Plikeria Privacy Policy
Values in [square brackets] have not been decided yet.
Effective from 11 October 2026
Translation. This is an English translation of the Polish original. We have tried to keep it as close to the original as possible. In the event of any discrepancy between this translation and the [Polish version], the Polish version prevails.
This policy describes what personal data Plikeria processes, for what purpose and on what basis, to whom it discloses the data, how long it keeps the data, and what rights you have.
Who we are
Plikeria (plikeria.app) is a service for storing and sharing files. The operator of the service and the controller of your data within the meaning of the GDPR is Julia Rudzka, a sole trader in Poland (place of residence: Dopiewiec, pow. poznański, NIP 7831849799, REGON 520987653, correspondence address: skr. poczt. nr 36, 62-052 Komorniki). For matters concerning data, write to hello@plikeria.app.
What data we process and why
Website
Every request to the website is recorded in the hosting provider’s technical log: IP address, browser, and approximate location determined from the IP address. The log is needed to detect errors and to protect the service against attacks.
We measure traffic and page speed with Cloudflare Web Analytics: a script on the page tells Cloudflare which page was opened, where the visitor came to it from, and how quickly it loaded.
In the browser’s local storage we keep a session key if you log in to an account, as well as your chosen theme and language. This is needed for the website to work.
Account
- Email address — your login and the address for service messages. An account cannot be created without an email address.
- Password, if you set one. It is not mandatory.
- Sessions — browser, time of login and of last use: so that you do not have to log in again.
- Language in which we send emails.
- Hash of the IP address at login — to protect against abuse.
Files
We store the files you upload, information about them (name, size, type, dates), and
the name and address of your shelf — the author page plikeria.app/@name.
Payments
- the email address for sending the proof of purchase: you cannot pay without it;
- amount, currency, date, payment status and the payment’s number at the payment provider;
- the file that was paid for, and your account if the payment was made while you were logged in to it.
We use the email address to send the proof of purchase and to let you know if something happens to the file you paid for. You enter your card or bank account details on the payment provider’s page — they do not reach us.
Reports
We store the data provided in a report, the course of its review, and a hash of the IP address — to protect against abuse. Providing a first and last name and an email address in a report is mandatory, except for reports in certain categories which, under the law, must be reviewed without this data.
Messages to us
We store your messages sent to hello@plikeria.app and legal@plikeria.app, together with attachments, so that we can reply to them.
On what basis
| What we do | Basis (Art. 6(1) GDPR) |
|---|---|
| We run the account, shelf and files, and send service messages | Contract with you (point (b)) |
| We accept payments and send proofs of purchase | Contract (point (b)) |
| We keep payment documents for accounting and the tax office | Obligation under Polish tax and accounting law (point (c)) |
| We review reports, comply with requests from authorities, and report criminal offences | Obligation under the DSA and other legislation (point (c)) |
| We keep a technical log and protect ourselves against abuse | Legitimate interest: security of the service and its users (point (f)) |
| We pass a file reported as CSAM to a hotline to verify whether the report is well founded | Legitimate interest: verifying the report and protecting victims (point (f)) |
| We measure traffic and page speed | Legitimate interest: knowing how the website performs (point (f)) |
| We reply to messages | Legitimate interest: replying to the person who wrote to us (point (f)), and if the message concerns your account — contract (point (b)) |
Who receives the data
Processors process data on our behalf and under a data processing agreement (Art. 28 GDPR):
| Processor | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage of data and files, email, technical log, traffic statistics | Files and the database — in the EU; other data may also be processed outside the EU |
Besides processors, data is received by:
- the payment provider Paynow — payment data. It processes card and account data as a separate controller, in accordance with its own privacy policy;
- the uploader of a file — the substance of a report concerning that file, without information about who submitted it, unless that information is necessary to protect the uploader’s rights;
- the Dyżurnet.pl hotline — a file reported as CSAM, to verify whether the report is well founded;
- public authorities — where the law requires it: at their request, and, where a criminal offence threatening the life or safety of persons is suspected, on our own initiative (Art. 18 DSA);
- anyone who has the link — what you publish yourself: the name and address of your shelf, file names and the files themselves.
Transfers of data outside the EU
Some processors are based in the USA. Transfers of data there are safeguarded by a European Commission decision finding an adequate level of protection (EU-US Data Privacy Framework) or by EU standard contractual clauses. For Cloudflare, the terms of data transfers are set out in its data processing agreement.
How long we keep data
| Data | Period |
|---|---|
| Hosting technical log | 7 days |
| Login attempt data (email address, hash of the IP address) | 24 hours |
| Hash of the IP address in a report | 30 days |
| Session | until logout, but no longer than one year from last use |
| Account | until you delete the account |
| File | until you delete it or until it is deleted in accordance with the Terms of Use |
| Information about a deleted file | until the end of the retention period for payment documents |
| Payments and proofs of purchase | as long as tax law requires: usually 5 years from the end of the year in which the tax payment deadline passed |
| Reports in connection with which a measure was applied to a file or account, including temporary suspension; orders and requests from authorities; our own decisions to apply measures | 6 years from the end of the year in which the decision was made |
| Reports rejected without any measure applied | 3 years from the end of the year in which the decision was made |
| Correspondence concerning a report or an order | as long as the report or order itself |
| Other correspondence | one year from the last message |
| A blocked file preserved as evidence | 90 days from notifying the police or from an authority’s order, and 6 months in the case of a removal order for terrorist content; longer if the authority requests an extension |
We keep data longer than the stated period only while proceedings on a report concerning that data are pending, or when the law requires it, for example a request from a court or a prosecutor to preserve the data.
Your rights
Under the GDPR you can:
- access the data we hold about you and receive a copy of it;
- rectify inaccurate data;
- erase data if we have no legitimate reason to keep it;
- restrict processing, for example while your objection is being considered;
- port data — receive it in a machine-readable format so that you can move it to another service.
Right to object. You can object, on grounds relating to your particular situation, to processing that we carry out on the basis of legitimate interest (point (f) in the table above). We will then stop it, unless we have compelling legitimate grounds that override your interests, or we need the data to defend against claims.
To exercise any of these rights, write to hello@plikeria.app. We will reply within one month, and in complex cases we will let you know that we need more time (no more than two further months).
You can lodge a complaint with the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority in your EU country.
How we protect data
We protect data with technical and organisational measures: we transmit it only over encrypted connections and restrict access to it.
Changes
If we change this policy, the new version will appear on this page together with its effective date. We will notify you of significant changes in advance at your account’s email address.