Privacy Policy

The short version

Plimmery is a reading app for children. Parents hold the account. We collect the bare minimum needed to teach reading: a parent email for the account, and the child's nickname, age, and lesson progress. Nothing is sold, nothing is shared for advertising, and there are no third-party trackers. You can review, export, correct, or delete your child's data at any time from the Account tab.

• No advertising. No advertising networks. Ever.
• No third-party analytics or trackers.
• We keep a basic, first-party error log to fix crashes and bugs. It's scrubbed of personal details and never shared.
• No voice or video recording of your child.
• No selling, renting, or sharing of personal information.
• No location data. No contact list access.

1. Who we are

Arkira Ventures MB ("Plimmery", "we", "us", "our"), a small partnership (mažoji bendrija) established under the laws of the Republic of Lithuania (company code 306351429, VAT LT100019659116), with its registered office at Smiltelės g. 53-11, LT-94262 Klaipėda, Lithuania, is the operator of the Plimmery reading app and the data controller for the personal information described in this policy. You can reach us about privacy at hello@plimmery.com. We aim to respond within 7 days, and we answer any formal privacy request within one month.

2. Scope of this policy

This policy describes how Plimmery handles personal information collected through our website and apps. It does not apply to third-party websites you reach via a link from Plimmery. Their practices are governed by their own privacy notices.

3. Information we collect

We've designed Plimmery so almost everything lives on your device. The categories below cover everything we collect about you or your child, even when the data never leaves your browser.

3.1 From the parent (account holder)

• Email address, typed by you, or provided by Google if you sign in with a Google account on our website. Used to identify your account and contact you about service-critical matters.
• Display name (optional, supplied by Google if it sends one). We store it against your account and show it back to you on the data-review page. We do not show it to your child.
• Google profile picture link, only if you sign in with a Google account on our website. Google sends the web address of your Google profile picture along with your name, and our sign-in provider stores it with your login. We never display it or use it, and it is deleted with your account.
• Parental consent record: timestamp, document version, and which affirmations you checked. It is our proof that you, the parent, gave consent before we collected anything about your child, which the U.S. Children's Online Privacy Protection Act (COPPA) requires us to obtain. It is kept after you delete your account, because the EU General Data Protection Regulation (GDPR), Article 7(1), requires us to be able to demonstrate that you consented. See §9.
• Account dates: when the account was created.
• Subscription & purchase records (only if you buy a plan): which plan you chose, its status and renewal date, and the reference identifiers the seller returns. On our website the seller is Lemon Squeezy (customer, subscription and order identifiers); inside the Android app it is Google Play (a purchase token, the order identifier and the purchase's state). We do not receive or store your card number or any other payment details: the seller handles them. See §6.

3.2 From each child profile

You, the parent, create child profiles. We collect only what the app needs to teach reading and to remember progress between sessions:

• Nickname, if you choose to type one. We recommend a short first name or initial, not a full legal name.
• Age, if you choose one (ages 4–9). Used to set the default daily time cap, to offer the optional jump-ahead questions during setup from age 5 and choose where they begin, and to leave out the age labels on the lesson path that sit below your child's age. Every child starts at the first lesson unless you choose those questions.
• Learning progress: which lessons were completed, how many attempts, scores, and a record of which sounds and letters the child has shown mastery of (so we don't re-teach what they already know).
• Streak data: which dates the child played. Used to show your child their streak, to pay the coins for a seven-day streak, and to show you in the parent view which days they played.
• Play minutes per day: used for the break reminder, for the daily limit if you set one, and to show you in the parent view how long they played each day.
• Preferences: readable-spacing toggle, mascot choice, and the English variety (American or British: sets the voice and spellings), all shared across your household; plus the time caps you set per child. Settings saved by an earlier version of the app can still include old sound settings that the app no longer has. The app ignores them, and they are being cleared as each household next opens the app.
• Reward state: coins earned and traded for in-app cosmetic mascot characters, which characters each child has unlocked and chosen, and streak freezes available. Internal game state, never linked to real-world rewards or real money.

We can also see a child's nickname, age, progress, streak, coins and play minutes on our own internal dashboard, as §4 explains.

