Draft, under legal review. Plume is in a free private beta; this document will be replaced by the reviewed version before public launch.
Plume Privacy Policy
Effective: [not yet in effect: draft of November 11, 2026] · Operated by [operator's legal name: to be added before launch], [postal address: to be added before launch] ("we", "us") · Privacy questions and requests: privacy@plumeapp.net · Help: help@plumeapp.net
Plume is a health journal. You tell it what you ate, how you slept and how you feel, and it helps you see patterns. Because that is health information, we keep this short and exact. Residents of Washington, Nevada and other states with consumer-health-data laws should also read our Consumer Health Data Privacy Policy, which takes precedence for health data.
Plume is a wellness app, not a medical device. It does not diagnose, treat or prevent any disease.
1. How Plume holds your data
- Until you give consent in the app, everything stays on your iPhone. We receive nothing: no entries, no analytics, no crash reports.
- After you give consent, before you sign in, Plume makes an account for this iPhone that has no name, no email and no Apple ID attached. Your data is stored and processed on our servers under that account so Plume can understand entries, find patterns and answer questions. That includes sending what you write, photograph and say to the processors in section 4. The account is tied to this device and can't be reached from any other device. If you don't use it for 180 days we delete it, with everything in it; you can also export it or delete it yourself at any time in Settings.
- When you sign in (with Sign in with Apple, or with a 6-digit code sent to your email), that same account becomes your signed-in account. Nothing is copied or merged; your data stays where it was, and you can now reach it from another device.
2. What we collect once you've given consent
| What | Examples | Where it comes from |
|---|
| Account identifier | A random ID our server makes for your account. If you use Sign in with Apple, also the identifier Apple gives this app for you. Before you sign in, an ID the app makes for this iPhone. | Our server, Apple, or the app. We never ask Apple for your email. |
| Device name | The name of the iPhone you use ("Lin's iPhone"), so you can tell your devices apart in Settings and see which device saved a change | Your iPhone |
| Name — only if you give one | What Plume should call you: a name you type in Settings, a name you tell Plume to use in an entry ("call me Lin"), or the given name Apple shares when you first use Sign in with Apple | You, or Apple at your first sign-in. Optional; you can change or clear it in Settings at any time. We never guess a name from an email address. |
| Email address — only if you sign in with email | The address you type to get a sign-in code | You. Used to send you the code and to recognise your account. If you use Sign in with Apple, or don't sign in, we have no email address for you. |
| Your entries | Text, voice recordings and their transcripts, photos, video frames, files you attach, and every edit | You |
| What Plume derives | Foods, drinks, sleep, symptoms, mood notes and other facts read from your entries, including rough nutrition estimates; daily summaries; patterns, experiments, memories, recaps, answers | Our systems and OpenAI (see section 4) |
| Health and fitness summaries | Daily totals of steps, sleep, heart-rate variability, resting heart rate, weight, workouts, active energy, the night's sleeping wrist temperature (as a difference from your usual), what you logged as food in other apps (energy, protein, carbohydrate, fat, fibre, sugar, sodium, caffeine, water) and (only if cycle tracking is on) cycle day and flow; the start and end time of each night's sleep and each workout; steps per hour for the last 35 days | Apple Health, read on your phone; Oura, if you connect it |
| State of Mind and medications from Apple Health — only if you allow each | The moods you log in Apple Health (how pleasant it was and the labels you picked, with the time; only while mood tracking is on), and the medications you mark as taken (name and time). Unlike the rest, these are individual records, not daily totals. Plume stores them and lists them in your day. It never gives advice about a medication, and does not use one in suggestions or experiments. | Apple Health, read on your phone. Each is asked for separately, the first time it comes up. |
| Goals and settings | Your goals, which sensitive layers are on, notification preferences, time zone | You |
| Consent records | What you agreed to, which version, and when | You |
| Device token | So we can send the notifications you turned on | Apple (push notifications) |
| Usage analytics — only if you opt in | Which screens and features you use, as counts and fixed categories. Never anything you wrote. See section 4 for whether they go anywhere. | The app and our servers |
| Error reports | When something fails on our servers: the type of error, a short technical message and where in our code it happened, after an automatic filter has removed quoted text, email addresses, IDs and long numbers. See section 4 for whether they go anywhere. | Our servers (the app itself sends no crash reports) |
Apple Health is read on your phone, including in the background when new data arrives. Only what is listed above is sent: summaries, plus your State of Mind entries and medication doses if you allowed those — no other raw samples. Plume never writes to Apple Health. Plume does not collect basal body temperature, ovulation test results or cervical mucus (our servers refuse them), and it does not use wrist temperature to estimate ovulation or fertility.
