This Privacy Policy describes how commonplot ("we", "us", "our") collects, uses, and protects information when you use the commonplot service (the "Service"). By using commonplot, you agree to the practices described here.
This document is a working draft and not a substitute for legal advice. If you are using commonplot to process regulated data, please consult a qualified attorney for your jurisdiction.
1. Information we collect
We collect information in three categories:
1.1 Account information
When you sign up via Google OAuth, we receive your name, email address, and profile picture from Google. When you sign up via email one-time-password, we receive only your email address. We do not receive or store passwords.
1.2 Content you create or save
commonplot stores articles and files you save, documents you write, notebooks you organise, AI chat messages you send, and entity / concept relations the AI extracts from your saved content.
1.3 Usage and technical information
We collect standard web server logs and aggregate Cloudflare analytics (IP address, user agent, referrer, request timestamps, and request metadata) for security, debugging, and service reliability.
By default, Google Analytics receives a pseudonymous browser identifier, coarse device and referral information, normalised page categories, and allow-listed product events such as a successful import, save, or checkout. We do not send account or object identifiers, document or chat content, titles, search text, email addresses, full URLs, or usernames to Google Analytics.
To improve recommendations, we keep our own record of reading activity on public resources. When you are signed in, it records which resources a list showed you and in what position, which you opened, how long and how far you read, which you saved or unsaved, and the text of searches in the public corpus. Each record carries a pseudonymous identifier derived from your account, never your account ID, email address, name, or IP address. When you are not signed in, we record only which resources a list showed, with no identifier. These records stay in our own storage on Cloudflare and are not sent to Google Analytics.
2. How we use information
- To provide, maintain, and improve the Service
- To generate AI summaries, translations, semantic search indexes, and entity extractions from content you save or upload (your content is sent to AI providers for this purpose — see Section 3)
- To deliver transactional emails (sign-in codes, account notifications, billing receipts)
- To analyse aggregate product usage and improve features
- To recommend and rank resources from reading activity
- To detect and prevent abuse, fraud, and security incidents
- To comply with legal obligations
3. Third-party services
commonplot relies on the following third-party providers. By using commonplot, you also agree to their privacy practices:
- Google — OAuth sign-in (we receive your name, email, and profile picture if you choose Google sign-in), and Google Analytics / Google Tag Manager product measurement
- PlanetScale — managed PostgreSQL storage for your account, content, and application metadata
- Cloudflare — Workers hosting, R2 object storage, AI Gateway, edge functions, logs, and aggregate analytics. Content you save or chat about may be routed through Cloudflare AI Gateway to underlying model providers (e.g. Anthropic Claude, OpenAI, Google Gemini) for summarisation, translation, image generation, and chat responses. Cloudflare AI Search indexes corpus content for retrieval. Reading activity records are stored with Cloudflare Basin on R2.
- Stripe — subscription billing and payment processing for paid plans (we never see your full card number)
- Better Auth — open-source authentication library running on our infrastructure (handles session tokens)
4. Data sharing
We do not sell your personal information. We share data only with the third-party providers listed above as necessary to operate the Service, with law enforcement when legally required, or with your explicit consent.
Connected AI apps. When you connect commonplot to an AI assistant such as ChatGPT or Claude, it can list your saves, read their stored text and public commonplot resources, and save links when you press Save on a commonplot card. What it reads is sent to that provider and is governed by its privacy policy. We keep the connection (the app, your consent and its access tokens) until you disconnect it under Settings → Account → Connected apps, which ends access immediately, or delete your account.
5. Cookies
We use first-party HTTP-only cookies for authentication managed by Better Auth. You can disable cookies in your browser, but doing so will prevent you from signing in.
Google Analytics sets its own cookies to measure product usage. You can block them with your browser settings or Google's Analytics opt-out browser add-on; doing so does not affect sign-in or product functionality. Reading activity records set no cookies of their own.
6. Data retention and deletion
We retain your data for as long as your account is active. You can request account deletion at any time by contacting us at the email below; we will permanently delete your account and associated content within 30 days, except where retention is required by law (e.g. billing records).
Google Analytics event and user data is retained for up to 14 months. Aggregate reports may remain available longer.
Reading activity records are kept to improve recommendations. Because they carry only a pseudonymous identifier, once your account is deleted they can no longer be linked to you.
7. Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, contact us at the email below. We will respond within 30 days.
8. International data transfers
Our infrastructure providers operate globally. Your data may be processed in the United States, European Union, or Asia depending on the provider. Where required, we rely on standard contractual clauses or equivalent safeguards.
9. Children
commonplot is not intended for users under 13 years old (or 16 in jurisdictions where applicable). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.
10. Security
We follow industry-standard security practices including encrypted connections (HTTPS / TLS), encrypted database storage, and limited internal access. No internet service is 100% secure; we cannot guarantee absolute security but we will notify affected users in the event of a confirmed breach.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent changes. For material changes that affect your rights, we will notify you by email or in-product notice before the change takes effect.
12. Contact
For privacy questions, data requests, or to report a concern, contact us at hello@newsence.app.