3.3 Information we deliberately do not collect

• No full names from children.
• No location data (no GPS, no IP-geolocation, no Wi-Fi triangulation).
• No photos, videos, or screen recordings. Plimmery never opens the camera and never asks the child to upload media.
• No microphone access. Ever. Plimmery never asks for microphone permission and never opens the browser microphone. Some lessons display a small visual hint that says "Read it out loud!" to encourage the child to vocalize, but nothing on the device is listening or recording. (Earlier internal builds used the mic for a volume-based "I heard you" cue. That was removed before launch because it provided no real pedagogical value and added an unnecessary permission surface.)
• No contact list, calendar, or address-book access.
• No device identifiers beyond what your browser exposes for normal operation.
• No biometric data.
• No social-graph or friend-network data.
• No third-party analytics (no Google Analytics, Mixpanel, Amplitude, Segment, Hotjar, Sentry, or similar).

3.4 Information collected automatically

When you use the Plimmery website or apps, the following is processed automatically:

• Browser storage: everything described in §3.1 and §3.2 is stored in your browser's local storage under keys prefixed with plimmery:, and your sign-in session is kept there too, under keys our sign-in provider names (they start with sb-). A few short-lived notes live in session storage, which the browser clears when the tab or the app closes: that you just passed the grown-ups check, which child is playing, where to return after signing in, whether the page is running inside our Android app, that the page just reloaded itself after an update, that you just deleted your account or withdrew consent and whether your subscription was stopped, so the next page can tell you once, and, in the app, that this launch has already asked Google Play about your purchases. One more is written only if someone opens our app-store review link, which app-store reviewers use and which is never shown to families. Clearing your browser data deletes all of it.
• Sign-in records: each time you sign in on a phone, tablet or browser, our sign-in provider (Supabase, see §6) records that device's IP address and browser type (its user-agent), and when it was last used, so that you stay signed in there. A record lasts until you sign out on that device or delete your account; a device you simply stop using, without signing out, stays on the list until your account is deleted. These records exist only to keep you signed in and your account secure, and we use them for nothing else.
• Offline copies: your browser keeps a copy of one small page, shown instead of an error if the connection drops, and copies of Plimmery's own files: the app's code, the lesson recordings your child has played, and the pages you have opened. They let the app open and keep its sound on a poor connection, and they hold nothing about you or your child.
• Hosting-provider request logs: like every website, requests to Plimmery pass through our hosting provider (Cloudflare). Cloudflare keeps short-lived request logs (IP address, user-agent, request path) for security and abuse prevention. We do not use those logs to profile users. Cloudflare's retention is governed by their privacy policy.
• First-party error log: when something breaks (a page crashes, or your child's progress fails to save to the cloud), Plimmery records a diagnostic entry (what went wrong, where it happened, and the browser type) in our own database so we can find and fix it. An entry may include your parent account id, so we can tell whether several errors hit the same account; it never includes your child's name or answers, and email-shaped text is removed before storage. Entries are kept for at most 90 days and then deleted automatically; if you delete your account sooner, entries are unlinked from your account id at that moment (see §9). They are never shared with a third party and are used only to keep the app working reliably. This is first-party only: no Google Analytics, Sentry, or similar service is involved.
• Plimmery cookies: we do not set any user-facing cookies on the main site. The only cookie Plimmery itself sets is an internal admin-auth cookie used to gate the internal admin tooling at /admin/*. It is HTTP-only, secure, scoped to /admin, and is only ever set for authorized administrators, when an administrator unlocks the admin area, either by signing in with an account on our admin allowlist or by entering the admin key. Regular users will never have this cookie.
• Third-party cookies: if you choose to sign in with a Google account on our website, Google may set its own session cookies on its own domain during the sign-in flow. Those cookies are governed by Google's privacy notice, not ours. This cannot happen inside the Android app, which never offers that sign-in.

Everything Plimmery keeps on your device is strictly necessary to give you the service you asked for: signing you in, keeping your child's progress, remembering a step you just took, and letting the app open and keep its sound on a poor connection. Nothing is stored on your device for analytics or advertising, which is why Plimmery does not show a cookie banner.

3.5 Information from third parties

Signing in with a Google account is offered on the plimmery.com website only. It is never offered inside the Plimmery Android app, where the only way in is the one-time code we send to the parent's email address. When you do use it, Google sends us your email address and a stable identifier we use to recognize you on return. If Google exposes a display name, we receive that too, together with the web address of your Google profile picture, which we never display or use (see §3.1). Apart from that one link, we do not request, and do not receive, any of your photos, contacts, calendar, or other Google account data.