We don't collect precise location, contacts, browsing history or advertising identifiers, and the app contains no third-party tracking or analytics code. Plume's own systems don't store your IP address (Cloudflare, as our network provider, handles it to deliver your connection; see section 4). When you ask for a sign-in code, or the app makes an account for your iPhone, we count the request against a scrambled form of the IP address (and of the email address) to stop abuse; those counters are deleted within about two days.
3. How we use it
Only to provide Plume to you: understanding your entries, computing your patterns and experiments, writing your recaps and answers, sending the notifications you asked for, keeping the service secure and working, and meeting legal obligations.
We do not sell your data, use it for advertising, or share it with data brokers. We don't use it to train AI models, and the providers in section 4 don't either. We don't build profiles for anyone but you.
Notifications appear on your lock screen, so by default they carry a fixed line that says nothing about your health (for example "Your weekly recap is ready.").
4. Who processes it for us
These companies process data for us, to provide Plume to you and for nothing else:
| Provider | Role | What they receive |
|---|
| Cloudflare, Inc. | Hosting, database, file storage, backups | Everything stored, encrypted at rest. Photos and recordings are additionally encrypted with a key unique to your account. As our network provider it also handles your connection, including your IP address. |
| OpenAI, L.L.C. | Understanding entries and photos, writing recaps and answers, search inside your journal, and turning voice notes into text | From our servers: the entry, photo, question or summary being worked on, with the context needed to understand it (such as related earlier entries, health summaries, your goals, what Plume has learned about you, and your name if you gave one); and the text of entries, to make them searchable. From your phone: the audio of a voice note, streamed straight to OpenAI while you talk, with a short list of your own topic names to help it spell them. This happens once you have given consent, whether or not you have signed in, unless you choose "Only on this iPhone" in Settings › Voice to text. We ask OpenAI not to store our requests. OpenAI may still keep what it receives for up to 30 days to detect abuse. It does not use it to train its models. |
| Resend (Plus Five Five, Inc.) | Sending the sign-in code, only if you sign in with email | Your email address and the message with the code. Nothing else: no entries, no health data, no account ID. The message is plain text with no links. |
| Apple Inc. | Sign in with Apple, push notifications, speech recognition when Plume's speech model isn't used | Sign-in: Apple tells us who you are to this app. Notifications: the notification text and your device token. Speech: before you give consent, when you choose "Only on this iPhone", or when the cloud can't be reached (offline, today's limit reached), voice is transcribed by Apple — on your phone when your device supports it, otherwise by Apple's speech service under Apple's privacy policy. |
| Oura Ring Inc. | Only if you connect Oura, which needs a signed-in account | Oura sends us your daily summaries; we send Oura nothing about you. When you disconnect Oura or delete your account, we give up our access at Oura. |
Error reporting and analytics services. We can run Plume with or without these, and at any time this is what happens:
- Error reports. If we have error reporting switched on, the error reports described in section 2 go to Functional Software, Inc. (Sentry), tagged with a one-way scramble of your account ID so that errors for one account can be grouped. They carry no entry text by design; the filter is automatic and could miss an unquoted fragment of text inside an error message. If it is switched off, the same filtered line is written only to our hosting provider's logs, without any account ID.
- Usage analytics. Only if you opted in and we have an analytics service switched on, feature-usage events (fixed names and fixed categories, a scrambled account ID, never anything you wrote) go to Statsig, Inc. If you have not opted in, or no analytics service is switched on, these events are discarded. Turning analytics off in Settings stops them at once.
If you add your own API key. In Settings › Advanced you can give Plume an API key for an AI provider you choose (OpenAI, Google or Anthropic) and pick a model. While that key works, Plume sends the text of your entries and questions, your photos when the model you picked can read images, and the context needed to understand them (such as related earlier entries, your goals and what Plume has learned about you) to the provider you chose, using your key. That processing is under your own agreement with that provider, not Plume's: what they keep, and whether they train on it, is set by your agreement with them, and they bill you for it. Voice notes and search still go to OpenAI as described in the table above. Your key is stored encrypted on Plume's servers, is never shown again (only its last 4 characters), and is removed when you remove it, when you choose "Forget everything", or when you delete your account. You need to be signed in to add a key.
