Privacy Policy

This Privacy Policy explains how Acrebase, Inc. d/b/a Plango (“Plango,” “we,” “us,” or “our”) handles information when you use the Plango software, including our Mac app (the “Software”), the installplango.com website, and related services (together, the “Services”).

The short version

• Plango is built to do its security work on your Mac. What it examines on your computer, such as your files, your AI agents’ commands, and your network activity, is analyzed on your Mac and is not sent to us.
• Some information does leave your Mac: what you need for an account and subscription, license checks, updates, and anything you choose to send us or connect Plango to. Those flows are listed below.
• We do not use your information to train artificial intelligence or machine learning models.
• We do not sell your personal information, and we do not share it for targeted advertising.

On your Mac: what stays on your device

To protect your computer, the Software needs to look at it. Depending on the features you use and the permissions you grant, this can include, for example:

• your computer’s security settings, installed apps and their permissions, and items that start automatically;
• network connections and the domain names your apps look up;
• AI agents and developer tools on your Mac, including their settings, the tools and servers connected to them, the skills and plugins they use, your recent conversations with them, and the commands, file access, and other actions they request;
• commands run in Terminal sessions where Plango is installed, whether you or an AI agent types them, and some of their output;
• files that commonly hold passwords, keys, and tokens, such as .env files, so Plango can warn you about exposed secrets (Plango keeps track of where a secret is and what kind it is);
• lists of software libraries in your projects, to check for known vulnerabilities; and
• if you turn on features that need it, the web pages open in your browser and what is shown on your screen, for example to recognize phishing pages.

This information is processed on your Mac by Plango’s rules and its built-in AI model, and the results, such as findings, alerts, and activity history, are stored on your Mac. It is not sent to us, except as described in the next section.

You can delete this information from within the Software where it offers that option, or by uninstalling Plango from its settings, which removes its hooks, network extension, and app data. Some items may remain until you remove them yourself, such as entries Plango saved in your Keychain and backup copies of settings files Plango changed.

macOS asks for your permission before Plango can use some of these capabilities, such as Full Disk Access, its network extension, Accessibility, or screen recording. You can turn permissions off at any time in System Settings, although some features will then stop working.

Information that leaves your Mac

Sent to us

• Account information: your email address and password. We store your password only as a salted hash.
• Sign in with Google or Apple, if you use it: your email address, whether that provider has confirmed it, and an identifier for your account with that provider. We do not receive your password or your contacts. If you use Apple’s Hide My Email, we receive the forwarding address Apple gives us instead of your own.
• Device and license information: an identifier for your Mac, created by a one-way hash of hardware identifiers (we do not receive your serial number); your Mac’s name and model, which may include your own name if your Mac is named after you; and the versions of the Software and macOS. The Software sends this when you sign in, when it checks your license (which happens frequently while you are signed in), and when it checks for updates. We use it to keep you signed in, enforce trial and device limits, prevent fraud, and deliver updates.
• Downloads: when the Software downloads updates, AI model files, or security data from our servers, we receive your IP address and, for updates and model files, the account you are signed in with.
• Support requests: what you write, your email address, an optional name, and anything you choose to attach, such as diagnostic details (for example, the Software and macOS versions, your account email and plan, and the status of Plango’s features) or a screenshot of the Plango window. You can leave these attachments out before you send.
• Error reports, only if you choose to send them: a description of the error, which may include names of files or folders on your Mac, along with your device information, account email, and diagnostic details.

Sent directly to others by the Software

• Vulnerability lookups: to check the software libraries in your projects for known vulnerabilities, the Software can send library names, versions, and package ecosystems to OSV.dev, a vulnerability database run by Google. You can choose a local mode in the Software’s settings, in which the Software downloads the database to your Mac and sends no library names, or turn the check off.
• Security data: the Software downloads blocklists and vulnerability data from their publishers when our servers cannot provide them. These requests reveal your IP address but contain no information about you.
• AI providers you choose to connect: Plango’s built-in AI model runs on your Mac. If you choose instead to connect an outside AI provider or an AI tool installed on your Mac, your questions and the information Plango includes to answer them, which can include findings, commands run by AI agents and their output, file names and paths, names of secrets (not their values), network destinations, and excerpts of skill or plugin files, are sent to that provider. The provider handles that information under its own terms and privacy policy. Any API key you enter is stored in your Mac’s Keychain.
• Apple and your network: the Software asks macOS to check Apple’s servers for system updates, and looks up domain names through the DNS resolver your Mac already uses.

