Privacy policy
Last updated
Plia lets you build and change your own apps by describing what you want. This policy explains what we collect to do that, why, who helps us process it, and what you can ask us to do with it.
Who we are
Plia is an early project built for a hackathon and run by Andy Lower (“Plia”, “we”, “us”). We are the controller of the personal data described here: your account, and how you use Plia.
The records you keep in your apps can be about other people, such as your clients, bookings or invoices. For those records you are the controller and we process them on your behalf, only to run Plia for you.
Questions about this policy go to me@andylower.com.
What we collect
- Account details. Your name and email address, and your profile picture if you sign in with Google. Sign-in uses a one-time code sent to your email or your Google account. Plia has no passwords.
- Your apps and records. The apps you build, the records in them, and your workspace settings such as time zone, language and currency. Your appearance choices, such as theme and corners.
- Edit requests. What you type or say when you ask Plia to change an app, what Plia did in reply, and how long it took. We keep the page as it was before each edit so you can undo it.
- Voice. When you use voice, your microphone audio streams to Meta for transcription while you speak. We do not store the audio. The words it produces are saved as an edit request.
- Connected apps. Which apps you connect, and the events they send once you set them up, such as new emails, messages or payments. Each event is kept as received and as a record in your workspace.
- Requests Plia can't do yet. When you ask for something Plia can't build or change, such as players placed on a drawing of a pitch, Muse writes a label of up to 60 characters for the missing feature, such as “place records on a drawing”. It writes one for the request, and one for each page it leaves out of a new app. Every label is written under the same instruction to use only general words and to leave out names, places, health details and phrases from your request, and we test that it does. Labels are still written by AI, so one could repeat a detail from your request. We keep it in a database shared across Plia, with your workspace, the build or edit it came from and the time, so we can see what to build next. Deleting your workspace deletes its labels.
- AI usage log. One entry per AI call or voice clip: the model, the tokens or seconds of audio, the cost, the time and whether it worked. The log does not contain what was said or sent.
- Technical data. Our providers process IP addresses and request logs to deliver the service and protect it from abuse.
How Plia uses AI
Plia uses Meta's Muse models through the Meta Model API. Each request sends only what that task needs.
- Changing an app. Your words, the structure of the page (its blocks and the names of the collections and fields they show), the records shown on that page, up to 25 from each collection, and the names of up to 40 records from each collection they can link to. Muse needs these to add or update the right records.
- Building an app. Your description, the names of your apps and their pages, the names and fields of the collections you already have, and the names of the records in collections of up to 50, so a new app can reuse them.
- Scheduled jobs. When a job runs, its name and instructions and up to 100 of the most recently changed records from each collection you chose for it, so Muse can write its summary or new records.
- Voice. Your microphone audio, passed through our relay on Cloudflare to Meta's transcription service. The relay holds audio in memory only while it forwards it.
- Setting up a connected app. A few sample events from that app, so Plia can work out which fields to keep as records.
- Importing from another tool. The screenshot you upload, which Muse also sees while it builds the pages. If you add a CSV export, its column names, how many rows it has, and up to 6 sample values from each column. Your other rows stay in Plia.
We do not train AI models on your data. AI can misread a request. Plia applies changes from a fixed set of options for the page, and you can undo any change.
Who processes it for us
These providers process personal data on our behalf, under contract, to run Plia.
| Provider | Purpose | Location |
|---|---|---|
| Clerk | Accounts and sign-in. Sends your sign-in codes by email and handles Google sign-in. | United States |
| Meta (Meta Model API) | Runs the Muse models that build apps, apply your edit requests, run scheduled jobs, transcribe voice and set up events from connected apps. | United States |
| Cloudflare | Serves this website and runs Plia's server. Keeps each workspace's apps, records, settings, edit history and AI usage log in its own database, and the labels of requests Plia couldn't do in a shared database. Runs the voice relay that passes your microphone audio to Meta. | Workspace data: the region nearest you when you first sign in, such as Europe or North America. Website and server: global network. Voice relay: United States |
| Pipedream (Pipedream Connect) | Connects your other apps, holds their sign-in tokens, delivers their events and runs actions you ask for. | United States |
If you sign in with Google, Google shares your name, email address and profile picture with us under its own privacy policy. Apps you connect also handle your data under their own terms.
We do not sell your data, show advertising or use your data for marketing.
How long we keep it
We keep your data while your account is open. You can delete apps and records in Plia at any time. Removing a connection removes it at Pipedream too. Voice audio is not stored. Screenshots and CSV files uploaded for an import are deleted about an hour after the import ends. To close your account, email me@andylower.com.
Your rights
You can ask for a copy of your data, or ask us to correct or delete it, by emailing me@andylower.com from the address on your account. If your data is in someone else's Plia app, for example as their client, ask them first, because they control it.
Security
Data is encrypted in transit. Every request to our server checks who is signed in and which workspace they belong to. Tokens for connected apps stay with Pipedream and never reach your browser. No system is perfectly secure, so keep your email account safe, because it is how you sign in.
Changes to this policy
We will post any change here with a new date. See also our terms of service.
Contact
- Run by
- Andy Lower
- me@andylower.com