4. How we use information

• Run the app: show lessons, save progress, pick what to teach next, render the parent dashboard.
• Keep you signed in across visits and devices.
• Improve the learning experience for your child by adjusting recommendations to their progress. A child's answers decide which lesson comes next, which skills come back for review, when a stage is secure, and the coins a lesson pays. The stage a child starts at also sets which of their lessons are free; it never changes a price. Nothing else about a child is decided from their answers.
• Check that the service works: our internal dashboard shows us each account with its children's nicknames, ages, progress, streaks, coins and play minutes, and adds these up across all families. We use it to see that lessons work and to find the ones where children get stuck. It is open only to the people who run Plimmery.
• Respond to support requests you send us.
• Comply with legal obligations, such as keeping proof that you gave parental consent, which the GDPR, Article 7(1), requires us to be able to show, and responding to lawful requests from regulators.
• Detect and prevent abuse of the service (fraudulent sign-ups, automated scraping, security incidents).

We do not use any child's information for advertising, targeted marketing, building of advertising profiles, or any form of cross-context behavioral advertising. Full stop.

5. Legal bases (EU / UK)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a similar legal framework, we rely on the following legal bases under the EU and UK General Data Protection Regulations (GDPR / UK GDPR):

• Contract (Art. 6(1)(b)): to provide the service you signed up for.
• Consent (Art. 6(1)(a) + Art. 8 for children): for processing your child's data, where you provide consent on behalf of the child.
• Legitimate interests (Art. 6(1)(f)): for security, fraud prevention, and improving the service. We weigh these interests against your privacy and only rely on them where they would not override your rights.
• Legal obligation (Art. 6(1)(c)): where we must process information to comply with law (e.g., consent records).

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

6. How we share information

Two different things happen below, and the difference matters. Most of the companies listed are service providers: they handle data on our instructions and for no purpose of their own. Some are not: the two sellers, Google when you sign in with a Google account on our website, and the two companies that carry email you send us. Each of those acts in its own right, under its own terms and privacy policy, and decides for itself what it keeps and why. We cannot instruct them, and deleting your Plimmery account does not reach their records.

We share the minimum needed with vetted service providers under written contracts that prohibit them from using your data for any purpose other than serving Plimmery:

• Hosting and infrastructure: our website is hosted on Cloudflare. Cloudflare processes requests on our behalf and keeps short request logs for security.
• Cloud database (Supabase): we use Supabase as our backend database and sign-in service, to store your account and sync your child's progress across devices. The database is hosted in the European Union (on Amazon Web Services infrastructure) and processes data only under our instructions, governed by a data processing agreement.
• Voice generation: lesson audio is generated at build time from a fixed script of words and sentences, using a text-to-speech provider. The generation never involves your child's data. Only the resulting audio files are shipped to your device.
• Our emails (Resend): every email we send goes through the email provider Resend, which processes the recipient address on our behalf to deliver it: your sign-in codes, the confirmation after you give parental consent (its button opens your parent dashboard, where you can withdraw consent after signing in), and the notice before an unused account is deleted (§9). No child data is included in any of them.

These companies are not our service providers. Each acts in its own right, under its own terms and privacy policy:

• Google sign-in (Google LLC), an independent controller and not a service provider: only when you sign in with a Google account, which is offered on our website and never inside the Android app. Google confirms who you are under its own terms and privacy policy, not on our instructions, and sends us your email, a stable identifier, and your name and profile picture link if it shares them (see §3.5). We send Google no information about your child.
• Lemon Squeezy (plans bought on our website), the seller of record: if you buy a plan on our website, the checkout is handled by Lemon Squeezy (the company is Sold through Link, LLC, formerly Lemon Squeezy LLC), which sells you the plan as the merchant of record, under its own terms, and processes your payment and (where applicable) sales tax / VAT. They receive your email and payment details to complete the purchase; we receive back only the subscription / order records described in §3.1. When you ask us to restore your access, we also ask Lemon Squeezy whether your account's email has a website purchase, so one bought there is found. We send them no information about your child.
• Google Play (purchases inside the Android app), a seller and not a service provider: if you buy a plan inside the Android app, Google Play sells it and takes the payment in its own right, under Google's own terms and privacy policy, using the Google account on your phone. It is not acting on our instructions and we send it nothing about your family; we only ask it about a purchase we already hold a token for. We receive back only the purchase records described in §3.1, and use them to unlock the plan on your Plimmery account and keep it in step with renewals, cancellations and refunds. We send Google no information about your child.
• Email you send us: mail to hello@plimmery.com is forwarded by our domain registrar, Porkbun (US), to a mailbox hosted by Google (Gmail, US), where we read and answer it. Each provides that service under its own terms and privacy policy. What reaches them is what you write: your address, your message and anything you attach, such as a screenshot. We keep that correspondence as §9 describes.

