Privacy policy
Last updated: November 10, 2026
Who we are
ploof is published by Humaro Studio (humaro.fr), on a non professional basis. We are responsible for your personal data in ploof and on this website. More in our Legal notice. For any question about your data: support@ploofapp.com.
What we collect, and why
| Data | What exactly | Why | Kept |
|---|---|---|---|
| Sign in with Apple or Google | An account identifier, and the email address Apple or Google shares with us (it can be a private relay address). We never see your password. | Create your account and keep it secure. | Until you delete your account. |
| Profile | First name, username, short bio if you write one, private or public setting. | Show your profile to the people your settings allow. | Until you delete your account. |
| Date of birth | Asked when you sign up. Never shown to anyone. | Check that you are 13 or older. | Until you delete your account. |
| What you post | Photos, captions, comments, likes. | Run ploof: the daily challenge, stories, grid, album. | Until you delete them, or your account. |
| Your network | Who you follow, who follows you, follow requests, blocked accounts. | Show you the right photos and protect you from people you blocked. | Until you delete your account. |
| Reports and moderation | What was reported, the reason, the decision. | Keep ploof safe and handle reports. | Up to 1 year after the decision. |
| Notifications | A notification token for your phone, your notification settings. | Send the notifications you chose. | Until you turn them off or delete your account. |
| Technical data | IP address, device model, system and app version, crash reports, dates and times of connection. | Security, preventing abuse, fixing bugs. | Up to 1 year. |
| Launch list (this website) | The email you type in “Notify me”. | Tell you once that ploof is out. | Deleted after that email. |
What we don’t do
- We don’t ask for your location. We remove location data stored in your photos before keeping them.
- We don’t sell your personal data and we don’t use it for advertising.
- We never access the contacts on your phone. You find your friends by their username, or by sending them an invitation link.
- No private messages in this version of ploof.
Who sees what
- Private account (the default): only the people you accept see your photos, your album and your likes.
- Public account: anyone on ploof can follow you and see them.
- Your first name and username can be found in the search, so friends can find you.
- A comment is visible to everyone who can see the photo.
- Someone you blocked sees nothing of you, and you see nothing of them.
Automatic photo check
Before a photo is published, an automatic model running on our own servers checks it for nudity and graphic violence. No outside company sees it. If the photo is refused, it isn’t published and you are told why. Reports are reviewed by a person.
Legal bases
- Our contract with you (the Terms): your account and everything ploof does for you.
- Our legitimate interest: security, moderation, preventing abuse, fixing bugs.
- Your consent: notifications, the launch list. You can withdraw it at any time in the app settings or by writing to us.
- Legal obligations: keeping some data for a limited time and answering lawful requests from authorities.
Where your data is, and who helps us
Your data stays in the European Union, except where a provider below says otherwise.
- OVH SAS (Roubaix, France): this website, our API and the automatic photo check.
- Supabase Inc., servers in Frankfurt (Germany): the database and the photos.
- Sentry, EU region: crash reports and app errors.
- Apple and Google: sign in with your Apple or Google account.
- Expo, and the Apple and Google notification services: delivering notifications to your phone.
Some of these providers are American companies and may process data outside the European Union, with the safeguards required by law (European Commission standard contractual clauses or the EU US Data Privacy Framework). They only act on our instructions. We share nothing else, unless the law requires it.
When you delete your account
Your profile, photos, comments and likes disappear for everyone right away. They are erased from our servers, including backups, within 30 days. We only keep what the law requires (for example technical connection data, up to 1 year). See how to delete your account.
Your rights
You can access your data, correct it, delete it, get a copy of it, object to some uses or ask us to limit them, and withdraw your consent. Most of this is in the app (edit your profile, delete a photo, delete your account). For the rest, write to support@ploofapp.com. We answer within one month. You can also complain to the French data protection authority, the CNIL (cnil.fr), or the authority of your country.
Teens
ploof is for people aged 13 and over. If we learn that an account belongs to someone younger, we delete it. Every account starts private, the app doesn’t use location, and there are no private messages.
Security
Connections are encrypted. Photos are served through temporary links, and our servers check, for every request, that you are allowed to see a photo. No system is perfect: if a breach affects your data, we will tell you as the law requires.
This website
No cookies, no trackers, no analytics. Your browser only remembers your language choice. Like any website, our server keeps short technical logs (IP address, page requested) for security.
Changes
If we change this policy in an important way, we tell you in the app before it applies. The date at the top always shows the latest version.