Privacy Policy

Last updated 4 November 2026

Pluoto is a small world for you and your close friends, made in Singapore, with virtual event venues where you can meet people. We collect what it takes to run that and keep it safe. We don’t sell your data or track you across other apps and websites.

What we collect

Your account: your email address, and a sign-in session for each phone or browser, which records the IP address and type of device it signed in from. If you sign in with Google, Google confirms your email address, and we keep a link between your account and your Google account with the sign-in tokens Google issues, encrypted. We don’t keep your Google name or photo.
What you make: your nickname, profile pills, character and land, plus any optional event introduction, fun fact and meeting preference you save, and your answers to Twin & Flip’s questions.
What you post: bubbles, your private history of past bubbles, and the reactions and waves you send, and when you stopped by a friend’s land (kept for a week).
Your connections: friends, friend requests and their optional introductions, inbox read/dismiss choices, your invite link and code, who you’ve muted, removed or blocked, and where friends’ lands sit in your world.
Reports you make or that are made about you, with a copy of the reported text, the reason and any note.
The day you last opened Pluoto (the date only), so friends can see whether you’re awake today.
Event attendance: the virtual venues you join while signed in, your visibility choice for each event, and temporary session activity used to show whether you’re online. We don’t collect your physical location.
Activity reminders: which activities you set a reminder for, how long before, whether it went out, and when you last read an event’s updates. As a guest, your reminders stay in your browser until you sign up.
If you turn on notifications: a notification address for each phone, and its time zone offset, so nothing arrives at night.
How Pluoto is used: named events such as “posted a bubble” or “opened an invite”, with counts and choices, never anything you wrote. Each carries your account id (before you sign up, a random id made on your phone, or in your browser on this website), and the type of device or browser, operating system, app version, screen size, language and time zone, plus the page address on the website. At events this includes entering the venue, how you reached it when the link says so (such as a QR code), which areas, activities and profiles you open, the reminders you set, whether you open your event recap, and app links you tap. These are views in the virtual venue, not where you are. When you sign up or in, the events from before join your account. We ask PostHog not to work out a location from your IP address, and set it to discard IP addresses.
Abuse prevention: scrambled keys made from your email and network address, to limit sign-in attempts. A scrambled key can’t be turned back into the address it came from.

We don’t collect your location, contacts or photos.

How we use it

To run Pluoto: showing your world to your friends, sending sign-in codes and the notifications you’ve turned on.
To keep it safe: checking nicknames, bubbles, event profile text and request introductions against a list of blocked words, reviewing reports, limiting sign-in attempts and enforcing our terms. The word check only stops a post from going out; decisions about accounts are made by people.
To make it better: seeing which features people use, from the usage events.

Who sees it

Your friends see your nickname, pills, character, land and bubbles, the reactions and waves you send them, and whether you’ve opened Pluoto today.
Event visitors, including guests, can see your nickname, character, profile pills and online presence when you enter a virtual venue while signed in. Any introduction, fun fact or meeting preference you save is also public. If you answer Twin & Flip’s questions, the people you’re matched with see the answers you share or differ on; as a guest, your answers stay in your browser until you sign up. A profile link can show those details after you go offline. Use Hide me to leave attendee discovery; your choice is saved for that event and also hides your event profile link. Your land and bubbles are not included in event profiles. Avatars on the venue map do not show physical locations or live walking positions.
Someone you wave at from an event profile sees your nickname and character with the wave, and can open your event profile.
The recipient of your friend request sees its optional introduction. A profile QR only opens your public profile; a request and explicit acceptance are still needed.
Anyone with your invite link sees your nickname, character and land before they join.
People you block cannot see you in attendee discovery while signed in to the blocked account or access your friend-only world. Public event profiles can still be viewed while signed out; Hide me removes yours from event discovery for everyone.
Our moderators, when someone reports you, see the reported text, your nickname and account id, the reporter’s nickname, and the reason and note, in a private chat. You aren’t told who reported you.
The police or other authorities, when the law requires it or to protect someone from serious harm. That includes reporting child sexual abuse, as our child safety standards describe.

