Privacy Policy
Plaza is a local-first desktop application. We designed it to keep your data on your own machine. This policy explains the limited personal data involved in buying, licensing, and updating Plaza.
1. Your project data stays with you
Plaza does not collect, transmit, or store the contents of your projects. Your files stay on
your own storage; Plaza writes its metadata to a hidden .plaza/ folder next to
them. If you sync that folder with a third-party service (e.g. Dropbox, Google Drive), that
service's privacy policy applies to the synced data — that is your choice and your
relationship with them, not ours.
The application contains no analytics, telemetry, advertising, or usage
tracking. It makes network requests to exactly two destinations, and only for the
reasons below: api.lemonsqueezy.com for licence activation and validation, and
github.com to check for and download updates. There is no other outbound
connection, and there is no account to create.
An optional Local API feature (off by default, Settings → Other) can serve a read-only HTTP endpoint to other programs on your own computer. It binds to localhost only and never leaves your machine; we neither see nor receive anything through it.
2. Data we process, and why
| Data | Purpose | Where it's processed or stored |
|---|---|---|
| Licence key, your email address, a generated instance ID, and a machine identifier derived from your hardware | Activate, validate, and manage your licence and its two seats | Sent to our licensing provider (Lemon Squeezy); cached locally in your operating system's secure credential store (Keychain / Credential Manager / Secret Service) |
| Purchase details (name, email, billing address, payment details) | Process your purchase | Collected and processed by Lemon Squeezy as merchant of record. We never see your payment details; we receive limited order and licence information |
| The date your free trial started | Enforce the 14-day trial | Stored only in your operating system's secure credential store. It is never transmitted to us |
| App version and network request metadata (including IP address) when checking for or downloading updates | Deliver software updates | Handled by GitHub at the time of the request |
We process this data to perform our contract with you (to provide and licence the Software) and for our legitimate interest in securing and updating it.
3. Sub-processors and third parties
- Lemon Squeezy LLC (United States) — payments and licence management, acting as merchant of record. Privacy policy.
- GitHub, Inc. (United States) — hosting of application downloads and update files. Privacy statement.
We do not sell your personal data, we do not share it for advertising, and we do not disclose it except to the providers above as needed to deliver the Software, or where required by law.
4. Retention
- Licence data in your operating system's credential store persists locally until you deactivate the Software or remove it. Note that credential-store entries can survive a plain uninstall until you delete them.
- Order and licence records are retained by us and by Lemon Squeezy for six years from the end of the accounting period they fall in, to meet UK company-law and tax record-keeping obligations. Support correspondence is kept for two years.
5. Your rights
If you are in the UK or the EEA, you have rights under the UK GDPR / GDPR to access, correct, delete, port, or restrict processing of your personal data, and to object to processing. If you are in California, you have comparable rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.
To exercise any of these, write to hello@secondmarch.xyz. We will respond within one month. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
6. International transfers
Both of our providers are established in the United States, so the limited data described above is transferred outside the UK/EEA. These transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (for UK transfers) and the EU Standard Contractual Clauses (for EEA transfers), together with the providers' own safeguards.
7. Children
Plaza is a professional tool and is not directed to children under 16. We do not knowingly collect personal data from them.
8. Changes
We may update this policy. We will post the new effective date here and, where the change is significant and we hold your contact details, notify you.