Information from our website

• Account and subscription: when you create an account or subscribe, we collect your email address, password, and agreement to our Terms, along with your subscription status, plan, and billing dates.
• Payments: payments are handled by Stripe, which collects your card and billing details and may collect device information to prevent fraud, under its own privacy policy. We receive a customer reference, subscription status, and payment amounts and dates, but never your full card number.
• Cookies and similar technologies: we use a cookie to keep you signed in (up to 30 days), a short-lived cookie that links your browser to the Mac app while you sign in (15 minutes), and, if you arrive from a link tagged with campaign labels, a cookie that remembers those labels (30 days). Your browser’s local storage remembers whether you chose light or dark mode.
• Campaign labels: if you sign up after arriving from a tagged link, we keep that link’s campaign labels, the page you landed on, and the time, with your account, to measure which campaigns work. We do not keep the full link, the referring page, or advertising click identifiers, and we do not use advertising pixels.
• Analytics: we count page views with analytics software that we host on our own servers and that does not use cookies, so this information is not shared with an analytics company. It records pages visited, the referring site, browser, operating system, device type, and an approximate location (country or region) derived from your IP address.
• Fonts: our pages load fonts from Google Fonts, so Google receives your IP address and browser information when you visit.
• Logs: our servers and hosting provider may record your IP address, browser, and the pages or endpoints you request, to run and secure the Services.
• Email: we send account, security, and billing emails through Amazon Web Services, which processes your email address to deliver them.

How we use information

We use the information described above to:

• provide, maintain, update, and secure the Services;
• create and manage your account, process payments, and enforce trial and device limits;
• respond to support requests and fix errors;
• send service, security, and billing messages, such as confirmations, receipts, and reminders;
• understand, in aggregate, how people find and use our website and which campaigns work;
• detect and prevent fraud and abuse; and
• comply with the law and enforce our Terms.

We do not use your information, including anything Plango processes on your Mac and anything you send us, to train artificial intelligence or machine learning models.

How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We share personal information only:

• with service providers that work for us, such as cloud hosting and email delivery (Amazon Web Services) and payments (Stripe), who may use it only to provide their services to us;
• with others when you direct us or the Software to, such as an AI provider you connect;
• when required by law, or when we believe in good faith it is needed to protect the rights, property, or safety of you, us, or others; and
• as part of a merger, acquisition, financing, or sale of assets, subject to this policy.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy. In particular:

• Account information: while your account is open. After you ask us to delete your account, we delete or de-identify it within 30 days, except for records we must keep for tax, accounting, or legal reasons.
• Device identifiers of Macs that have used a free trial: kept, as one-way hashes, for as long as we offer free trials, so that each Mac gets only one.
• Support requests and error reports: until you ask us to delete them or to delete your account.
• Campaign visits that never become an account: 30 days.
• Server logs: as long as we need them to run and secure the Services.

Information that Plango processes on your Mac stays on your Mac, and you control how long it is kept there.

Security

We use reasonable safeguards to protect personal information, such as encrypting connections to our website and servers, storing passwords and sign-in tokens only as hashes, and limiting who can access our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we have about you and give you a copy, in a portable format where practical;
• correct information that is inaccurate;
• delete your personal information and your account; and
• stop sending you marketing emails, if we send any (each one will include a way to unsubscribe).

To make a request, email privacy@acrebase.com or use our support page. To protect your account, we will verify your request, usually by confirming it from the email address on your account. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to confirm your identity with us directly. We respond within 45 days, or tell you if we need more time, as the law allows. We will not discriminate against you, for example by charging a different price or giving a different quality of service, for using these rights.

If we decline your request, you can appeal by replying to our decision or emailing privacy@acrebase.com with “Appeal” in the subject. We will respond within the time the law requires. If you are not satisfied with the result, you can contact your state attorney general.

You control the information Plango keeps on your Mac. You can change what Plango monitors in its settings, turn off macOS permissions, and remove Plango’s data by uninstalling it, as described in “On your Mac.”

Opt-out signals: Do Not Track and Global Privacy Control

Our website does not track you across other websites over time, and we do not allow third parties to do so through our website, except that Google Fonts and Stripe receive the information described above when their content loads. Because there is no common standard for Do Not Track signals, our website does not respond to them differently. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of your personal information. We do not sell or share personal information, so the signal does not change how the Services work for you.

Notice for California residents

In the past 12 months we have collected the following categories of personal information, from you, from your use of the Services, and from our payment processor, for the purposes described in “How we use information”:

We do not sell or share (as those terms are defined in California law) personal information, and we have no actual knowledge of selling or sharing personal information of anyone under 16. We use sensitive personal information only to provide the Services, as the law permits, and not to infer characteristics about you. California residents have the rights described in “Your choices and rights,” including the rights to know, delete, correct, and opt out, and to not be discriminated against for using them. Under California’s “Shine the Light” law, you may ask whether we disclosed personal information to third parties for their own direct marketing; we do not.

Children

The Services are not meant for children, and we do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable age). If you believe a child has given us personal information, contact us at privacy@acrebase.com and we will delete it.

Where we process information

We are based in the United States, and we and our service providers process information in the United States.

Changes to this policy

We may update this policy as the Services change. We will post the new version here with a new effective date. If a change is material, we will also tell you by email or in the Software before it takes effect.

Contact us

Acrebase, Inc. d/b/a Plango
533 E Girard Ave STE 63004, Philadelphia, PA 19125
Privacy: privacy@acrebase.com
Support: support@acrebase.com or our support page