Privacy Policy

This Privacy Policy explains how Howdoicomputer, LLC ("Plukio", "we", "us") collects, uses, and shares information when you use Plukio at plukio.com (the "Service"). Plukio is a search and discovery service for independent online shops - purchases happen on the shops' own websites, never on Plukio, and we never process payments or receive payment details.

Information we collect

Information you give us:

• Account details - your email address and display name. We use passwordless, magic-link sign-in, so we do not collect or store passwords. Accounts are optional.
• Favorites and follows - the items and shops you save while signed in.
• Content you create - messages to claimed shops, shop reports, and support requests.
• Shop-claim details, if you claim a shop - the verification data needed to confirm you control the shop's domain or site.

Information we collect automatically: log and device data (such as IP address, browser type, and pages viewed); essential session / authentication cookies; outbound-click records - when you follow a "buy" link off Plukio we record which listing was clicked, when, and a session identifier, so shops can see the traffic Plukio sends them and we can understand what's useful (automated/bot clicks are filtered out); search-query records - when you search the catalog we record the query text, the number of results, and the same session identifier, so we can improve relevance and suggest related searches; and listing-view records - when you open a listing's page we record which listing, when, which part of Plukio you came from, and the same session identifier, so we can tell how often a listing was looked at rather than only how often it was clicked through.

About that third one, plainly: an earlier version of this policy said we kept no server-side history of what you looked at. That is no longer true, and we would rather say so than quietly reword it. Listing views are now recorded, for one reason: without them, "12 people clicked through to your shop" is a number with no denominator, and we cannot tell a shop owner whether their listing was seen and passed over or never seen at all. The record is the listing, the time, the referring part of Plukio, and the session identifier - not a browsing history attached to you, and not shared with anyone. Your recently viewed list, the one you see on Plukio itself, is still kept only in your own browser and is still never sent to us.

What your browser tells us about itself. Alongside each of those three records we now also keep a few things your browser sends with every request it makes anywhere on the web: which browser and operating system it reports, whether that adds up to a phone, a tablet or a desktop, the main language it asks for, and - for the first page of a visit only - the website that sent you here (the site's name, like instagram.com, never the full address and never anything after it, such as what you searched for there). We keep these so we can answer ordinary questions like "how many people reached this shop on a phone", and so a shop owner can see the same for their own listings.

Which advertisement brought you, if one did. We buy advertising in a few places, and when we do, the link in the advertisement carries a short label saying which campaign and which version of the advertisement it was. If you arrive that way, we keep that label alongside the same three records - so we can tell whether an advertisement we paid for actually brought anyone who looked at anything. In our advertisements that label is shared by everyone who clicked the same one, which is what makes it a fact about the advertisement rather than about you. If you did not arrive from one of our advertisements, we record that you did not, which is by far the most common case.

The awkward part of that, said out loud. The label travels in the web address, so anyone can put anything there - including a link built for one person, which would make the label a fact about that person after all. We cannot tell the two apart, so we treat every such label as if it were the second kind: the campaign and version names are kept for administrators only and are never shown to shops. What a shop can see is the network a visit came from - that it was Reddit rather than Instagram - and nothing about which advertisement it was.

And the unflattering half. For a short window we also keep the raw text of what your browser reported about itself, rather than only our tidy summary of it. That text is more identifying than the summary - it can carry version numbers and, on older devices, a model name. We keep it because we decide, from that same text, whether a visit was a person or an automated crawler, and we publish those figures; a decision we cannot check afterwards is a decision nobody should trust. It is kept for 14 days, administrator-only, never shown to shops, and then deleted - much sooner than the records it explains. We do not store your IP address with any of it, which is what keeps this a description of a browser rather than a way to follow a person.

One caveat on that deletion, because "deleted" should mean deleted. A short one-way fingerprint computed from that same text - not the text, and not anything we can show you - stays on the record for as long as the record itself does, so we can tell whether two clicks came from the same kind of client without keeping what it said. It is a fingerprint of the browser, not of you: everyone running the same browser version on the same kind of device shares it. We are naming it here rather than leaving it out because it does outlive the text, and a retention promise with an unmentioned exception is not one.

Indexed shop information: the shop and product content on Plukio (shop names, listings, prices, images) is collected from shops' own public websites - it is published commercial information about shops, not information about you. Shop owners can control or remove it at any time (see plukio.com/bot).

How we use your information

• To operate the Service - search, favorites, follows, and messaging.
• To create and secure your account and sign you in via magic-link email.
• To send transactional messages (such as magic links) and, where permitted, marketing email you can opt out of at any time. Email is delivered through our provider, Lettermint.
• To attribute outbound clicks - showing claimed shops the traffic Plukio sends them, in aggregate.
• To improve discovery - search queries, listing views, and clicks feed aggregate relevance signals (related searches, related items, trending) that never identify you.
• To tell shops how their listings performed - in aggregate, and never as anything resembling an individual's browsing history. Where a figure would be based on too few people to be anonymous, we withhold it rather than show it.
• For trust and safety - preventing fraud, reviewing reported shops, verifying shop claims, and enforcing our policies.
• To comply with legal obligations.

How we share your information

• With shops you contact: if you message a claimed shop, that shop sees your display name and your messages. Claimed shops see aggregate click statistics, not your identity.
• When you leave for a shop's website: clicking "buy" takes you to the shop's own site, which collects information under its own privacy policy. The link tells the shop the visit came from Plukio; anything you do there (including any purchase) is between you and the shop.
• Service providers: companies that operate the Service for us - Lettermint (email delivery), DigitalOcean (hosting and infrastructure), and Cloudflare (network and content delivery). They may use your information only to provide services to us.
• Legal and safety: when required by law or to protect the rights, property, or safety of Plukio, our users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell your personal information.

