Privacy Policy

This policy explains how pStack handles information when you use its Pluko website, workspace, and image-search API. If someone else hosts a separate copy of Pluko, ask that operator about its own data practices.

Pluko is operated by pStack. For privacy requests, account assistance, or reports about misuse, email sjapnoor11@gmail.com. Website: pStack.in. Include your account email and relevant request or job IDs, but never send passwords, API keys, or authenticator codes.

• Account information: email address, role, account status, creation date, and a salted password hash.
• Access information: hashed session tokens, session expiry, CSRF values, a short device description for each session (browser and operating system), API-key hashes and prefixes, scopes, expiry, and last-use information. Enabled authenticator secrets are encrypted.
• Webhook settings: if you set a webhook, its URL, an encrypted signing secret, and a record of each delivery attempt (event type, time, response status, and error text).
• Search data: queries, filters, requested counts, job progress, image URLs, source URLs, titles, dimensions, and other result metadata.
• Operational records: sanitized request and response bodies, routes, status codes, timing, provider attempts, usage counts, audit events, and feedback you submit.

The image-search service does not download or store image files. Your browser or application may load images directly from their hosts. Avoid putting personal, confidential, or sensitive information into queries and feedback.

Credential fields are redacted before request logging. Redaction is not a guarantee that arbitrary personal information inside a query or free-text field will be removed. Connection IP addresses are used for rate limiting; hosting and proxy systems may also generate their own access logs.

We use this information to authenticate accounts, run searches, return results, enforce quotas, investigate failures and misuse, maintain the service, and respond to support requests.

Account owners can inspect their workspace data. Service administrators can access account records, search metadata, sanitized request logs, and audit records through operational tools. Do not treat a search query as a private message to the service.

Search queries are sent to the image-search provider the service is configured to use, currently Bing, to retrieve results. That provider processes those requests under its own terms and privacy practices. Pluko does not send your password or API key to the search provider.

If you set a webhook, Pluko sends signed event notifications (job identifiers, status, and counts) to the address you provide. That server is yours or your provider’s, and its own policies apply.

The landing page loads sample photography from Unsplash. Search-result previews and full-image links can load content from other websites. Those hosts receive normal connection information, such as your IP address and browser details, and their own policies apply. Hosting providers may process data to operate the service. Depending on those providers, processing may occur outside your country.

The current application does not include advertising trackers or third-party analytics scripts.

Pluko uses a session cookie to keep you signed in. Sessions normally expire after 12 hours; logging out invalidates the current session. The workspace can also store a sidebar preference cookie for up to seven days.

The workspace and the documentation can also remember your theme, layout and code-language choices in your browser’s local storage. These stay on your device and are not sent to Pluko.

These cookies support login and interface preferences. You can remove them in your browser, which may sign you out or reset preferences. Blocking the session cookie prevents authenticated workspace use.

The current default retention settings are:

• Sanitized request and response bodies: 30 days.
• Request summaries, provider attempts, feedback, and finished webhook delivery records: 90 days.
• Inactive jobs and their result metadata: 30 days.
• Audit history and usage summaries: approximately one year.

Administrators can change configurable retention periods. Cleanup runs periodically while the worker is running, rather than at an exact deletion deadline. Active jobs are not removed by the inactive-job cleanup.

Account, project, and key records do not have an automatic deletion schedule. Backups can retain earlier copies until separately removed. Contact us for the settings that apply to your deployment or for a deletion request; we will explain any records that must remain for security, legal, or operational reasons.

You can change your password, sign out other devices, revoke or rotate API keys, download your data, and stop using the service from the Account page of your workspace. For correction or other privacy requests, contact pStack using the details below. We may need to verify that you own the account before releasing or changing information.

You can delete your account yourself from the Account page. This permanently removes your projects, API keys, search jobs and results, feedback, and request logs. Audit history is kept without naming your account, and backups can retain earlier copies until they are separately removed. Rights and available remedies depend on applicable law. This policy does not limit those rights.

Pluko is operated by pStack. For privacy requests, account assistance, or reports about misuse, email sjapnoor11@gmail.com. Website: pStack.in. Include your account email and relevant request or job IDs, but never send passwords, API keys, or authenticator codes.

We use controls such as password hashing, access checks, session expiry, credential redaction, and encrypted authenticator secrets. No system can guarantee complete security. Report suspected unauthorized access promptly and revoke any affected keys.

We will update this page when our practices change and revise the date above. Material changes should be reviewed before you continue sending information to Pluko; additional notice or consent will be provided where required by applicable law.