Platenwell (“Platenwell,” “we,” “us”) is operated by J.P. Sariz. Contact: sariz@tuta.com.

What we collect

Account and identity

Email address: required to sign in. You can use a magic link (no password) or an email and password. Passwords are stored by Supabase (hashed); we never see the plaintext.
Optional authenticator MFA: if you use email and password, you may enable time-based one-time codes (TOTP) from an authenticator app. Magic-link sign-in does not use TOTP.
Profile data: a display name (derived from your email prefix on account creation), and optionally a bio, avatar image, and social links you add yourself. All profile fields beyond the display name are optional. Other signed-in users can only see your profile when you share a project with them.
Session cookie: after sign-in, Supabase stores a first-party session cookie so you stay logged in. The cookie is marked Secure on HTTPS andSameSite=Lax. It is readable by the app (not HTTP-only) so the browser can talk directly to Supabase APIs and realtime collaboration. It is an auth session cookie, not an advertising or tracking cookie. We ship a Content-Security-Policy to reduce the risk of cross-site script theft.

Project content

Document data: your drafts and notes sync as collaborative document state (Yjs) through Supabase. Update records can link to the user ID of the person who made them (used for presence and attribution in the editor).
Project metadata: title and timestamps.
Media files: images you upload (e.g. avatars and document images) are stored in Supabase Storage and served with authenticated or short-lived signed URLs, not as a public bucket listing.
Collaboration state: membership records, invite codes you generate, viewer and reader links, and realtime presence signals. Presence data is ephemeral and not kept as a permanent log.
Security audit events: we keep a minimal log of security-relevant actions (invite/share create or revoke, account export) with actor id, action name, optional project id, and timestamp. We do not store manuscript text, IP addresses, or user-agent strings in that log.

Usage signals

Netlify Analytics: server-side, no cookies, no fingerprinting. We look at page-view counts and referrers to understand traffic and manage hosting costs.
Device preference: in the app, your color theme and typewriter-sound choices stay in your browser’s localStorage and are never sent to our servers.

What we don’t do

No Google or social login.
No advertising cookies or third-party tracking pixels from us.
No selling your drafts, email, or contact list.
No using your project content to train generative AI models.
No reading your document content except when necessary to operate the service (e.g. serving files you request, debugging a reported issue with your permission).

Third-party processors

Supabase (privacy policy) processes your account, project, and media data. By using Platenwell you acknowledge that your data passes through Supabase’s systems in the region configured for the project.

Netlify (privacy policy) hosts the application at app.platenwell.com and this marketing site at platenwell.com, and provides the server-side analytics described above.

Ko-fi: the tip jar link points to Ko-fi’s platform. If you click it, Ko-fi’s own privacy policy applies. We do not receive any personal data from Ko-fi.

Fonts used on this marketing site and in the app are self-hosted. No font CDN requests are made.

Collaboration and invites

When you share an invite code, join link, or reader link, anyone who redeems it gains access to your project at the permission level that link grants. Invite codes can expire, have use limits, and can be revoked by the project owner. Treat codes like keys: don’t share them somewhere public unless you intend open access.

Collaborators can see your display name, avatar, and realtime cursor position while you are both active in a project.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal data, or to object to certain processing. In the app you can export your owned project metadata and request account deletion from your profile. You can also email sariz@tuta.com.

Retention

We keep your account and project data for as long as your account is active or as needed to operate the service. If you ask us to delete your account, we will remove your profile and project data from Supabase. Note that collaborative update history associated with your user ID in shared projects may remain until those projects are deleted by their owner.

Children

Platenwell is not directed at children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

Changes to this policy

If this policy changes in a material way, we will update the date at the top. Continued use of the service after an update constitutes acceptance of the revised policy.

Contact

Email sariz@tuta.com.

Privacy Policy