Privacy policy
Last updated 24 October 2026
This policy explains what Plugferry, operated by Black Matter VC ("we"), collects when you use a plugin hosted on Plugferry, such as Diligence Desk, from ChatGPT, Claude, Codex or another assistant, and what we collect from people who build plugins with Plugferry.
When you use a plugin
Your assistant sends each tool request to the plugin's bridge on Plugferry, for example diligence-desk.on.plugferry.com. The bridge forwards the request's arguments to the plugin's upstream service to answer it, and returns a trimmed version of the response to your assistant.
- Request content is not stored. We do not keep the arguments you or your assistant send, or the responses, after the request completes.
- Call records. For each request we keep the tool name, whether it succeeded, timing, request and response sizes, which network route was used, and pseudonymous identifiers: a one-way hash of the assistant session and, if you signed in, a one-way hash of your account. These records contain no names, email addresses or request content. We use them to run, secure and improve the service and to show plugin owners aggregate usage.
- IP address. Used to apply rate limits and deleted automatically within a few minutes. Our hosting provider keeps operational logs, which may include IP addresses and request URLs, for up to 7 days.
- Your conversation. We never receive your chat history. We see only the tool requests your assistant decides to send.
If a plugin asks you to sign in
Some plugins require an account. Diligence Desk does not. Where sign-in is required, we collect your email address and send you a one-time code to confirm it, or we receive an access token from the service you connect. We store your email address, a display name if the service provides one, and any connected-service tokens, which are encrypted. You can disconnect at any time from your assistant's settings, and ask us to delete your account.
If you build a plugin with Plugferry
We collect your account email, the content you upload (GPT exports, API descriptions, knowledge files, logos) and the API credentials you store for your plugin. Credentials are encrypted with AES-256-GCM using a key specific to your workspace, are used only inside requests to the service they belong to, and are never shown to any model or returned by any tool.
Third parties
We do not sell personal information, use it for advertising, or use it to train AI models. We share data only with providers that run the service for us, and with the upstream service a plugin calls when you use it:
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting the bridges and network edge |
| Supabase (on Amazon Web Services) | Database, file storage, and a relay for upstream services that block Cloudflare's network |
| Postmark | Sending sign-in codes by email |
| The plugin's upstream services | Answering your request. For Diligence Desk: SEC EDGAR, GLEIF, USAspending.gov, RDAP domain registries and GitHub, all of which publish public records. |
Retention
Call records are kept for up to 13 months and then deleted; daily totals without identifiers may be kept longer. Account data is kept until you delete the account or ask us to. Encrypted credentials are deleted when the plugin owner removes them or deletes the plugin.
Your choices and rights
You can ask us to access, correct or delete personal information we hold about you by writing to support@plugferry.com. Because call records are pseudonymous, include the plugin name and the approximate time of use so we can find them. We answer within 30 days.
Children
Plugferry and the plugins it hosts are not directed to children under 13, and we do not knowingly collect their information.
Changes
We will post changes to this policy on this page and update the date above. Material changes will also be announced to plugin owners by email.
Contact
Black Matter VC, operator of Plugferry: support@plugferry.com