Privacy policy

1. What we collect

• Account data. Your email address, your business name, and the plan you are on.
• Site and brand data. The website you connect and the public pages we read from it to build your brand brief and content plan.
• Channel credentials. The access tokens or application passwords you provide so we can publish to your site or social accounts.
• Content records. Drafts, sources, revisions, your approval decisions and the resulting published URLs.
• Inbox records. When you connect a social network, comments and reviews left on the posts we published for you, and direct messages sent to your connected account: the message, the public handle of whoever wrote it, and when. We hold them so you can read and answer them in one place. Message text is deleted after 90 days, or sooner for some networks (section 6 lists them), and the writer's handle is deleted with it; your own replies are kept for 400 days; a network's inbox, and the credentials stored for it, are deleted when you disconnect it.
• Device sign-in records. If you sign in by approving from a device you are already signed in on, we keep one short record of that request: a one way hash of the code and of the waiting device's own secret (never either value itself), the browser and platform the waiting device reported such as Safari on iPhone, which of your accounts approved or refused it and when, the country that answer came from, and when the waiting device completed the sign-in. It is kept for one day.
• Operational logs. Request and job records needed to run the pipeline, diagnose failures and prevent abuse.
• Payment data. Handled by our payment processor. We receive a customer reference, the plan, and the status of the subscription. We do not receive or store your full card number.
• Referral records. If you arrive from a partner link, the partner code on that link and the address of the page that sent you, reduced to the site and the path. These are kept with your account so that the partner can be credited. Section 8 describes the cookie they are read from.
• Advertising records. If you arrive from a Reddit advertisement, the click identifier that Reddit put on the link. It is kept with your account so that Reddit can be told whether the advertisement led to a customer. It is the identifier Reddit created, not one we made, and nothing else about you is recorded with it. Section 8 describes the cookie it is read from.

2. Why we collect it

To run the service you asked for: to research and write content in your voice, to publish it to the channels you connected, to keep a record of what you approved, to bill you, and to support you when something breaks. We also use aggregate usage data to find and fix problems.

That includes reviewing how a piece was produced, which means its brief, the sources fetched, the drafts, the results of the automated checks, the reviewing model's report and the published result. The review is carried out by us, including by automated tooling, for three purposes: to find and fix faults, to check quality, and to improve how the service works. Section 3 below still applies to it, and the full clause is section 6 of the terms of service.

3. What we do not do

• We do not sell your data.
• We do not use your business content to train our own models.
• We do not place advertising or third-party tracking scripts on this marketing site. The measurement described in section 8 is self-hosted and is served from this domain. We do advertise, and section 9 describes exactly what that sends and when; it is done by our server after the fact, so no advertising company receives anything from your browser.

4. Credentials

Channel credentials are encrypted at rest with AES-256-GCM and are decrypted only at the moment they are needed to publish on your behalf. They are never shown back to you in full, never written to logs, and never shared with a third party other than the platform they authenticate against. Revoking a connection from your side stops us using it immediately.

5. Processors we rely on

Running the service means using other providers. Each receives only what it needs for its function, and this is the current list rather than a promise of one.

• Cloudflare. Hosting, the database, file storage and the AI models that draft and review content. Everything the service stores passes through it.
• Stripe. Payments. Card details are entered on Stripe's own checkout and are never seen by or stored on our systems.
• Resend. Transactional email, which includes your sign-in links and the notifications you have turned on.
• Upload-Post. Publishing to social networks, and only for accounts that have connected one. It holds the authorisation for the networks you connect, and, for accounts that use the inbox, it relays the comments, reviews and messages left on those accounts. Some networks are connected directly instead (currently Bluesky, Discord, Mastodon and Telegram): the credentials you give us for them are stored encrypted on our own systems and never passed to Upload-Post.
• Human review, only if you add it. A reviewer reads your drafts and the social posts written from them before they reach your queue, inside the platform, under a written agreement that keeps what they see confidential and limits its use to the review.
• Reddit. Advertising measurement, and only for visitors who arrived from a Reddit advertisement and agreed to the cookie in section 8. It receives the click identifier it created and the fact that a sign-up or a payment happened. It receives no email address, no name, no account details and nothing about your device, and no Reddit code runs on these pages.

