Privacy Policy
This Privacy Policy explains how IDPlain (https://idplain.com, the "Service"), operated by Analogkit, handles personal data. It applies the Analogkit Privacy Policy to this Service and adds what is specific to it. By using the Service you agree to this policy. We will notify you at least 14 days before material changes take effect.
1. Who Is Responsible for Your Data
The data controller is the individual developer who operates Analogkit. The operator's legal name is available on request. Privacy contact: support@analogkit.app. We have not appointed a data protection officer, as we are not required to.
2. Personal Data We Collect
Your photos
Photos you check or make files from are processed only in your browser: face detection and every measurement run on your device. Your photos are never sent to our servers or to any third party, and we can't see them. Once your first check has loaded the checker, you can turn off your internet connection and keep checking. If you sign in or pay in the middle of a check, the photo is kept in your browser's storage on this device so you can continue; it is removed when your files are made, when you choose another photo or delete it, and is discarded after 24 hours. When you send a photo from your phone to your computer, it is end-to-end encrypted between your two devices; on some networks it passes through Cloudflare's relay, which can't read it and doesn't store it. We don't collect biometric data.
Data you give us
- Account: your email address; your name and profile picture if you provide them or your Google account shares them; whether your email address is verified.
- Purchases: order and transaction identifiers, the pack bought, amount, currency, status and dates, as reported by PayPal, and the IP address used at checkout (to handle disputes and fraud). We never receive or store full card numbers.
- Credits: your credit balance and a record of each credit grant, use and refund, with its time and the related task.
- Messages: what you write when you contact support or report content.
Data collected automatically
- Sign-in and security: one-time sign-in codes, session tokens, and the IP address and browser/device user agent of the device that signed in; short-lived counters per IP address to limit abuse.
- Server logs: IP address, user agent, requested URL, time and response status, recorded by our hosting provider.
- Usage statistics: we use cookieless analytics to understand how the Service is used. Umami counts page views and a few actions (signing in, using the tool, starting checkout, completing a purchase). It records the
page address (without query parameters, except campaign tags such as
utm_sourcethat say which link brought you), the referring site, browser, operating system, device type, screen size, language and the country derived from your IP address; it does not store your IP address and does not count browsers that send a Do Not Track signal. Cloudflare Web Analytics counts page views and measures how quickly pages load. It records the page address, the referring site, browser, operating system, device type and country, and does not use fingerprinting. Neither tool sets cookies.
We do not collect location data beyond what can be inferred from your IP address, and we do not use advertising trackers.
3. Why We Use Your Data and Our Legal Bases
| Purpose | Legal basis |
|---|---|
| Create and secure your account, sign you in, provide the Service | Performance of our contract with you |
| Process purchases, keep your credit balance, handle refunds and billing questions | Performance of contract; legal obligations (accounting) |
| Prevent fraud and abuse (e.g. rate limits, stopping the same purchase from being credited twice), keep the Service secure, fix errors | Our legitimate interests in running a safe service |
| Reply to your messages and reports | Performance of contract; legitimate interests |
| Understand, in aggregate, how the Service is used and how fast it loads, so we can improve it | Our legitimate interests in improving the Service |
| Send product news or marketing (only if you opt in) | Your consent |
Where the law of your country requires consent (for example, under China's Personal Information Protection Law), we rely on your consent, given when you use the Service after reading this policy. We may produce aggregated or de-identified statistics that cannot identify you.
4. Cookies and Similar Technologies
We only use cookies and browser storage that are strictly necessary: to keep you signed in and to protect your session. They cannot be turned off without breaking sign-in.We do not use advertising or cross-site tracking cookies. Our analytics tools, Umami and Cloudflare Web Analytics (see above), do not use cookies either.