We may also disclose information in two other situations:

• Legal compliance: we may disclose information to comply with valid legal process (e.g., subpoenas), to protect Plimmery, our users, or the public, or to enforce our Terms. We will give you notice unless prohibited by law.
• Business transfers: if Plimmery is acquired or undergoes a corporate restructuring, your information may be transferred as part of that transaction. We will give you notice and an opportunity to delete your account before any material change in how your data is handled.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not done either of these things in the past 12 months either.

7. Children's privacy (COPPA & equivalents)

Plimmery is directed at children. We comply with the U.S. Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506 and 16 CFR Part 312), the UK Age-Appropriate Design Code, and equivalent rules in the EEA (GDPR Art. 8). The account model is built around parental control:

7.1 Parental consent

Before we collect any personal information from your child, we verify that consent comes from you, the parent or guardian, through layered steps: (1) you sign in with a verified identity: a one-time code sent to your email, which confirms you control that email account, or, on our website only, a Google account; (2) you affirm a set of statements that establish your authority to consent on the child's behalf; and (3) we send a confirmation to your email after consent is recorded, so that if it wasn't you, you find out at once and can withdraw it from your parent dashboard. The email does not act on its own: withdrawal needs you to sign in, so that a link opened by a mail scanner, a prefetcher or anyone the message was forwarded to cannot erase your child's data. Taken together, these steps are reasonably designed to ensure consent is given by the parent, taking into account available technology. We use the data we collect from your child solely for the internal operations of Plimmery and do not disclose that data to third parties for their own purposes (see §6).

7.2 Parental rights

As the parent or legal guardian of a child under 13, you have the right to:

• Review the personal information we hold about your child. The Account tab in the parent dashboard links to a data-review page that shows your account, your consent, and every child's profile and progress.
• Refuse to permit further collection or use of your child's personal information. You can withdraw consent at any time from the Account tab.
• Direct us to delete your child's personal information. "Delete account" in the Account tab removes everything on your device immediately and any cloud-side copies within 30 days. The one exception is the parental-consent audit record (date, policy version, affirmations checked), which we keep because the GDPR, Article 7(1), requires us to be able to demonstrate that consent was given. See §9.
• Have your data exported. The "Download" button under Your data, in the Account tab, downloads a machine-readable JSON copy of your account, your consent, and every child's profile and progress. For the technical records in §3.4 (your devices' sign-in records and any error entries), and your full consent history, email us and we send them.
• Correct inaccurate information. In the Family tab, Children lets you edit your child's nickname and age, and Settings lets you edit preferences. Lesson progress can be reset in the Danger zone, in the Account tab.

7.3 What happens if you refuse

If you refuse to consent or withdraw consent, we will stop collecting and using your child's personal information, and the child profile will be removed from your account. The parent account itself can remain, but lessons will not be available until consent is in place.

7.4 Schools and educators

Plimmery is not currently a classroom product. If a teacher or school wishes to use Plimmery with students, the school must obtain parental consent on our behalf, as permitted by FTC guidance under COPPA. Contact us before deploying Plimmery in an educational setting so we can put a written data-processing agreement in place.

8. Security

We use industry-standard measures to protect personal information, including encrypted connections (HTTPS), modern identity providers (Google), and limiting access to user data to the small number of people who need it to operate the service. No system is perfectly secure; we cannot guarantee the security of information transmitted to or stored by us. If we ever experience a data breach affecting your personal information, we will notify you as required by applicable law.

9. Data retention and storage

We keep a child's personal information only for as long as it is needed for the purpose it was collected, running Plimmery for that child, and we delete or anonymize it when that purpose ends or when you ask us to. We do not retain children's data indefinitely. The specific timeframes are below.

Your data is stored in two places: your own browser's local storage, and our cloud database, so your child's progress syncs across devices and survives clearing the browser. The cloud database is provided by Supabase and hosted in the European Union (on Amazon Web Services infrastructure). It holds your parent profile, each child's profile and learning progress, and your consent record, every row protected by row-level security so only your account can read it.