Research and indexing also send topic queries and published page addresses to outside services, including a search provider and the suggestion endpoints operated by Google, Microsoft Bing and DuckDuckGo. Those requests carry the subject being researched, not your personal data.

6. How long we keep it

• Account and billing records: while you have an account, then as long as tax law requires.
• Content, sources and approval records: while you have an account. Approval records are retained because our publishing controls depend on them.
• Inbox records: the text of a comment, review or message somebody else sent, and the handle of whoever wrote it, are deleted 90 days after it was posted, or sooner for these networks:
  • X mentions: text and the writer's handle deleted after 30 days, because a copy older than that can no longer be checked against X.
  • LinkedIn comments: text deleted after 48 hours, the writer's handle after 24 hours, as LinkedIn's own rules require.
  • Google Business Profile reviews: text and the writer's handle deleted after 30 days, as Google Business Profile's own rules require.
  When a post is removed from the network within 30 days of being published, the stored comments on it are deleted once the next check finds it gone, and a recent mention deleted on X is deleted here once the next check finds it gone. For LinkedIn and Google Business Profile the whole record is deleted at the limit; for the other networks the record of it stays without the text so your counts and dates remain right. Replies you sent, and the record of sending them, are kept for 400 days. A network's inbox, and the credentials stored for it, are deleted when you disconnect it; where other networks are still connected through the same posting provider, the provider keeps its link to the account until the last of them is removed. The data deletion page sets this out network by network.
• Operational logs: a short rolling window, then deleted.
• After you close your account: working data is deleted within 30 days, except records we are required to keep.

7. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to a particular use. Emailhello@plainquill.com, which the dashboard also links to, and we will respond within 30 days. The data deletion page sets out how to ask for deletion, what is deleted and when. The email route is here because a right you can only exercise from inside an account is not much of a right: the people most likely to read this page are deciding whether to hand anything over at all, and someone who has already deleted their account has no dashboard to ask from. If you are in the UK or the EU, you also have the right to complain to your data protection authority.

8. This website

This section changed on 21 August 2026. Until that date it said that these marketing pages set no cookies and ran no analytics, and that a notice would appear here before that changed. Analytics was added on the same day this section was rewritten, so the change is recorded here rather than announced in advance. What follows describes what runs now.

This section changed again on 23 August 2026, and the change is a correction rather than an addition. Until that date this section said that no third party received a measurement and that opening a page here contacted no other host. Both were untrue, and had been since analytics was first added. A second measurement was running that nobody here had recorded, described below. It is disclosed now, and the sentences that were wrong are gone rather than softened.

This section changed on 30 September 2026, when a theme switch was added to these pages. Until that date this section said that these pages set no cookies, which was true. They now set one, and only if you use the switch. It is described below in a paragraph of its own, and the sentences that said there were none have been changed rather than left to contradict it.

This section changed again after 30 September 2026, when more of the actions on these pages, on the blog at /blog and in the dashboard began to be counted, and when measurements sent by automated tools began to be discarded. Each is listed below where the measurement is described. Nothing new is stored about you, no cookie was added, and no other party receives anything.

There are two measurements on these pages, and they are different in kind.

The first is ours and it is self-hosted. The measurements go to infrastructure operated for this service rather than to an analytics company. It is served first-party, which means that both the measurement script and the endpoint that receives a measurement are requested from this domain and from nowhere else.

The second is not served from this domain, and that is the part the earlier wording got wrong. A browser loading a page here also contacts the host below. Each of these is cookieless and records how the page performed rather than anything about you.

• Cloudflare Web Analytics, requested from cloudflareinsights.com. It measures how quickly pages load for real visitors.

Cloudflare serves this website and is already named in section 5, so this adds no company to that list. What it adds is a host your browser talks to, which is why it belongs here as well.

Neither measurement sets a cookie or gives you an identifier that could be used to recognise you on another website.