Our legal bases (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following bases to process personal data:

• Performance of a contract - operating your account, signing you in, delivering messages you send to shops.
• Legitimate interests - running and securing the Service, measuring what people find useful, attributing outbound clicks to the shops that earned them, and building and maintaining the index itself. We index public storefront and catalog information; where a shop is run by one person, that information can also be personal data, and our interest in operating a search service is balanced against the shop owner's rights by the controls described at plukio.com/bot - including removal on request, without argument.
• Consent - marketing email, where we send it. You can withdraw consent at any time.
• Legal obligation - where the law requires us to keep or produce records.

Where we rely on legitimate interests you have the right to object, and for shop information that objection is honored as removal from the index.

Payments

Plukio has no checkout and processes no payments. Any purchase you make happens on the shop's own website under the shop's own payment provider and privacy policy - we never see your payment details.

Cookies and similar technologies

We set one first-party cookie. It is signed, it is cleared when your browser session ends, and it carries: your sign-in state, if you are signed in; a random session identifier; and four things about the visit that we describe in "Information we collect automatically" above - the country Cloudflare reported, the main language your browser asked for, the site that referred you here, if any, and which of our advertisements brought you, if one did.

That list is exact rather than illustrative. Everything in the cookie is either necessary to keep you signed in or is one of the reporting dimensions named above; there is nothing in it we have not described.

We want to be exact about that session identifier, because it is not purely technical. It is the identifier attached to the outbound-click, search, and listing-view records described above, which lets us count distinct sessions instead of raw events - so part of its purpose is measurement, not just keeping the Service working. It is random, it means nothing outside Plukio, and it is not linked to your account unless you are signed in.

Because the cookie is cleared when your browser session ends, we cannot and do not recognize you as a returning visitor. That is a deliberate choice rather than a technical limit: we could make the cookie persist and learn a great deal more about repeat behavior, and we have decided not to.

The advertisement label lives in that same cookie and dies with it, which costs us something we would rather name than hide: if you click one of our advertisements on a Monday and come back on a Thursday, Thursday's visit is not connected to the advertisement, and our own count of what that advertisement did is lower than the truth. We would rather undercount our advertising than keep a cookie that follows you between visits.

We set no third-party cookies, run no advertising or cross-site tracking, and do not follow you to other websites. To be exact about the boundary, because we do buy advertising: we advertise on other websites, and we run no advertising or tracking code on Plukio - no advertising network's pixel, no tag manager, and nothing that reports your activity here back to whoever showed you the advertisement. What we know is the label that arrived in the link, and it goes nowhere. Your recently viewed list is stored only in your own browser and never sent to us.

Your rights and choices

Depending on your state, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of marketing. California residents have rights under the CCPA / CPRA, including the right to know, delete, and correct their information, and to opt out of the "sale" or "sharing" of personal information - which we do not do.

If you are in the EEA, the UK, or Switzerland you also have the right to access your personal data; to have it corrected; to have it erased; to restrict how we process it; to receive it in a portable form; to object to processing we base on legitimate interests; and to withdraw consent where we rely on it, without affecting processing carried out before you withdrew. You may also lodge a complaint with your national data protection authority.

To exercise any of these, email [email protected]. You can unsubscribe from marketing email at any time using the link in those messages. If you run a shop we index, the fastest route is plukio.com/bot, which removes a shop without needing an account or a conversation with us.

Data retention

We keep your information for as long as your account is active. When you close your account, we delete your personal information within 30 days, except where we are legally required to keep certain records longer. Raw outbound-click records are kept for a limited period (currently around six months) before being reduced to daily aggregates; raw search-query records are kept for about 90 days before being reduced to aggregate search-phrase statistics; raw listing-view records are kept for about 90 days as well, before being reduced to daily per-listing counts that carry no session identifier.

The raw text your browser reports about itself is kept far more briefly - 14 days - and is then deleted outright rather than aggregated. The short summary derived from it (browser, operating system, phone/tablet/desktop, language, referring site) lives with the record it describes and for the same period as that record. That gap is deliberate: the summary is what we count with, and the raw text only needs to outlive the moment someone might reasonably ask us to show our work. The one-way fingerprint described above is part of the summary, not the raw text, and lives on the same clock as the record it belongs to.

Statistics we publish

We publish some of these aggregates openly, at plukio.com/transparency. What appears there is whole-site and by day - how many browsing sessions, how many listings were opened, how many searches, how many people we sent on to a shop, and how much of that traffic was search-engine and AI crawlers rather than people. It carries no session identifier, no country, nothing about an individual shop, and nothing that can be traced back to you.

One thing on that page is text somebody typed: a short list of searches that returned no results, so that makers can see what people are looking for and cannot find. A search only appears once at least 5 separate browsing sessions have made it across at least 3 separate days - so a phrase one person searched, or a phrase searched many times in a single sitting, is never published. We use this floor because search boxes sometimes receive personal details, and a one-off search is exactly the kind of thing that must not end up on a public page. If you would rather a search of yours were not counted at all, email [email protected].

Security

We use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure.

Where we operate

Plukio is based in and operated from the United States, and we store and process information there. Our index covers shops worldwide, and shoppers reach us from everywhere - so if you are outside the United States, using Plukio means your information is transferred to and processed in the United States, a country whose data protection laws differ from your own.

Howdoicomputer, LLC is the controller of the personal data described in this policy. Our contact details are at the end of this page.

Children

Plukio is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

Contact us

Questions about this policy or your information? Email [email protected], or write to Howdoicomputer, LLC, 1650 NW 21st Avenue, Portland, OR 97209.