5. Who We Share Data With
We do not sell your personal data. We share it only as follows:
| Recipient | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting and network; session storage; sending sign-in emails; storage of encrypted backups; bot protection on sign-in (Turnstile); cookieless website analytics (Web Analytics) | USA (global network) |
| Neon, Inc. (on Amazon Web Services) | Our account database: accounts, purchases, credits and moderation records | USA (us-east-1) |
| GitHub, Inc. | Runs our daily backup job; the database copy is encrypted before it is stored | USA |
| PayPal Pte. Ltd. | Payment processor (we are the seller). PayPal account and card data are entered on and processed exclusively by PayPal | Singapore |
| Umami Software, Inc. (Umami Cloud) | Cookieless website analytics: page views and a few actions, without identifying you | USA; EU |
Service providers may only use the data to provide their service to us and are bound by confidentiality and data protection terms. We may also disclose data when required by law or a valid legal request, to protect rights and safety, in connection with a transfer of the business (you will be notified), or with your consent.
6. Security
- All connections use TLS encryption; our databases and file storage are encrypted at rest by our providers.
- Secrets such as third-party API keys are stored encrypted (AES-256-GCM); backups are encrypted before upload.
- Access to production systems is limited to the operator.
- If a personal data breach is likely to affect you, we will notify you and the relevant authority as required, within 72 hours of becoming aware of it.
7. How Long We Keep Data
| Data | Retention |
|---|---|
| Account data | Until you delete your account; then deleted from our live database immediately and from backups within 30 days |
| Sessions | Up to 7 days, or until you sign out |
| One-time sign-in codes | 5 minutes |
| Abuse-prevention counters per IP address | Up to 1 day |
| Document records (which document you unlocked, when, how many times you made the files, and whether it was accepted; never the photo) | While your account exists; deleted when you delete your account |
| Rejection claims (agency, date and reason you give) and a keyed hash of your network address | While your account exists. When you delete your account the text is deleted; the hash is kept, detached from you, for up to 12 months to prevent repeated claims |
| Phone-to-computer pairing: the document you chose and a hash of the pairing key. Photos go straight between your devices, on some networks through an encrypted relay that can't read them | Deleted when the pairing ends: within 10 minutes if the code isn't scanned, at most 30 minutes after your phone connects |
| Purchase and credit records | While your account exists. When you delete your account they are detached from it and kept without your identity, for accounting and to stop the same purchase from being credited twice |
| Support messages | Up to 24 months after the conversation ends |
| Server logs | Up to 7 days |
| Usage statistics (Umami and Cloudflare Web Analytics; not linked to your account) | Up to 2 years |
| Backups | Rolling 30 days |
PayPal keeps its own transaction records as required by law; see its privacy policy.
8. Your Rights
Depending on where you live, you can ask us to: access your data; correct it; delete it; restrict or object to processing; receive a portable copy; and withdraw consent at any time (this does not affect earlier processing). You can delete your account yourself on the account page; this also deletes your data on this Service. For other requests email support@analogkit.app from your account email; we respond within 15 business days and in any case within one month. You also have the right to complain to a data protection authority, for example the authority in your EU country or the cyberspace administration in mainland China.
9. Marketing Emails
We only send emails needed to provide the Service, such as sign-in codes, receipts (sent by PayPal) and important notices about your account or these policies. We will send marketing only if you opt in, and every marketing email will have an unsubscribe link. Unsubscribing does not stop the necessary emails above.
10. International Transfers
Our servers and service providers are located in the United States, Singapore and the European Union. If you use the Service from elsewhere, including mainland China or the European Economic Area, your data is transferred to and processed in those places. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses in our providers' data processing terms. If you are in mainland China, by using the Service you separately consent to the transfer described in this section.
11. Children
The Service is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it promptly.
12. Third-Party Links and Services
This policy covers only data we collect. Websites and services we link to, including PayPal's checkout, have their own privacy practices, for which we are not responsible.
13. Changes to This Policy
We will notify you by email or on the Service at least 14 days before material changes take effect and update the "Last updated" date above.
14. Contact Us
Privacy and support: support@analogkit.app. Data controller: the individual developer who operates Analogkit (https://analogkit.app). We reply within 2 business days (Monday to Friday, 10:00–18:00, China Standard Time, UTC+8).