PlotLuma Privacy Policy

1.1 Information from Google Sign-In

When you choose to sign in to PlotLuma using your Google account, Google shares the following information with PlotLuma via OAuth 2.0:

• Your email address — used to create and identify your PlotLuma account
• Your name — displayed in the PlotLuma interface
• Your Google account ID — used internally to link your account

PlotLuma requests the email, profile, and openid OAuth scopes for sign-in. If you optionally connect Google Drive from Settings, PlotLuma also requests the drive.file scope — which only allows creating and updating files that PlotLuma itself creates in your Drive (a PlotLuma folder). PlotLuma does not access your existing Drive files, Gmail, Google Calendar, or Contacts.

1.2 Information you provide

PlotLuma stores the pre-production content you create, including:

• Project titles and descriptions
• Scripts, scenes, and script annotations
• Shot lists, shot descriptions, and shot types
• Shot designer canvas diagrams and equipment layouts
• Storyboard sketches, notes, and (when Drive is connected) Drive file references for board PNGs
• Scene breakdown data (cast, props, locations, costumes)
• Pitch deck text and images, saved in the browser on the device where you edit them

Reports are generated from the project content above when you open them. PlotLuma does not keep a separate copy of a report.

When Google Drive is connected, the shoot checklist stores checkmarks, notes, and the files you add (such as call sheets, permits, releases, and insurance) in a Before the shoot folder inside that project’s folder in your Google Drive. Those checklist files are not copied into PlotLuma’s database.

All content you create in PlotLuma is private to your account and is not visible to other users.

1.3 Technical information

Standard server logs (IP address, browser type, request timestamps) are collected by PlotLuma's hosting providers, Vercel and Supabase, as part of normal infrastructure operation. PlotLuma does not use this data to track or identify individual users.

1.4 Android companion app

The Google Play companion app displays PlotLuma in a secure WebView and may open the system browser for Google Sign-In. It uses the same authentication and project data as the website. The app requests only the Internet permission. It does not access your contacts, photos, microphone, camera, or precise location. Local device storage may hold session tokens and UI preferences (for example, last selected project in overlay mode) so you stay signed in between launches.

PlotLuma uses the information collected for the following purposes only:

• Authentication — to verify your identity and maintain your login session
• Account management — to associate your projects and content with your account
• Service delivery — to display your project data back to you across devices
• Optional Google Drive sync — if you connect Drive, to write project archives, storyboard frames (combined PNG plus per-layer WebP images and metadata), and the shoot checklist (checkmarks, notes, and the files you add) into a PlotLuma folder in your Google Drive (you control that account). Storyboard drawing and the shoot checklist require Drive so those files stay in your storage
• Service communications — to send email confirmation when you register with email/password, and password-reset emails when you request them (no marketing emails are sent)
• Security — to investigate abuse, security incidents, or service errors

PlotLuma explicitly does not use your information, including any data received via Google sign-in, for the following purposes:

• Advertising — PlotLuma does not serve advertisements and does not use your data for targeted or personalised advertising
• Selling data — PlotLuma does not sell, rent, or transfer your personal data to data brokers or any third party for commercial purposes
• Creditworthiness or financial profiling — PlotLuma does not use your data to determine your creditworthiness, financial situation, or eligibility for financial products
• AI or machine learning training — PlotLuma does not use your content or personal data to train AI models, machine learning systems, or any automated profiling systems unrelated to the service
• Cross-site tracking — PlotLuma does not track your activity across other websites or apps
• Sharing with unauthorised third parties — PlotLuma does not share your Google user data with any third parties except as described in Section 5 (infrastructure providers required to operate the service)

PlotLuma's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

PlotLuma only uses Google account data (email, name, account ID) to:

• Create and authenticate your PlotLuma account
• Display your name within the PlotLuma interface

If you connect Google Drive, PlotLuma additionally uses the drive.file scope solely to write and update PlotLuma-created files in your Drive (project archives, storyboard shot folders, and each project’s Before the shoot checklist folder, under your PlotLuma folder). You can disconnect Drive anytime from Settings or revoke access at myaccount.google.com/permissions.

This data is not transferred to other parties, used for advertising, or used for any purpose other than providing the PlotLuma service to you.

PlotLuma does not sell your data. PlotLuma shares data only with the following infrastructure providers that are necessary to operate the service:

• Supabase (supabase.com) — database storage, authentication, and row-level security. Your project data and account information are stored in Supabase. See: supabase.com/privacy
• Vercel (vercel.com) — web application hosting and content delivery. See: vercel.com/legal/privacy-policy

PlotLuma may disclose information if required by applicable law, court order, or to protect the safety of users or the public.

PlotLuma protects your data using the following measures:

• All data is transmitted over HTTPS (TLS encryption in transit)
• Data stored in Supabase is encrypted at rest
• Row-level security policies in the database ensure each user can only access their own data
• Authentication tokens are signed and encrypted by Supabase Auth
• Access to the production database is restricted to authenticated application requests only

Despite these measures, no security system is completely infallible. We recommend keeping local backups of important production documents.

PlotLuma uses a single session cookie set by Supabase Auth to keep you signed in. This cookie contains a signed, encrypted session token. It does not contain your personal data and is not used for tracking.

PlotLuma does not use advertising cookies, analytics cookies, or any third-party tracking cookies.

PlotLuma retains your account information and project data for as long as your account remains active.

You may request deletion of some or all data without deleting your account at https://plotluma.com/data-deletion. You may also remove projects yourself in the app. Files already saved in your Google Drive, including project archives and the Before the shoot folder, stay in your Drive until you delete them there.

To delete your entire account and associated data, use https://plotluma.com/account-deletion (or Feedback & help → Account / data request). PlotLuma will permanently delete verified requests within 30 days.

Server logs held by Vercel and Supabase are governed by their respective data retention policies.

Depending on where you are located, you may have the following rights regarding your personal data:

• Access — you can view all your project data within the PlotLuma app at any time
• Correction — you can edit or delete your content directly in the app
• Deletion — request data deletion at /data-deletion, or full account deletion at /account-deletion
• Portability — request an export via Feedback & help
• Withdraw consent — you can revoke PlotLuma's access to your Google account at any time via myaccount.google.com/permissions

Users in the European Economic Area (EEA) and United Kingdom have rights under the GDPR. Users in California have rights under the CCPA. To exercise any of these rights, use Feedback & help in PlotLuma.

PlotLuma is not directed at children under the age of 13. PlotLuma does not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to PlotLuma, please contact us via Feedback & help and we will delete that information promptly.

PlotLuma may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes, we will update the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify users through the PlotLuma app interface or by email.

We encourage you to review this Privacy Policy periodically. Continued use of PlotLuma after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact PlotLuma via:

PlotLuma
Data deletion: https://plotluma.com/data-deletion
Account deletion: https://plotluma.com/account-deletion
In-app: Feedback & help (or Settings → Feedback & help when signed in)
Website: https://plotluma.com