Privacy Policy

1. What we collect

When you create an account on PlushCrew, we store:

• Your email address (used for login)
• Your name (used in the UI)
• A password hash — we never store your plaintext password
• Your mission prompts and results (used to show your history)
• Token usage per mission (used to enforce plan limits)
• Any files you upload for codebase audit (used to run the audit)
• Your confirmation that you are 13 years or older (for legal compliance)

2. Why we collect it

We use your data to:

• Authenticate you and keep your session active
• Run AI missions and store your results
• Enforce plan token limits and prevent abuse
• Show your mission history

3. Who we share it with

We do not sell your data. We share it only with:

• Google (Gemini API) — your prompts are sent to their models for processing
• OpenAI / Anthropic — only if you explicitly select a model from those providers
• Lemon Squeezy — for payment processing (once Pro plans are live)

These providers have their own privacy policies. We do not control how they handle data beyond our API calls.

4. How long we keep it

We keep your data as long as your account is active. If you delete your account, we delete your email, name, password hash, sessions, mission history, token usage, and uploaded audit folders.

Mission output folders (the files generated by AI agents) are automatically deleted after 7 days to conserve storage.

5. Your rights (GDPR)

If you are in the EU, you have the right to:

• Access your data — email us at the address below
• Delete your account and all associated data — use the "Delete Account" option in your profile settings, or email us
• Export your data — email us and we will send a copy
• Correct any inaccurate information

6. Security

Passwords are hashed with PBKDF2-SHA256. Sessions expire after 30 days. All code generated by AI agents runs in an isolated sandbox.

7. Contact

Questions about your data? Email [email protected].