Privacy Policy
Effective date: 2026-07-15
1. Controller
MyPK is the controller for personal data processed by MyPK.
2. Data We Process
We process the data needed to provide account access, PluralKit dashboard features, local notes, local messages, friend requests, and alter sub-accounts.
- Account data: usernames, password hashes, account creation dates, and password-version counters.
- PluralKit data you save locally: PluralKit token, PluralKit System ID, saved friend System IDs, and display names.
- Alter sub-account data: alter login usernames, password hashes, display names, and PluralKit member references.
- Notes and messages: note titles, note bodies, alter messages, and system messages.
- Friend-request data: requester and recipient account IDs, status, and timestamps.
- Session data: PHP session cookies, CSRF tokens, functional-cookie consent choice, and optional persistent-login cookies.
- Technical data: server logs may contain IP address, browser user agent, request URL, and request time, depending on Apache/server configuration.
3. How Data Is Stored
Application data is stored in a normal MySQL database. The database configuration is loaded from ../pkconfig/config.php, outside the application web root.
- Passwords are never stored in plain text. They are stored using PHP password hashing.
- PluralKit tokens, note titles, note bodies, alter messages, and system messages are encrypted at rest with AES-256-GCM using
APP_SECRET. - Persistent-login cookies store only a random selector and validator. The database stores only a hash of the validator.
- Normal session cookies and persistent-login cookies are HTTP-only and SameSite=Lax. The functional-cookie consent choice is stored in a persistent browser cookie. Secure cookies are used when the site is served over HTTPS.
Changing APP_SECRET will make previously encrypted tokens, notes, and messages unreadable.
4. How PluralKit Data Is Handled
PluralKit API calls are made from your browser directly to PluralKit. The PHP server does not proxy PluralKit API requests. Your saved PluralKit token is loaded into your authenticated browser session so your browser can call the PluralKit API.
When your browser contacts PluralKit, PluralKit receives the request directly and processes it under PluralKit's own terms and privacy policy. Friend System IDs are stored locally and fetched from PluralKit in the browser.
5. Purposes and Legal Bases
- Providing the app and user accounts: performance of a contract or requested service.
- Security, abuse prevention, CSRF protection, sessions, and login persistence: legitimate interests in keeping the service secure.
- Notes, messages, friend requests, and sub-accounts: performance of the requested service.
- Server logs and diagnostics: legitimate interests in operating, securing, and debugging the service.
6. Sharing and Processors
We do not sell personal data. Data may be processed by hosting, database, backup, email, monitoring, or infrastructure providers used to operate the service. PluralKit receives API requests directly from your browser when you use PluralKit features.
7. Retention
Account data is kept while your account exists. Notes and messages are kept until deleted or until the account is deleted. Persistent-login tokens are kept until expiry, manual logout, password change, or deletion. Server log retention depends on server configuration and should be kept only as long as needed for security and operations.
8. Your GDPR Rights
If GDPR applies to you, you may have the right to access, rectify, erase, restrict, object to processing, and receive a portable copy of your personal data. You may also have the right to complain to your local supervisory authority.
To exercise these rights, contact the configured privacy contact. We may need to verify your identity before acting on a request.
9. Security
The app uses password hashing, CSRF tokens, HTTP-only cookies, prepared SQL statements, and encryption for sensitive stored content. No system can be guaranteed perfectly secure. Use HTTPS in production and protect ../pkconfig/config.php, database credentials, backups, and APP_SECRET.
10. Deletion and Export
Deletion/export tooling may be handled administratively unless a dedicated user-facing tool is added. Account deletion should remove related alter accounts, notes, messages, friend requests, persistent login tokens, and saved friend systems through database foreign keys where applicable.
11. Changes
This policy may be updated when the app or data handling changes. The effective date above should be changed when publishing a new version.