attached to your account when you sign in. Product records store a hash of this value.
• boards_ui — remembers how to display your sign-in status; it does not authorize access.
• boards_internal and umami.disabled — mark internal testing and disable browser analytics on that browser.
• plopino.firstTouch in local storage — remembers a referring domain or campaign labels for up to 90 days. It contains no full referring URL.

These identifiers are used within Plopino, not for cross-site advertising.

3. Who else sees it

• Cloudflare — sits in front of the site and processes every request to serve it and to absorb attacks.
• The hosting provider — stores the server’s disk, including uploaded files and the account database.
• Google or GitHub — only if you choose to sign in with them, and only for the sign-in step.

Your data is not sold, rented, or shared for advertising. It may be disclosed if required by law, or where necessary to investigate abuse.

4. How long it is kept

• Files — kept until the board expires or is deleted. An expiry can be set on any board, and expired boards are removed from disk. Boards with no expiry set are kept indefinitely.
• Deleted boards — removing a board from your account hides it and its link straight away; the files stay on disk until the operator purges them.
• Account data — kept while the account exists. Ask to have it deleted (see below).
• Analytics — retained by the Umami instance; it holds aggregate traffic data, not profiles.
• Product action records — kept in the account database until removed during maintenance or in response to a deletion request. These records can be associated with an account after an anonymous board is claimed.
• Feedback — kept until the operator deletes it. Signed-in users can see replies on the feedback page.

5. Your choices

Write to abuse@plopino.com to ask for a copy of what is stored about your account, to have it corrected, or to have the account and its data deleted. Requests are answered as quickly as the operator can manage. You can also delete your boards yourself at any time from My Boards.

You can also use the feedback form for questions or requests.

6. Children

The service is not intended for children under 13, and accounts are not knowingly created for them.

7. Content you publish

Boards are public by default, and anyone with the link can read them. Uploaded files can also be indexed or copied by third parties once shared. Do not upload anything you would not want to be public. A board can be made private from My Boards, which restricts it to your account and the operator.

8. Changes

This policy may be updated; the date at the top of the page shows the current version. Significant changes will be reflected here before they take effect.

9. Contact

Privacy questions or requests: abuse@plopino.com.