When you sign up, we collect your username, email address, and password (stored as a salted hash — we never see your actual password). Optionally: your bio, favicon, and page content.
We also store your last login IP (for security), failed login attempts (for brute-force protection), and account timestamps.
Everything you create: articles (stored as Markdown), uploaded images (auto-converted to WebP, 10 MB max), and comments.
We take a privacy-first approach. When someone visits a Pluma blog, we record:
No cookies are used for analytics. No individual visitor is identifiable, even by us.
If a reader subscribes to your newsletter: their email address, subscription date, and an unsubscribe token. That's it.
Your subscription plan and Stripe customer ID. We never store your card number, CVV, or bank details — Stripe handles all of that directly.
We set exactly three cookies:
| Cookie | Purpose | Duration |
|---|---|---|
pluma_session |
Keeps you logged in across subdomains | 14 days |
csrftoken |
Protects against cross-site request forgery | Session |
pluma-theme |
Remembers your dark/light mode preference | 1 year |
All are strictly necessary or preference-based. No consent banner needed — there's nothing to consent to.
We use a small number of services to run Pluma:
| Service | What they get | Why |
|---|---|---|
| Stripe (stripe.com) | Your email, plan info, payment details you enter on their page | Payment processing |
| Brevo (brevo.com) | Recipient email, subject, body | Sending transactional emails and newsletters |
| IP-API (ip-api.com) | Visitor IP address (transiently) | Country lookup for analytics — IP is not stored |
| CDNs (jsdelivr, Cloudflare, Google Fonts) | Your IP + browser info via standard HTTP requests | Serving JavaScript libraries and fonts |
We don't sell, rent, or trade your data. We may disclose information if required by law.
You have control over your data:
We won't discriminate against you for exercising your rights.
No system is 100% secure. If we discover a breach affecting your data, we'll notify you as required by law.
If we make significant changes to how we handle your data, we'll email you at least 30 days before they take effect.
Your continued use of Pluma after changes take effect means you accept them. If you disagree, you can delete your account.
support@pluma.ink — for everything, including privacy requests.
If you're in the EU and want to complain to a regulator, you can find your local Data Protection Authority at edpb.europa.eu.
Last updated February 10, 2026.