We use no other AI provider for Plume's own processing. We may disclose information if the law requires it (and we will tell you unless legally prohibited), or to a successor if Plume is acquired. Any successor stays bound by this policy for data collected under it.
5. Your choices and rights
In the app, at any time, whether or not you have signed in:
- See and export everything: Settings › Export all data. The export also lists the processors in section 4.
- Correct: edit any entry, or edit or forget any memory.
- Delete an entry: its text, all earlier versions, what was read from it, its photos and recordings are erased from our servers.
- Switch off sensitive layers: turning off cycle or mood tracking stops collecting and using them. Plume deletes the day values and Apple Health records for that layer and retires what it had read from your entries so it is no longer shown or used; your entries stay as you wrote them, and the retired readings stay until you delete those entries or your account.
- Withdraw consent: Settings › Consent and data use. Processing stops at once. You can still export and delete.
- Delete your account: Settings › Delete account and data. Section 6 says exactly what is erased and what is left.
- Analytics: off by default, and you can turn it off again at any time.
Asking us directly
You can also write to privacy@plumeapp.net to ask whether we hold data about you, for a copy of it, for the list of processors that received it, to withdraw consent, or to have it deleted.
- We answer within 45 days. If a request is complex we may take up to 45 more days, once, and we tell you why within the first 45.
- To make sure a request is really yours, we may ask you to confirm it from inside the app or from the email address you sign in with. We don't ask for more information than that needs. If you never signed in, the account is tied only to your iPhone, so the in-app export and delete are the reliable way.
- Requests are free, up to twice a year.
- Appeal. If we decline a request, we tell you why. You can appeal by replying to that message or writing to privacy@plumeapp.net with "Appeal" in the subject. We answer an appeal in writing within 45 days, with what we did or didn't do and why.
- If the appeal is denied, you can contact your state's attorney general. In Washington: https://www.atg.wa.gov/file-complaint.
We don't treat you differently for using these rights.
6. Retention and deletion
We keep your data while your account exists and you haven't deleted it. An account you never signed in to is deleted, with everything in it, after 180 days without use (or after 24 hours if consent was never given, in which case it holds no data). A sign-in code is valid for 10 minutes and is stored only in a scrambled form. An export you ask for is kept for 7 days so you can download it.
When you delete your account, we erase right away: your entries and every version of them, your photos, recordings and files, everything Plume derived from them, your health summaries and records, goals and settings, your name and email address, the identifier from Sign in with Apple, your sessions and device tokens, your own API key if you added one, the connection to Oura, any exports, the encryption key for your files, and your consent records. If a step fails, it is tried again every day until it is done.
What is left, and for how long:
- Backups. Our hosting keeps point-in-time backups so we can recover from failures. Deleted data drops out of them within 30 days. We don't restore deleted data except to recover from an outage.
- OpenAI. What OpenAI already received may stay in its abuse-monitoring logs for up to 30 days.
- Access log. If our support tools were ever used on your account, the log entry (who did what, and when) stays, with your account ID removed.
- Abuse counters. The scrambled sign-in counters described in section 2 expire within about two days.
- Error reports and analytics, if those services were switched on, are kept by those services under a scrambled ID; we don't keep the means to look them up by person after your account is gone.
- Sign in with Apple. Plume stays listed under "Sign in with Apple" in your Apple Account settings until you remove it there. We don't revoke it for you.
- Your iPhone. Deleting the app removes the copy on your phone.
Consent records are kept with your account and are deleted with it. We don't keep a separate copy afterwards.
7. Security
Data is encrypted in transit (TLS) and at rest. Photos and recordings are encrypted with a per-account key, and deleting your account destroys that key. Each account's data lives in its own isolated database. Our support tools show account metadata only — not your entries — and every use is logged. If a breach affects your data, we will notify you (in the app, by email if we have your address, and on our website) and the authorities as the law requires.
8. Children
Plume is for adults 18 and older. We don't knowingly collect data from anyone younger; if we learn we have, we delete it.
9. Changes
If we make a material change, we will tell you in the app before it takes effect. If the change affects how we use health data, we will ask for your consent again.
10. Contact
[operator's legal name: to be added before launch] · [postal address: to be added before launch] · privacy@plumeapp.net (privacy questions and requests) · help@plumeapp.net (everything else)