Privacy Policy

Updated 29 October 2026

Plots is operated by Alejandro Attia. Contact plots@alejandroattia.com about your information.

What we store

• Your account: your sign-in identifier, name, email address, username and optional university. Apple or Google handles your provider password. Profiles show initials; provider photos are not published and photo uploads are not supported.
• Your library: titles, saves, rankings, scores, dates, notes, lists, catalog artwork, goals and preferences. We use these to sync your library and make recommendations.
• Your activity: follow connections, replies and emoji reactions. Reaction totals are public; individual reaction records cannot be enumerated by other users.
• Safety and support: blocks, reports, relevant content, moderation decisions, and feedback messages with their account identifier and submission time. Emailing support also shares your sender details and anything you attach. In-app feedback does not automatically include your email address, screenshots or diagnostics.

What is public

A public profile can show your name, username, initials, university, rankings, saved titles, lists and recent title activity. Reviews saved while your profile is public can be published. Private notes are not automatically made public when you change visibility. Replies remain visible in their conversations and are not made private by making your roster private. Your username directory entry still contains your account identifier and username while your profile is private. Information you share may be copied by its recipients.

Accounts follow @alejandro once by default. You can unfollow, and Plots will not repeat that follow. Other follows are your choice. Blocking hides the account from your social views and removes both follow connections; it does not hide public information from signed-out visitors.

Contacts

Contact access is optional. Plots reads only email addresses from contacts you allow, including selected contacts when supported. Names, phone numbers, notes and photos are not read for matching.

Email addresses are normalized and hashed on your phone. The authenticated Plots service on Cloudflare compares those identifiers with a nonpublic directory of verified sign-in emails. Hashing does not make an email anonymous. Submitted contact identifiers are processed for that request and are not saved as an address book, contact graph, negative-result cache or application log. Matches stay in session memory; following creates an ordinary connection.

Public accounts are discoverable by verified sign-in email by default. Only eligible active public accounts can appear; blocks and deletions are checked. Private profiles are excluded. Apple relay emails may not match a personal email in someone’s contacts. No contact invitations or messages are sent automatically. Revoke access in iPhone Settings to stop future reads. Account deletion removes your directory entry, discovery preference and account-linked matching limits. Aggregate request-budget counters contain no submitted contact identifiers.

Services and notifications

Firebase Authentication and Cloud Firestore provide account access and account-linked storage. Apple and Google process sign-in. Their components receive network, account and device information; Google’s sign-in component also declares contact, approximate location and usage data. See Firebase privacy and Google sign-in disclosures.

Vercel hosts the web app. Cloudflare and Resend process feedback or reports and account identifiers for support delivery when enabled. Providers can retain operational and security records. Information may be processed outside your country; Firebase Authentication operates in the United States. See Vercel, Cloudflare and Resend.

Optional notifications use Cloudflare, Firebase Messaging and Apple Push Notification service. With permission, the Cloudflare notification service stores an FCM registration token, installation identifier and revision, time zone, permission status and selected categories. Firebase Messaging associates the Apple push token with a Firebase installation identifier. No permission prompt appears just from opening the app or Settings. Delivery records prevent duplicates. Messages use generic text and routing identifiers, not private notes or title names. Signing out disconnects that installation. An account-free revision record remains to reject stale registration requests. See Firebase’s iOS disclosures.

Searches, artwork and storage

Catalog and image providers receive title, creator, search or ISBN information and ordinary network information to supply results, biographies, artwork and recommendations. Plots does not attach your account identifier or private notes. Google Books checks preview availability by ISBN and region; preview permissions are not stored offline. Trailers open on YouTube. Watch availability comes from JustWatch for your selected country; Plots does not request device location. University lookup and school icons use third-party directories and image services.

Your device keeps account-specific library and recovery copies, preferences, artwork and description caches. Sign-in components also keep session information, including in the iPhone keychain. Signing out preserves recoverable library copies. Exports are under your control; temporary native sharing files are removed after sharing finishes or is cancelled.

Plots has no advertising, cross-app advertising tracking, or separate analytics or crash-reporting SDK of its own. Sign-in providers can process the operational and analytics information described above. Community trends use public activity from at least three distinct public accounts per title; private and deleted accounts are excluded.

Your choices and deletion

Use Profile → Export Library for a copy and Settings → Delete Account to delete your account. You may need to verify sign-in again. Incomplete deletion is shown so you can retry.

Successful deletion removes your sign-in account, active cloud library, profile, username claims, follow connections, authored replies and replies on your account, submitted feedback, and local library/recovery copies on that device. Background cleanup removes contact discovery records, notifications and delivery jobs, reactions and their totals, reports by or about your account, blocks, moderator decisions and restrictions. Safety cleanup continues independently of notification delivery. Cleanup runs in retryable batches and can finish after the in-app operation; notification delivery is blocked when deletion begins.

A minimal nonpublic deletion record retains the account identifier, deletion start time and cleanup completion times indefinitely to stop older sessions from recreating deleted data. It contains no name, email, library or report text. Exports, recipients’ copies, local copies on other devices, past references in others’ private connection or block records, support email and providers’ operational or backup records are outside this cleanup. Active-account reports remain for investigation or appeals until removed by the operator.

Email us for access, correction, or review of retained information. We may verify ownership. Do not send passwords or sign-in tokens. We update this page when our practices change.