Plinth · Legal

Privacy Policy

Effective October 19, 2026 · Version 2026-10-19

1Who we are

Plinth is an Android app that turns your descriptions into working apps and websites using AI. Plinth is made by Virat Kumar, an independent developer in India ("we", "us"). This policy explains what happens to your information when you use the Plinth app and Plinth Sites, our website hosting.

If you have a question, contact us on +91 92969 33126 (phone or WhatsApp).

2The short version

• Plinth has no accounts. We never ask for your name, email or phone number.
• Your projects, chats and settings stay on your phone.
• To build your app, your prompts, images and code are sent to third-party AI providers. They may log them or use them to train their models.
• Sites you publish are public to anyone with the link, until you unpublish them.
• Plinth has no ads, no analytics and no tracking.

3What stays on your device

Your projects, chat history, saved versions and settings are stored on your phone, in storage that only Plinth can read. We do not have a copy.

API keys for your apps: when an app you build needs a key for another service (for example a weather service), Plinth asks you for it in the chat. The key is encrypted and stored only on your phone. It is never sent to us or to the AI; the AI only sees the key's name. Your app's preview sends it only to the service the key belongs to. It goes into a published site only if you choose that when publishing, and then anyone who opens the site can read it.

Reporting AI replies: if you report a reply, your WhatsApp or SMS app opens with the report filled in (your prompt and the reply). Nothing is sent unless you send it.

Android cloud backup is turned off for Plinth, so the app does not copy this data to a cloud backup. You can make your own backup with Export (a .zip file) and restore it with Import. If you share that file, you decide where it goes.

"Clear all data" in Settings deletes everything Plinth stores on your phone. Uninstalling the app does the same.

4Plinth AI (the built-in models)

When you use Plinth AI, the app sends the following from your phone, through an AI gateway, to the third-party companies that run the AI models:

• your prompts and chat messages
• any image you attach
• the code of the project you are working on
• your device's IP address, which every internet request reveals

These providers process this content to produce a reply. They may keep logs of prompts and replies. Some of them say they may use this content to improve or train their models. We do not control what they keep or for how long.

So please do not put personal, private or confidential information in your prompts, images or projects. That includes passwords, ID numbers, bank details, health information, or other people's personal details.

5Your own API key

You can choose to add your own API key for an AI provider you pick. If you do:

• The key is stored only on your phone. It is encrypted with AES-256-GCM, using a key held in the Android Keystore, and the encrypted value sits in the app's private storage.
• The key is sent only to the provider you chose, inside each request to that provider.
• Your prompts, images and code go to that provider instead of Plinth AI.
• That provider's own terms and privacy policy apply to what you send it.

We never see or receive your key.

6Web search

Plinth can search the web when the AI needs current information. This setting is "Web search: Auto" by default. When a search runs:

• The app sends a short search query, based on your conversation, from your phone to third-party search services.
• The app may then download the text of the top result pages, so the AI can read them.
• Those services and websites see your device's IP address and the request, like any website you visit.

You can switch this off in Settings with "Web search: Off".

7Publishing with Plinth Sites

When you tap Publish, the app uploads your site (one HTML file) to Plinth Sites, a server we run on a cloud hosting provider. Here is what the server keeps:

• Your site's HTML file and its link name, for as long as the site stays published.
• With it: when it was first published, when it was last updated, its size, a scrambled (hashed) copy of the site's private update token, and a scrambled (hashed) copy of your install ID.
• A daily publish counter for your install ID. It deletes itself after about 26 hours.

The install ID is a random code created on your phone when Plinth is installed. It is not linked to your name, phone number or Google account. We use it only to apply the limit of 30 publishes a day. Your phone also keeps the private update token, which lets only your phone update or unpublish the site.

Our server code does not store IP addresses and does not keep request logs. Like every website, the hosting provider receives your IP address to deliver the request, and may keep short-term technical and security logs under its own policies.

Published sites are public. Anyone with the link can view, copy or share them, even after you unpublish. Do not publish anything you want to keep private.

You can unpublish at any time from the app. This deletes the site from our server. Copies cached on the network may take about a minute to disappear.

8What we do not collect

• No account, name, email or phone number.
• No analytics, ads or advertising IDs.
• No crash reporting.
• No third-party tracking tools or SDKs.
• No access to your location, contacts, camera or microphone. Plinth only sees images you choose to attach.

We do not sell your information.

9App permissions

• Internet and network state: to talk to the AI, search and publishing services.
• Notifications: to tell you when a build has finished.
• Foreground service (data sync): to keep a build running while you use other apps, lock the phone or close Plinth from Recents. It shows a notification while it runs.

10Where your data is processed

AI providers, search services and our hosting provider may process data on servers outside India. When you use these features, your content travels to them over encrypted connections (HTTPS).

11How long data is kept

• On your phone: until you delete it, clear all data or uninstall.
• Published sites: until you unpublish them, or we remove them under our Terms.
• Daily publish counters: about 26 hours.
• AI providers and search services: according to their own policies, which we do not control.

12Your choices and rights

You stay in control:

• Delete projects, or clear all data in Settings.
• Unpublish any site from the app.
• Turn web search off.
• Use your own API key instead of Plinth AI.

Under Indian law, including the Digital Personal Data Protection Act, 2023, you may have the right to ask about, correct or erase personal data we hold about you, and to raise a complaint. Because Plinth has no accounts, we usually cannot tell which published site belongs to which person. If you need help, message us with the site link.

13Children

Plinth is not meant for children under 13. Users aged 13 to 17 may use Plinth only with a parent's or guardian's permission and supervision. The built-in Plinth AI is for users aged 18 or older. See our Terms of Service for details. If you believe a child has published personal information on Plinth Sites, contact us and we will remove it.

14Security

We use encrypted connections, store your API key encrypted on the device, keep only hashes of update tokens and install IDs, and run published sites in an isolated sandbox. No system is perfectly secure, so please keep sensitive information out of Plinth.

15Changes to this policy

If we change this policy, we will update the version and effective date above. If the change matters, the app will show it and ask you to agree again.

16Contact and grievance officer

Grievance officer: Virat Kumar
Phone / WhatsApp: +91 92969 33126

You can contact us about privacy questions, complaints or published content. We will acknowledge your message within 24 hours and aim to resolve it within 15 days.

Also readTerms of Service