• While your account is active: data persists in your browser's local storage until you remove it.
• After you delete the account: everyplimmery: key is removed from your browser's local storage immediately, and your profile and your children's progress are deleted from our cloud database immediately (and in any case within 30 days), except the consent-audit record (date, policy version, affirmations checked; see §3.1). We keep that record because the GDPR, Article 7(1), requires us to be able to demonstrate that you consented, and deleting it with everything else would destroy that proof.
• Consent-audit record: kept for six years after the account is deleted, the time within which a regulator or a court could ask us to prove the consent, and then deleted. It holds nothing about a child.
• Email you send us: kept for 12 months after the matter it is about is closed, then deleted. A request to delete your account is kept for the same 12 months, as the record that we did what you asked.
• Backups: we keep one offline copy of the cloud database, on the company's own computer, and replace it at least every 30 days, so an account deleted from the service is gone from the backup within 30 days as well. If we ever had to restore from it, we would delete again every account deleted since the copy was taken.
• First-party error log: diagnostic entries (see §3.4) are kept for at most 90 days and then deleted automatically. If you delete your account, any entries carrying your account id are unlinked from it immediately. The technical record of the error remains, with no connection to you.
• Sign-in records: each device's record (IP address, browser type, when it was last used; see §3.4) lasts until you sign out on that device or delete your account. They have no other expiry, so a device you stop using without signing out stays on the list until the account is deleted. Your login itself, with your email address and anything Google sent us (§3.5), is deleted with your account.
• Subscription and purchase records: kept for as long as the account exists, and deleted with it. Separately, the seller keeps its own record of the transaction for as long as tax law requires: Lemon Squeezy for a plan bought on our website, Google Play for one bought inside the Android app. Each of them holds that record as its own controller, under its own policy, and deleting your Plimmery account does not reach it.
• Google Play purchases no account has claimed: when a plan is bought inside the Android app, Google Play tells us about the purchase and the app tells us which account made it. If the app never does (for example, because it could not reach us), we keep Google Play's record of the purchase (the purchase token, the order number, the plan and its state) with no account attached, so it can still be matched to the family that paid. Google Play refunds a purchase that is not confirmed to it within three days. These unclaimed records hold nothing about a child, and are deleted 90 days after the purchase if no account has claimed them. If you think one is yours, email us. We confirm it with the email address on your account, as §11 describes, and then match the purchase to that account or delete it.
• Withdrawal of consent: removes the child profile(s) and progress from your device and our cloud database immediately and stops further collection. Your parent account remains so you can re-affirm consent later if you change your mind, and the consent-audit record remains because the GDPR, Article 7(1), requires us to be able to demonstrate that you consented.
• Inactive accounts: we delete accounts that have not been used for 24 months, after giving you advance notice at the email on file.
• Hosting-provider request logs: kept by Cloudflare under their own retention policy. We do not store copies of those logs.

10. International data transfers

Your child's stored profile and learning progress live in our cloud database in the European Union (Supabase, on Amazon Web Services infrastructure in the EU), so that data does not leave the EEA in normal operation. Some providers we rely on are US-based: Cloudflare (website hosting and short-lived request logs), Google (only if you sign in with a Google account on our website), Lemon Squeezy (payment processing, only if you buy a plan on our website), Google Play (only if you buy a plan inside the Android app), and Resend (every email we send, including sign-in codes). For any personal data those providers process outside the EEA / UK, we rely on the European Commission's Standard Contractual Clauses and the EU-US / UK Data Privacy Framework (and equivalent safeguards). Your child's profile and progress are stored in the EU and are not copied to another country for storage. Two of the companies that operate that infrastructure are established outside the EEA: Supabase Pte. Ltd in Singapore, which runs the database, and Cloudflare in the US, which serves every page request. Access from outside the EEA can therefore happen. Those are transfers under Chapter V of the GDPR, and we rely on the Standard Contractual Clauses for them.

Email you send us is the exception. It passes through Porkbun and is kept in a Gmail mailbox, both in the US (see §6), and those two companies provide that service under their own terms, not under the safeguards above. If you would rather not send something by email, tell us and we will agree another way.

You can ask us for a copy of these safeguards. Email hello@plimmery.com with "transfer safeguards" in the subject line and we will send you the relevant clauses, or tell you where the provider publishes them, within one month.

