We collect the following information when you use PlainSec:
Account information: email address, name, avatar, and profile details you provide through email registration, Sign in with Apple, Google sign-in, or GitHub sign-in via Clerk. Sign in with Apple can share an Apple relay address in place of your email.
Preferences: language, timezone, focus areas, region, and vendor selections you configure in your profile.
Usage data: cookieless web analytics such as pages visited, briefing engagement, and email link attribution. When you use MCP, we also collect authorization outcomes, OAuth client identifiers, MCP client name and version hints, tool names, success or error outcomes, and durations. MCP analytics uses pseudonymous user and connection keys and does not include tokens, prompts, tool inputs, or returned content.
Contact form: if you use it, your email address, your name if you give it, and your message.
How We Use Your Information
We use your information to:
Publish the cybersecurity briefing on the web and deliver it by email at 7:00, Monday to Friday.
Personalize briefing content based on your industry and technology preferences.
Send service-related communications such as briefing delivery and account notifications.
Cookies
PlainSec uses essential cookies for authentication session management (via Clerk) and theme preferences. PostHog web analytics runs without persistent browser storage and honors browser Do Not Track. We do not use third-party advertising or tracking cookies.
The iPhone App
The PlainSec iPhone app uses the same account and the same sign-in options as the website. It connects to the PlainSec API, Clerk for sign-in, PostHog for feature settings and notification events, Sentry for crash reports, and Firebase Cloud Messaging for notifications. It shows no advertising and does not track you across other companies' apps or websites.
Set-up: the app reads your iPhone's language and time zone to set your briefing language and region. You can change both later.
Reading activity: as on the website, the stories you open, the briefings you have seen, and your audio plays are stored with your account. They mark what you have read and count plays toward the weekly play limit on Free. Our servers also send briefing opens and audio plays to PostHog as analytics events linked to your account.
Crash reports: when the app crashes or an action fails, it sends Sentry a report with the error type, where in the app's code it happened, the app version, the iPhone model, and the iOS version. Reports carry no name, email address, or account ID and are not linked to your account. Sentry is set not to store your IP address or a location derived from it.
Briefing email: creating an account in the app subscribes your email address to the briefing email, as it does on the website.
Feature settings: when you sign in, the app sends PostHog your account ID and whether it is a PlainSec team account, to learn which features are on for your account. The app keeps PostHog's answer on your iPhone until you sign out.
Notifications: the app delivers notifications through Firebase Cloud Messaging, Google's notification service. If you allow notifications, the app registers your iPhone with Firebase and links its notification token to your account so we can send you alerts. The app sends PostHog, linked to your account and with the app version, whether you allowed notifications and each alert you open or receive while the app is open.
Third-Party Services
We use the following third-party services to operate PlainSec:
Clerk: authentication and user account management.
Brevo: email delivery for briefings and contact-form messages.
Cloudflare: web hosting, CDN, and DDoS protection.
PostHog: cookieless web analytics, usage events linked to your account, feature settings and notification events for the iPhone app, and pseudonymous MCP usage analytics.
Sentry: crash reports from the iPhone app.
Firebase: notification delivery to the iPhone app.
Stripe: subscription billing and payment processing for PlainSec Pro.
Data Retention
We retain your account data for as long as your account is active. Usage analytics and briefing delivery logs are retained for up to 90 days. You can delete your account at any time, on the website or in the iPhone app. Deleting it removes your account data, your sign-in account at Clerk, and your email contact at Brevo. Analytics events already recorded are not removed with it and expire within those 90 days. You may also request deletion of your account and associated data, including analytics linked to your pseudonymous MCP key, at any time by contacting us. Contact-form messages are kept in our mailbox only as long as we need them to handle your request.
Your Rights
You have the right to:
Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and personal data.
Unsubscribe from email briefings at any time via the unsubscribe link in each email.
Object to or request restriction of non-essential usage analytics associated with your account.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the Service after changes constitutes acceptance.
Contact
For privacy-related questions, contact us at privacy@plainsec.com.