1. Scope of this policy
PostPlugin.org (“PostPlugin”, “we”, “us”, or “our”) provides a browser workspace for asking Minecraft plugin questions and generating, revising, checking, and downloading plugin project files. This policy covers information processed through the website, accounts, plugin workspaces, subscriptions, and support features.
Questions about this policy or the identity of the person responsible for a particular request can be sent to eftasmare@gmail.com.
2. Information we process
Account and sign-in information
- Email registration stores your name, normalized email address, account dates and status, plan and signup-credit information, and a one-way password hash. We do not store your plain-text password.
- Google sign-in provides your verified email address, name, verification state, and Google account identifier. We store the identity link needed to recognize the account.
- Sessions record a hashed session token, account identifier, creation, expiry, last-seen, and revocation information. The browser receives the bearer token only in an essential secure cookie.
Plugin workspace content
We process initial prompts, follow-up messages, selected images, and supported text files. We also process generated Java source, resource files, plugin metadata, progress and validation events, build results, JAR files, source ZIP files, file hashes, and the existing project source needed for a requested revision.
Attachments
Attachment records can include the original filename, media type, file kind and size, a content hash, storage identifier, associated owner, job and revision, timestamps, and the uploaded bytes. Selected attachments are supplied to the plugin-generation workflow.
Usage and credit records
For each answer or build revision, we can record the related owner, job identifier and revision, timestamp, and reported input, cached-input, output, reasoning-output, and total token counts. Only reported output tokens are charged as PostPlugin.org credits; input text and files are not charged as output credits.
Billing and refund information
Subscription records can include account email, selected plan and price, Stripe customer, checkout and subscription identifiers, subscription state, billing-period dates, checkout session information, and payment-event identifiers. A refund ticket stores the reason you provide, account and owner identifiers, email, plan and subscription-status snapshot, ticket status, and timestamps.
Technical and security information
We may process request timing, network address for rate limiting, request path, response status, browser or device details supplied by a request, upload validation results, and security or abuse events. Operational logs do not intentionally contain plain-text passwords or payment-card numbers.
4. Plugin generation and external processing
To answer a Minecraft plugin question or create a project, PostPlugin.org sends the relevant prompt, selected attachments, and—during a revision—the existing generated project source to the configured generation service. That provider processes the selected content to return an answer or project changes. Hosting, build, and infrastructure providers can also process information needed to run the service.
Google profile data is not deliberately inserted into plugin-generation prompts. Chats, attachments, projects, and downloads are scoped to their owner and are not published as public plugin pages or made available to other users through Swizie.
5. Google sign-in data
Google sign-in requests only the basic openid, email, and profile scopes. PostPlugin.org does not request access to Gmail, Google Drive, Google Contacts, or other Google content. The authorization code and ID token are processed to verify sign-in; the Google identity link remains with the PostPlugin account.
We use Google profile information only to create or authenticate the account, secure the sign-in flow, and display the signed-in identity. We do not sell it or use it for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
6. Why we use information
- Provide the requested account, question-answering, plugin generation, revision, validation, download, credit, subscription, and support features.
- Authenticate users, keep workspaces owner-scoped, enforce limits, prevent abuse, investigate failures, and protect service reliability.
- Administer purchases, reconcile subscription state, answer billing questions, review refund tickets, and manage disputes.
- Meet accounting, tax, security, consumer-protection, and other legal obligations that apply to the service.
Where data-protection law requires a legal basis, processing may be necessary to provide a requested service or perform a contract, comply with law, protect legitimate security and operational interests that are not overridden by individual rights, or act on consent when we specifically ask for it.
7. Service providers, payments, and transfers
Information is shared only as needed to provide PostPlugin.org, protect it, comply with law, or complete a transaction you request. Provider categories include hosting and infrastructure, authentication, generation and build services, and payment processing. Providers may process information in countries other than your own under their terms and privacy notices; where required, recognized transfer safeguards should apply.
Stripe hosts checkout and the billing portal. PostPlugin.org can send Stripe your email address, an internal account identifier in metadata, the selected price, and an existing Stripe customer identifier. Stripe may collect your name, billing address, tax information, and payment details. PostPlugin.org does not receive or store full card numbers or security codes.
Refund tickets are visible to the submitting account and authorized staff accounts. The ticket reason is not sent to Stripe by the ticket form, and a ticket status change does not itself cancel a subscription or initiate a payment or refund.
We do not sell personal information or publish private prompts, attachments, chats, generated projects, or downloads to other users.
8. Storage and retention
- Account and Google identity records have no automatic expiry while the account remains in use. Account deletion is handled through a verified request rather than an instant self-service control.
- Authenticated sessions are configured to expire after 30 days. A Google sign-in transaction is valid for about 10 minutes; expired transaction and session rows are removed during normal authentication maintenance.
- Uploads not attached to a job are normally removed after about 24 hours. Attached files follow their workspace job.
- Ready or failed plugin jobs, messages, progress data, attachments, workspaces, and generated artifacts are normally removed about 72 hours after the job’s last update. Active or queued jobs are not removed merely because they reach that age, and user deletion schedules earlier workspace cleanup.
- The usage ledger is separate from workspace cleanup. It can retain an owner hash, job identifier, revision, token counts, and timestamp after a chat or generated project is deleted. No automatic expiry is currently applied to those usage records because they support credits, account usage, abuse prevention, and billing support.
- Submitted or in-review refund tickets remain open until their status changes. Denied and closed tickets are normally deleted 24 months after their last update, unless a chargeback, fraud review, legal duty, litigation, or another dispute requires longer retention.
- Billing and security records are retained while needed for a subscription, accounting, reconciliation, fraud prevention, disputes, or legal duties. Some Stripe event-deduplication records are normally limited to about 90 days; other account-linked billing identifiers do not have a general automatic expiry.
Backups, infrastructure logs, legal records, and information held independently by a provider can follow separate retention practices. We do not promise that every record is deleted immediately or at the same time.
9. Security
We use owner-scoped access controls, secure cookies, hashed passwords and session tokens, time-limited OAuth transactions, upload restrictions, isolated project workspaces, and build validation intended to reduce unauthorized access and unsafe content. No internet service can guarantee absolute security. Do not submit passwords, session cookies, private keys, API tokens, card or bank details, or private server credentials in prompts or attachments.
10. Your choices and rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or a copy of personal information, or to object to certain processing. Contact eftasmare@gmail.com from the email associated with the account and describe the request. We may verify identity before acting.
Deleting a chat does not delete the separate usage ledger or necessarily remove billing, security, backup, legal, or provider records. For a broader account or privacy deletion request, contact us. Applicable law may require or permit some information to be retained. You may also complain to the data-protection supervisory authority competent for your location.
11. Children
PostPlugin.org is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can review it.
12. Changes to this policy
We may update this policy as the service changes. We will change the date at the top of this page and, where appropriate, provide additional notice. The version in effect when information is processed applies subject to rights that cannot legally be limited.
13. Contact and related policies
Questions or privacy requests can be sent to eftasmare@gmail.com. You can also review the Terms of Service, Refund Policy, and Policy Center.