LAST UPDATED · 21 JULY 2026

Privacy policy

Plukky uses your account data only to provide the playlist-sync features you request. It does not sell personal data or use Google user data for advertising.

Data we collect

When you connect YouTube or SoundCloud, we store your provider account identifier, display name, optional email and avatar, encrypted OAuth access and refresh tokens, and the time those tokens expire. We store one-way hashes of session identifiers and privacy-preserving rate-limit keys.

Playlist data

Plukky reads playlist and track metadata temporarily to find catalog matches and perform the sync you initiate. Playlist names, track listings, audio, and search results are not retained in Plukky’s database. Operational logs contain the service, operation, duration, success status, and aggregate match count—not playlist names or track titles.

How we use data

We process this data to authenticate you, connect your music accounts, display your playlists, perform selected syncs, prevent abuse, diagnose failures, and keep the service secure. Google user data is used only for the visible user-facing features described here, consistent with the Google API Services User Data Policy, including its Limited Use requirements.

Storage and retention

OAuth tokens are encrypted at rest with AES-256-GCM. Session tokens are stored only as one-way hashes. Expired OAuth requests and sessions are routinely deleted; operational metrics are retained for 90 days by default. Account and provider records remain until you disconnect a provider or delete your account.

Sharing and processors

Data is exchanged with Google and SoundCloud when you connect accounts or request a sync. Hosting, database, and logging providers may process the minimum data needed to operate Plukky under appropriate agreements. Plukky does not sell personal data.

Your controls

You can disconnect either provider from the Account page. Plukky requests provider revocation and immediately erases its local token copy. Deleting your account permanently removes your profile, provider connections, encrypted tokens, and sessions. Provider-side revocation can also be managed from your Google or SoundCloud security settings.

Cookies

Plukky uses only essential HTTP-only cookies for sign-in and OAuth security. It currently uses no advertising or cross-site analytics cookies.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or export your personal data and to object to certain processing. Contact privacy@plukky.app. You may also complain to your local data-protection authority.

Changes

Material changes will be shown in the app and the date above will be updated.