Privacy Policy
Plaza is a local-first desktop application. We designed it to keep your data on your own machine. This policy explains the limited personal data involved in buying, licensing, and updating Plaza.
1. Your project data stays with you
Plaza does not collect, transmit, or store the contents of your projects. Your files stay on
your own storage; Plaza writes its metadata to a hidden .plaza/ folder next to
them. If you sync that folder with a third-party service (e.g. Dropbox, Google Drive), that
service's privacy policy applies to the synced data — that is your choice and your
relationship with them, not ours.
The application contains no analytics, telemetry, advertising, or usage
tracking. Plaza itself talks to exactly two services, and only for the reasons
below: api.lemonsqueezy.com for licence activation and validation, and
github.com to check for and download updates. One further kind of outbound
request happens only when you trigger it: pasting a link onto a Board fetches that page
(and your machine then loads its preview image and icon) directly from the site you chose,
to build the preview card — nothing about it passes through us or is visible to us. There
is no other outbound connection, and there is no account to create.
An optional Local API feature (off by default, Settings → Other) can serve a read-only HTTP endpoint to other programs on your own computer. It binds to localhost only and never leaves your machine; we neither see nor receive anything through it.
2. Data we process, and why
| Data | Purpose | Where it's processed or stored |
|---|---|---|
| Licence key, your email address, a generated instance ID, and a machine identifier derived from your hardware | Activate, validate, and manage your licence and its two seats | Sent to our licensing provider (Lemon Squeezy); cached locally in your operating system's secure credential store (Keychain / Credential Manager / Secret Service) |
| Purchase details (name, email, billing address, payment details) | Process your purchase | Collected and processed by Lemon Squeezy as merchant of record. We never see your payment details; we receive limited order and licence information |
| The date your free trial started | Enforce the 14-day trial | Stored only in your operating system's secure credential store. It is never transmitted to us |
| App version and network request metadata (including IP address) when checking for or downloading updates | Deliver software updates | Handled by GitHub at the time of the request |
| Website analytics, on this website only: pages visited, referrer, approximate location derived from IP, browser and device type, and interactions — including session replays in which anything you type is masked before it is recorded | Understand what brings visitors here and improve this website | Processed by PostHog, hosted in the EU (Frankfurt), keyed to a random visitor ID in your browser's local storage — no cross-site cookies, no advertising identifiers. The installed app sends none of this, ever |
We process this data to perform our contract with you (to provide and licence the Software), and for our legitimate interest in securing and updating it and in understanding how this website is found and read. When you click Buy here, a random visitor ID and the page you left from travel with you into the Lemon Squeezy checkout, so we can tell which page a sale came from — they identify a browser, never a person.
3. Sub-processors and third parties
- Lemon Squeezy LLC (United States) — payments and licence management, acting as merchant of record. Privacy policy.
- GitHub, Inc. (United States) — hosting of application downloads and update files. Privacy statement.
- PostHog — analytics for this website only, with data hosted in the EU (Frankfurt); the installed application never talks to it. Privacy policy.
We do not sell your personal data, we do not share it for advertising, and we do not disclose it except to the providers above as needed to deliver the Software, or where required by law.
4. Retention
- Licence data in your operating system's credential store persists locally until you deactivate the Software or remove it. Note that credential-store entries can survive a plain uninstall until you delete them.
- Order and licence records are retained by us and by Lemon Squeezy for six years from the end of the accounting period they fall in, to meet UK company-law and tax record-keeping obligations. Support correspondence is kept for two years.
5. Your rights
If you are in the UK or the EEA, you have rights under the UK GDPR / GDPR to access, correct, delete, port, or restrict processing of your personal data, and to object to processing. If you are in California, you have comparable rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.
To exercise any of these, write to hello@secondmarch.xyz. We will respond within one month. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
6. International transfers
Lemon Squeezy and GitHub are established in the United States, so the limited data described above is transferred outside the UK/EEA. These transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (for UK transfers) and the EU Standard Contractual Clauses (for EEA transfers), together with the providers' own safeguards. Website analytics data is hosted by PostHog in the EU (Frankfurt).
7. Children
Plaza is a professional tool and is not directed to children under 16. We do not knowingly collect personal data from them.
8. Changes
We may update this policy. We will post the new effective date here and, where the change is significant and we hold your contact details, notify you.