This is what a measurement records, in full. The address of the page. The address of the page that linked to it, where a browser sends one. The country the request came from. The kind of browser, operating system and device. Where a link carried campaign parameters, those parameters. When you click a call to action, the name of that action, the address it leads to and, where the button chooses a plan, which plan and billing interval it belonged to, so that an enquiry can be told apart from a returning customer signing in. The same is recorded, and nothing more, when you follow a link to one of our social profiles, switch the language or the colour scheme, open or close a question on the pricing page, choose monthly or annual prices there, or, on the blog at /blog, open a post from the list or go back to it; the blog is counted in the same measurement as the rest of this website as well as in its own. And when the address you asked for does not exist, the fact that the page was not found. A measurement sent by an automated tool rather than a browser is discarded before it is recorded.

Your IP address is not stored. It is used to derive the country and to count you once for the day, in a form that cannot be linked to the following day, and is then discarded. There is no record of an individual visit, and nothing that could be followed from here onto anyone else's website.

The one cookie these pages set, and only if you ask for it. The switch at the top of every page of this website, in the menu on a phone, chooses between Auto, Light and Dark. The blog at /blog has no switch of its own and follows the choice you make here. Auto is where every visitor starts: the pages follow your device's own setting, and nothing is stored. Choosing Light or Dark sets one cookie, __Host-pq_theme, which holds the word light or the word dark and nothing else. Its only purpose is to open these pages in the colours you chose the next time you visit. It lasts 365 days from the last time you chose. Your browser sends it only back to the address that set it, plainquill.com, and never to the dashboard at app.plainquill.com or to any other address. No script on the page can read it: the server that sends you these pages reads it to choose their colours, and nothing else of ours reads it. The first measurement above never receives it, because the server that passes a measurement on removes every cookie before it does. Your browser may send it along with the second, as it does with any request to plainquill.com, and Cloudflare states that its measurement uses no cookies. It is not shared with anyone. Choosing Auto deletes it. You do not need it to use this website.

The dashboard at app.plainquill.com also records a few moments, and these are all of them: an email address being submitted for a sign-in link, and whether that was on the sign-up form or the sign-in form; the first time you click into the email box on either form; an address being refused, and whether it was not a valid address, too many requests or a fault on our side; a sign-in link being opened, or failing because it had expired or could not be used; a sign-in on another device being completed with a code you approved; a new account being created; a checkout being started; a payment completing; your return from a completed payment; and your return from a checkout you left without paying. Each one records the name of the moment, the address of the page it happened on, and, where the plan or the billing interval was part of it, which they were. It also records a few plain facts about the moment itself: whether the account was new, whether the link that brought you carried a partner code, the state the payment processor reported the subscription to be in, and, on your return from a completed payment, the amount that was charged. No email address, no account identifier, no partner code and nothing about what is in an account are ever part of it. Moments from our own accounts and from automated tools are not recorded.

These are recorded by the server rather than by your browser. They set no cookie, load no script and add no other host to any page. Your IP address is used exactly as it is above, to derive the country and to count you once for the day, and is then discarded. The payment-completed record is sent by our own server after the payment processor tells us the payment succeeded, so it carries no address and nothing about your device at all. The record of your return from a payment is made while your browser loads the page it returns to, and is treated like the other moments above.

The dashboard is a separate application and it does use cookies. There are five, and all of them are first-party.

