Privacy & Cookie Policy

Plyrium Forge is an agentic development environment (ADE) operated by Plyrium LLC. References to "we," "us," or "our" in this policy refer to Plyrium LLC. You can reach us at support@plyrium.com.

When you create a Plyrium Forge account we collect:

• Email address — used to identify your account and send you transactional emails (password reset, email confirmation, etc.)
• Authentication tokens — generated by Supabase when you sign in; stored in your browser as session cookies and, for the desktop app, encrypted on your device using your operating system's secure credential store (DPAPI on Windows, Keychain on macOS)
• Subscription data — tier (Solo, Studio, Team), billing status, and renewal dates; stored in our database to gate features
• Usage metadata — which features you use, processed to improve the product; not sold or shared with third parties

We do not collect the contents of your code, terminal sessions, or agent output. All orchestration runs locally on your machine.

Plyrium Forge uses strictly necessary cookies only. These are required for the service to function and are legally exempt from consent requirements under GDPR Article 5(3) of the ePrivacy Directive and UK PECR. We do not use advertising, analytics, or tracking cookies.

Desktop app:The Plyrium Forge desktop application stores authentication tokens in your operating system's encrypted credential store (Windows DPAPI / macOS Keychain). These are never written to plain text on disk and are not transmitted to Plyrium servers.

How to delete cookies: You can delete cookies at any time through your browser settings (usually Settings → Privacy → Clear browsing data). Deleting the auth cookie will sign you out.

• To authenticate you and maintain your session
• To apply the correct feature set based on your subscription tier
• To send transactional emails (account confirmations, password resets)
• To process payments via Stripe (billing data only; we never store card numbers)
• To improve the product based on aggregate usage patterns

We do not sell your personal data. We do not share it with third parties for advertising purposes.

We use the following sub-processors:

• Supabase (supabase.com) — authentication and database. Data processed in the US. GDPR-compliant DPA available.
• Stripe (stripe.com) — payment processing. PCI DSS Level 1 certified. Does not share card data with us.
• Vercel (vercel.com) — web hosting. GDPR-compliant. Data processed in the US (with EU edge nodes).

• Contract performance (Art. 6(1)(b)) — authentication, session management, feature gating, billing
• Legitimate interests (Art. 6(1)(f)) — product improvement, fraud prevention, security monitoring
• Legal obligation (Art. 6(1)(c)) — financial record-keeping as required by law

Depending on your location, you may have the right to access, correct, or delete your personal data; restrict or object to processing; and data portability. To exercise any of these rights, contact us at support@plyrium.com. We will respond within 30 days.

EU/UK residents may lodge a complaint with their local data protection authority (e.g. the ICO in the UK, or your national DPA in the EU).

Account data is retained for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law (e.g. billing records, which we retain for 7 years).

We may update this policy from time to time. The effective date at the top of this page reflects the latest revision. Material changes will be communicated via email to registered users.

Plyrium LLC
support@plyrium.com