Who processes it for us

Each of these only gets what its job needs:

Convex hosts our database and servers, in the United States.
Resend sends sign-in codes to your email.
Google confirms who you are, if you choose to sign in with Google.
Expo, Apple and Google deliver notifications. A notification carries what it’s about, such as a friend’s nickname and their bubble.
PostHog stores the usage events, in the United States.
Vercel hosts this website and passes the website’s usage events to PostHog.
Telegram carries reports to our moderators. Those messages delete themselves after a month.

So your data is stored and processed outside Singapore, mainly in the United States. We choose providers that protect it to a standard comparable to Singapore’s Personal Data Protection Act.

How we protect it

Everything travels encrypted. There are no passwords to steal: you sign in with a one-time code sent to your email, or with Google. Only the people who run Pluoto can reach the database, and moderators only see reports.

How long we keep it

Bubbles show for 24 hours, then move to a private history only you can see, until you delete them or your account.
Sign-in codes work for 10 minutes and are deleted within the hour.
A sign-in session lasts until you sign out on that device, it goes a week unused, or you delete your account.
Reports about you are kept while your account exists, and for a year after you delete it, so we can act on repeat abuse.
Event visibility choices and the most recent disconnection time for each event stay until you delete your account. Temporary presence sessions expire after missed check-ins; offline attendees are not listed in live discovery. Public profile links remain available until hidden or the account is deleted.

When you delete your account, your profile, world, bubbles, friends, reactions, waves, notification addresses, sessions, the link to Google, friend requests and introductions, event attendance, activity reminders and the reports you made are deleted, usually within minutes. A few things stay, so deleting an account can’t be used to dodge safety measures:

Reports about you, for a year, then deleted.
Blocks and removals other people made against you, held under a scrambled key from your email, so a new account with the same email stays blocked by them, until they delete their own account.
If we closed your account for breaking the rules, a scrambled key from your email, so it can’t sign up again.
The scrambled sign-in limit keys.
Usage events, under your account id, which no longer leads to anything we hold. Ask us and we’ll delete them.

Your rights

See and correct your data: most of it is in the app, where you can change it. Ask us for a copy of everything we hold about you.
Delete it: delete your account at any time, in the app or on the web, and delete past bubbles from your history.
Withdraw consent: turn off notifications in your phone’s settings, or delete your account. We can’t run Pluoto for you without the data it needs to work.

We reply to requests within 30 days. If you’re not happy with how we’ve handled your data, you can complain to Singapore’s Personal Data Protection Commission at pdpc.gov.sg.

On your device

Pluoto keeps your sign-in, a copy of your world so it opens quickly, an unfinished onboarding, which bubbles you’ve seen and its random usage id on your phone. Deleting the app removes them.

When you explore an event as a browser guest, we save your character, a random local identifier, creation and expiry times, and whether you’ve entered the venue in that browser’s local storage. This draft stays on your device and isn’t an account or a public attendee profile. It expires seven days after creation and is replaced when the event page next checks it. You can remove it sooner by clearing this site’s browser data. Private browsing, blocked storage or switching devices may mean your character can’t be restored.

This website also keeps a random usage id, and the account it was joined to after you sign in, in the browser’s local storage, with no cookie. Signing out replaces it with a new one. While you sign in, the email a code was sent to is kept in that browser tab until the code expires, so reloading the page doesn’t lose it.

An unfinished event friend request is saved locally for up to seven days, including the event, recipient, optional message, submission identifier and account binding. It is cleared after confirmed sending, cancellation or an account change when the venue checks it. Restoring a draft never sends it automatically. Clearing site data removes it; blocked storage may prevent recovery.

As a guest, your activity reminders and Twin & Flip answers are also kept in this browser until you sign up, when they move to your account, and a Wave you tapped before signing in is remembered for an hour so you return to that person. None of these send anything by themselves.

Children

Pluoto is for people 13 and older, and everyone confirms their age when they agree to our house rules. If you believe a child under 13 is using it, contact us and we’ll delete the account.

Contact and changes

Our data protection officer can be reached at pluoto@mightwork.co, for questions or requests about your data. If we change this policy in a way that matters, we’ll tell you in the app first.