• Sign-in cookies. A session cookie, together with the short-lived cookies the sign-in exchange itself requires. These are strictly necessary to sign you in and to keep you signed in.
• A referral cookie, pq_via. Set only if you reach the dashboard through a partner link. It lasts 60 days and holds two things: the partner code that was on the link, and the address of the page that sent you, reduced to the site and the path with the query string removed. It holds no IP address, nothing about your device, and no record of the individual visit; a click on a partner link adds one to that partner's total for the day and nothing else is written. It identifies nobody, and it is never used for advertising or for building a profile of you. Its only purpose is to credit the partner if you go on to open an account: it is read on the sign-up and sign-in pages, so that the code survives an email link opened on another device, and it is applied once, when the account is created. It is not strictly necessary and you do not need it in order to use the service. It cannot be used to follow you around other websites: it is sent only to this service, and the page cannot read it.
• A consent cookie, pq_via_consent. It holds one word, which is your answer about the referral cookie above, and nothing else. It is strictly necessary and it is set whichever way you answered, including when you said no: remembering a refusal is how a refusal is honoured, and a site that forgot it would ask you again on the next link. It lasts the same 60 days as the answer it records.
• An advertising cookie, pq_adclick. Set only if you reach us from a Reddit advertisement. It holds the click identifier that Reddit put on the link, the name of the platform, and the moment you arrived. It lasts 30 days, which is the longest window Reddit measures a click over. It holds no name, no address, no IP address and nothing about your device, and the page cannot read it. Its only purpose is described in the paragraph below. It is not strictly necessary and you do not need it in order to use the service.
• A second consent cookie, pq_adclick_consent. Your answer about the advertising cookie above, and nothing else. It is separate from the referral answer on purpose: agreeing to credit a partner is not the same decision as agreeing to measure an advertisement, and we will not read one as the other. It is strictly necessary, it is set whichever way you answered, and it lasts the same 30 days as the answer it records.

Where the law requires consent, we ask before setting the referral cookie. Visitors in the European Union, the rest of the European Economic Area and the United Kingdom, and anyone whose location our network cannot determine, are shown a plain page that explains the cookie and offers two answers, and nothing is stored until one of them is chosen. Saying no is a complete answer: no referral cookie is set, then or later, and you are not asked again. The page carries no scripts and no trackers of any kind.

A partner link to a page on this marketing site is the same story from one step further back. The link sends you to the dashboard for a moment so that it can ask, or set the cookie where no consent is required, and then returns you to the page you were reading. These marketing pages do not set the referral cookie themselves: it belongs to the dashboard, and the only cookie this site writes is the theme choice described above.

9. Advertising, and what we send back to Reddit

This section was added on 1 September 2026, on the day advertising was bought and before any advertisement ran. It describes a measurement that is new, so it is recorded here in its own section rather than folded into the one above, which is about how these pages measure themselves.

We advertise on Reddit, and we measure it from our own server. When Reddit sends someone here from an advertisement it puts a click identifier of its own on the address, so that it can later be told whether that click led to anything. We store that identifier in the first-party cookie pq_adclick described in section 8, for 30 days.

If you go on to become a customer, we send Reddit that identifier together with the fact that a sign-up or a payment happened, and for a payment the amount. That is the whole of it. We do not send your email address, your name, your business, your IP address, anything about your device, or anything about what is in your account. The only thing about you that leaves us is Reddit's own identifier coming back to it.

No Reddit code runs on any page here. There is no advertising pixel, no tag manager and no script from any advertising company on this site or in the dashboard. Your browser never contacts Reddit because of us. The report is made by our server, once, after the fact, which is why section 3 can still say that this site carries no third-party tracking scripts.

Where the law requires consent, we ask first, exactly as we do for the referral cookie. Visitors in the European Union, the rest of the European Economic Area and the United Kingdom, and anyone whose location our network cannot determine, are shown a plain page that names Reddit, says what would be stored and says what would later be sent. Nothing is stored until an answer is given. Saying no is a complete answer: no identifier is kept, nothing is ever reported to Reddit about you, and you are not asked again. That page carries no scripts and no trackers of any kind.

10. Children

PlainQuill is a business service and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Contact and changes

PlainQuill is operated by MaximizeMy.Business LLC, which is the controller of the personal data described in this policy.

Write to hello@plainquill.com with any privacy question, including a request under section 7. You do not need an account to use it, and it is the right address if you are deciding whether to create one. Customers can also reach support through the dashboard. When we change this policy we will post the updated version here with a new effective date, and we will notify active customers of material changes.

Effective 30 September 2026, with the later change to section 8 described at the start of that section. This policy applies now, because the service is already collecting the things described above.