Privacy policy

Your Discord account

PLAS Util has no password of its own. You sign in with Discord, and your Discord account is your PLAS account. Signing in asks Discord for two permissions: identify and guilds.members.read. From those we receive and store your Discord user ID, username, display name and avatar reference, and we can read your membership and roles in our own Discord server.

We do not receive your email address, your password, your direct messages, or anything you do in other servers. The app never asks Discord for them.

A device ID

When you sign in, the app calculates a device ID: a one-way SHA-256 hash of your motherboard's serial number and firmware UUID. It is sent to us and stored against your account, and it is re-checked each time the app starts.

We use it for one thing: keeping a paid tier to one machine, so a single subscription cannot be shared around. Because it is a hash, we cannot reverse it back into your serial number, and because it is derived from firmware it survives a Windows reinstall and changes if you swap motherboards. If you change machines, email us and we will unbind the old one.

Crash reports: on by default

PLAS Util sends crash diagnostics on launch. This is on by default and you can turn it off in the app under Settings → Send anonymous crash reports.

While it is on, a report contains:

• The app version, the build channel, and your Windows version string
• Your device ID (the hash above)
• The crash trace or error log, and which screen the app was on, up to 32 KB of text
• The country the report came from, and the time it arrived

Your IP address is used at the moment a report arrives, to rate-limit abuse. It is not stored with the report. Reports are automatically deleted 60 days after they arrive.

"Online now"

While the app is open it sends a heartbeat roughly every 30 seconds so the home screen can show how many people are using PLAS Util right now. The heartbeat carries a random ID generated fresh each time the app launches. It is tied to nothing about you or your machine, and it expires 90 seconds after the last beat.

Discord Rich Presence: on by default

If the Discord desktop app is running, PLAS Util publishes a status showing that you are using PLAS Util, which tier you are on, and which page of the app you have open (for example "Tuning the GPU"). Anyone who can see your Discord profile can see it. You can turn it off in the app under Settings → Show on Discord.

Updates and download counts

The app checks our update service for new versions, which necessarily reveals your IP address to that service in the same way as any other download. We count installer downloads to know how many people install the app, de-duplicated per IP so one person is not counted repeatedly. The count is a number, not a list, and it is not tied to your account.

Cloud backup: only when you press Save

If you are on a paid tier you can save a backup of your setup to your account. It is sent only when you press Save, never on its own. A backup holds the list of tweaks you have applied, your services preset, your Conductor rules (which name the programs they apply to), your GPU tuning slots and the name of your graphics card, your CPU model, your app preferences and language, and the cosmetics you own. It does not hold files, documents or anything from outside PLAS Util.

We keep one backup per account and each save replaces the last. You can ask us to delete it at any time.

PlasChips

Your PlasChips balance and the items you have unlocked are stored against your account on our server, so they follow you between machines.

What the app does not send

Apart from a cloud backup you choose to save, PLAS Util does not upload your files, your settings, the tweaks you apply, your browsing, your keystrokes, or a record of which features you use. Hardware monitoring (temperatures, clocks, fan speeds, memory timings) is read and displayed locally on your machine and is never sent to us. There is no feature-usage analytics in the app.

Website accounts

Signing in on the website also uses Discord, through our authentication provider Supabase. Unlike the app, a website account record does include the email address attached to your Discord account, along with your Discord ID and profile details, and your purchase and subscription status.

Analytics

We record a small number of events (page views, download clicks, checkout clicks, bookings made, taps on "Send the link to your PC", and taps on a few buttons that lead to a session or to our measured results) and how quickly each page loaded for you (how long it took to appear, whether it shifted while loading, and how fast it responded to a tap) to know whether the site works. It is first-party: the data goes to our own database and no third-party analytics service, advertising network or tracking pixel is used on this site.

These events and speed measurements deliberately carry no IP address, no user-agent, no name, no email and no account ID. They are joined together by a random ID kept in your browser's sessionStorage, which is discarded when you close the tab and cannot follow you between visits. As a result we cannot tell returning visitors apart, which is a trade we are happy with.

Alongside the page and that random ID, an event stores two other things: the site that linked you here, if it was not one of our own pages, and whether you are on a phone or a desktop. Nothing else.

If a page breaks while you are using it, we record the error so we can fix it: the error message, the technical trace the browser produces, the page it happened on, and the same random ID and phone-or-desktop marker as above. These reports go to our own database, not to a third-party error service, and they are deleted after 90 days.

Session bookings

When you book a tuning session on this site we store your Discord ID, the package, the time you picked, and the PC parts you enter (CPU, graphics card, and motherboard and RAM if you give them). They are posted to a private staff channel in our Discord server and shown in your Discord ticket so the session can be prepared. A booking is deleted 12 months after the session, and sooner if you ask.

Forms and applications

The partner application and the custom-build request ask for your name and email address, plus what you choose to tell us: for a partner application your organization, links and a short pitch, and for a custom build your location, budget, what the PC is for, your display and any parts or notes. A submission is stored by Netlify and posted to a private staff channel in our Discord server so we can reply. It is kept until we delete it, and you can ask us to delete it at any time.

Cookies and local storage

We do not use advertising or tracking cookies. If you sign in, your session token is kept in your browser's local storage so you stay signed in. On the booking page, what you have filled in is kept in your browser's session storage while you sign in, then deleted when the page loads again; it never leaves your browser. Local storage also remembers your currency choice, your cart and your answer to the cookie notice; these stay in your browser too. If you are signed in, your Discord profile picture is loaded from Discord's image server. Our hosting provider processes standard web-server request logs, including IP addresses, to serve and protect the site.

Cloudflare

Runs the app's backend. Your account record (Discord ID, username, tier, and the device ID above), your PlasChips and any cloud backup you save are stored in Cloudflare's key-value store, and the app's installers and updates are served from Cloudflare storage. Crash reports are stored here too. See cloudflare.com/privacypolicy.

Discord

Provides sign-in for both the app and the website, and receives the Rich Presence status described above. Session bookings and form submissions are posted to a private staff channel in our Discord server. A Discord account is required to use PLAS Util. See discord.com/privacy.

Supabase

Authentication and database for the website: website account records, purchase status and the analytics events described above. See supabase.com/privacy.

Netlify

Hosts this website and processes standard request logs. Partner and custom-build applications sent through the forms on this site are stored by Netlify and passed on to us. See netlify.com/privacy.

Stripe

Processes payments. Your card details go to Stripe and are never stored on our servers or seen by us. See stripe.com/privacy.

Resend

Sends the confirmation email after a purchase on this site. It receives your email address and what you bought. See resend.com/legal/privacy-policy.

AnyDesk

The remote-access tool used for tuning sessions. Sessions connect through AnyDesk's servers, which see connection details such as your IP address and AnyDesk ID. See anydesk.com/privacy.

unavatar.io

Serves the profile pictures shown beside vouches on the About page. Loading that page requests them from unavatar.io, which sees your IP address as any image host does. See unavatar.io.