11. Your privacy rights

Depending on where you live, you may have one or more of the rights below. To exercise any of them, use the controls in your Account tab or email us at the address in §1.

If you email us, we confirm the request before acting on it. We write to the email address on your account, and act only once your answer comes back from that address. An email can carry someone else's address as its sender, so we never act on the sender's address alone.

• Access: see what we hold about you and your child.
• Correction: have inaccurate information fixed.
• Deletion: have your personal information erased.
• Portability: receive a copy of your data in a machine-readable format.
• Restriction: ask us to limit how we use your information.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: where processing is based on consent, withdraw it at any time.
• Lodge a complaint with your supervisory authority (e.g., the UK ICO, or the data-protection authority in your EU member state).

We will not discriminate against you for exercising any of these rights.

12. California residents (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA"), California residents have specific rights:

• Right to know what personal information we collect, use, disclose, and share.
• Right to delete personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not engage in either, so there is nothing to opt out of.
• Right to limit the use and disclosure of sensitive personal information. We do not use sensitive personal information for any purpose beyond providing the service.
• Right to non-discrimination for exercising any of these rights.

Categories collected (CCPA §1798.130)

• Identifiers: parent email, account id.
• Internet activity: browser-local-storage interactions with the app; short-lived server logs (IP, user-agent) for security; the IP address and browser type recorded with each sign-in (see §3.4).
• Education information: child's lesson progress and learning preferences.
• Commercial information: the subscription and purchase records described in §3.1, meaning which plan you bought, when, and whether it is still running. Card details are never among them, because the seller takes the payment.
• Inferences: lesson recommendations derived from progress. Not shared.

We do not collect or use the other CCPA categories (biometric, geolocation, sensory, professional, etc.).

Sources and purposes

We collect this information directly from you and your child (via you) when you use the service, and from the identity provider you choose to sign in with. We use it for the purposes described in §4. We retain it for the periods described in §9. We do not knowingly sell or share the personal information of any consumer under 16.

Exercising California rights

California residents (and authorized agents acting on their behalf) can exercise these rights through the Account tab or by emailing us at the address in §1. We verify that a request comes from you through your account: by your signing in, or, for a request sent by email, by writing to the email address on your account and acting only once the answer comes back from it (see §11). If we need additional information, we will request only what is necessary.

13. EU / UK users: GDPR & Children's Code

If you or your child are located in the European Economic Area or the United Kingdom, you have the rights described in §11 under the GDPR and UK GDPR. We apply the UK Information Commissioner's Age-Appropriate Design Code (Children's Code) principles to our service:

• Best interests of the child drives every product decision.
• Data minimization: we collect only what is strictly necessary to teach reading.
• Default privacy settings: nothing optional is switched on by default. A nickname, an age, and signing in with a Google account on our website are all your choice.
• No nudges against the child's privacy interest.
• Transparency: this policy and any notices are written in plain language a non-specialist parent can understand.
• Detrimental use: we do not use child data in ways that have been shown to be detrimental to their wellbeing.

14. Other jurisdictions

If you are in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. If you are elsewhere and your local law provides specific rights or stricter rules, we will honor the stricter standard. Contact us at the address in §1 and we will do our best to address your request promptly.

15. Cookies and similar technologies

Plimmery does not use any cookies for analytics, advertising, or behavioral tracking. We do not set any user-facing cookies on the main site at all. We keep you signed in via your browser's local storage (not a cookie). The one cookie Plimmery itself sets is the internal admin-auth cookie scoped to the/admin route; see §3.4 for details. If you sign in with a Google account on our website, Google may set its own cookies on its own domains during the sign-in flow; please refer to its privacy notice. We do not respond to a browser's "Do Not Track" signal because we do not engage in tracking that the signal is designed to prevent.

16. Third-party links and services

Plimmery may link to third-party websites (for example, Google's sign-in page). We are not responsible for those websites' privacy practices. Their handling of your information is governed by their own policies.

17. Changes to this policy

We may update this policy from time to time. If we make a material change (for example, a new category of data, a new processor, or a new purpose for processing), we will ask you to re-affirm parental consent before you continue to use the service. The "effective date" below tracks the current version.

18. Contact us

Privacy questions, requests, or complaints can be sent to hello@plimmery.com. For COPPA-specific inquiries, please write "COPPA request" in the subject line so we can route it appropriately. We aim to acknowledge within 7 days, and we resolve a request within one month.