PluralPage GDPR Privacy Policy

Effective date: 21 October 2026 Last updated: 21 October 2026

This Privacy Policy explains how PluralPage collects and uses personal data. PluralPage is operated by Dobbel as an individual, not by a company.

1. Controller and privacy contact

The data controller for PluralPage is:

Dobbel Individual operator of PluralPage Email: privacy@pluralpage.net

Data Protection Officer / privacy contact: Dobbel, privacy@pluralpage.net

Contact this address to ask a privacy question or exercise your data-protection rights.

2. Data PluralPage processes

Depending on how you use the Service, PluralPage may process:

Account and authentication data

• user ID and username;
• email address;
• password hash;
• account status, permissions, and settings;
• login sessions and security events; and
• account creation and update times.

Plural-system information

• system and member names;
• pronouns, descriptions, notes, avatars, and profile information;
• fronting, switch, and activity information;
• groups, friendships, and relationships you choose to record;
• privacy preferences and other system settings; and
• any other text or structured information you submit.

Some of this information may reveal or strongly suggest information about health, mental health, identity, sexuality, beliefs, or other sensitive matters. Where information is special-category data under Article 9 GDPR, PluralPage processes it on the basis of your explicit consent.

PluralKit integration data

If you choose to connect or query PluralKit, PluralPage may process:

• PluralKit system, member, group, or account identifiers;
• information returned by the PluralKit API according to your request and PluralKit privacy settings; and
• an authentication token or other integration credential where required for a feature.

PluralPage does not operate PluralKit. PluralKit's own processing is described in the PluralKit Privacy Policy.

Technical and security data

• IP address;
• browser-provided request information, such as user agent and request headers;
• essential session-cookie data;
• timestamps, requested paths, response status, and diagnostic information; and
• application and security logs needed to operate, diagnose, and protect the Service.

PluralPage does not use personal data for targeted advertising and does not sell personal data.

3. Why data is processed and the legal basis

| Purpose | Personal data | GDPR legal basis | |---|---|---| | Create and operate your account | Account, authentication, and settings data | Performance of a contract, Article 6(1)(b) | | Store and display the information you ask PluralPage to manage | Plural-system information | Performance of a contract, Article 6(1)(b) | | Process special-category information you choose to enter | Potentially sensitive plural-system information | Explicit consent, Article 9(2)(a), together with Article 6(1)(a) | | Connect to PluralKit when you request it | PluralKit identifiers, credentials, and returned data | Performance of a contract, Article 6(1)(b), and consent where required | | Authenticate users and prevent abuse, fraud, and attacks | Sessions, IP addresses, permissions, and security logs | Legitimate interests in securing and operating the Service, Article 6(1)(f) | | Respond to privacy requests and legal obligations | Account and correspondence data | Legal obligation, Article 6(1)(c) | | Establish, exercise, or defend legal claims | Relevant account, security, and correspondence data | Legitimate interests, Article 6(1)(f), and Article 9(2)(f) where applicable |

You are not required by law to provide PluralPage with personal data. Account information is required to create and secure an account. Information about a plural system is optional, but features that rely on information you do not provide may not work.

4. Explicit consent for sensitive information

PluralPage is designed to store information that may be sensitive. Before adding special-category data, you must actively consent to its processing.

You may withdraw consent at any time by deleting the relevant information, deleting your account, or contacting privacy@pluralpage.net. Withdrawal does not make earlier lawful processing unlawful. If consent is withdrawn, PluralPage will stop processing the affected information unless another legal basis requires limited retention.

Do not enter sensitive information about another identifiable person unless you have a lawful basis and any consent required to do so.

5. How information is protected

PluralPage uses the following technical safeguards:

• stored application data and integration secrets are encrypted at rest using AES-256-GCM, which provides confidentiality and integrity protection;
• account passwords are not stored in plaintext and are not decryptable: they are processed with the Argon2id password-hashing algorithm;
• access is restricted through authenticated accounts and application permissions; and
• operational access is limited to what is needed to run, secure, and maintain the Service.

Argon2id is a one-way password hash, not encryption. AES-256-GCM encryption at rest does not mean data remains encrypted while it is being actively processed or displayed to an authorised user.

No security measure can eliminate every risk. If a personal-data breach is likely to create a risk to people, it will be handled and reported as required by Articles 33 and 34 GDPR.

6. Cookies

PluralPage uses essential session cookies to keep you signed in and protect authenticated requests. These cookies are necessary to provide the Service. PluralPage does not use advertising cookies.

7. When data is shared

Personal data is disclosed only where necessary:

• PluralKit: when you actively use a PluralKit-linked feature. PluralKit is an independent service with its own Privacy Policy and Terms of Service;
• infrastructure providers: if hosting, networking, storage, email, or backup providers are used to operate PluralPage, they may process only the data needed to provide those services and must be subject to appropriate data-protection terms; and
• legal and safety disclosures: where disclosure is required by law, a valid legal request, or is necessary to establish or defend legal claims or protect a person or the Service from serious harm.

PluralPage does not sell or rent personal data.

8. International transfers

PluralPage aims to process data within the European Economic Area. A user-requested connection to PluralKit or another provider may involve processing outside the EEA. The provider's own policy describes its processing. Where PluralPage itself appoints a provider outside the EEA, an applicable adequacy decision or another lawful safeguard under Chapter V GDPR will be required.

9. Retention and deletion

PluralPage keeps data only for as long as it is needed for the purpose for which it was collected:

• account and plural-system information is retained while your account remains active;
• information you delete is removed from the active Service without undue delay;
• session data is retained until the session expires, you sign out, or the session is revoked;
• operational and security logs are retained only for as long as needed to diagnose problems, investigate abuse, secure the Service, and meet legal obligations, then deleted or anonymised; and
• information required for a legal claim or legal obligation may be retained until that need or applicable limitation period ends.

If backups exist, deleted data may remain in a protected backup until that backup is overwritten through the normal backup cycle. Backup data will not be restored for ordinary use and, if restored for disaster recovery, deletion requests will be reapplied where technically possible.

You may request deletion of your account by emailing privacy@pluralpage.net. Identity may need to be verified before a request is completed.

10. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may:

• request access to your personal data and a copy of it;
• correct inaccurate or incomplete data;
• request erasure of your data;
• restrict particular processing;
• object to processing based on legitimate interests;
• receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller;
• withdraw consent at any time; and
• lodge a complaint with a supervisory authority.

PluralPage does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Send requests to privacy@pluralpage.net. Requests are normally answered within one month. That period may be extended by up to two additional months for a complex request, in which case you will be informed.

If you are in the Netherlands, you may complain to the Autoriteit Persoonsgegevens. If you live elsewhere in the EEA, you may contact your local supervisory authority through the European Data Protection Board's authority list.

11. Children

PluralPage is not intended for children under 16, and accounts may not be created by anyone under 16. If you believe a child has provided personal data contrary to this rule, contact privacy@pluralpage.net so the information can be investigated and deleted where appropriate.

12. Changes to this policy

This policy may be updated when PluralPage, its integrations, or legal requirements change. The current version will show the effective date. Material changes will be communicated through the Service or using the contact information associated with your account where practical.

13. Contact

For privacy questions, consent withdrawal, or data-subject requests, contact:

Dobbel Data Protection Officer / privacy contact for PluralPage privacy@pluralpage.net