Privacy Notice

01 Company

We are The Plain Works Co., Ltd., a company registered in the Republic of Korea, and we are the controller of the information this notice describes. Company details are on the Company page. Our Privacy team handles privacy questions and requests at hello@theplain.works.

02 Information we handle

• Messages. We receive the sender details and contents of emails sent to our published addresses.
• Technical requests. The site is hosted on Cloudflare, which processes your IP address and request details (such as the page requested, browser and device type) to deliver the site and keep it secure. We also keep Cloudflare Workers request logs for diagnostics.
• Usage analytics. We use PostHog, through our own domain, to count page views and clicks on this site. It uses a random identifier held only in your browser's memory for that page load, writes nothing to cookies or browser storage, and does not record sessions. It is off when your browser sends Do Not Track or Global Privacy Control. PostHog processes this data for us in the United States.

This site has no accounts or checkout. It sets no cookies, has no contact form and runs no advertising trackers.

03 Purposes

• Deliver, secure, diagnose, and maintain this website.
• Answer the emails you send us about the company, legal or privacy questions, or anything else.
• Meet applicable legal, accounting, and security obligations.

We do not sell personal information received through this website.

04 Service providers and transfers

We use Cloudflare to host and deliver the site, PostHog for usage analytics and an email provider to receive messages. Those providers may process information in countries outside the Republic of Korea under their applicable contractual and legal safeguards. We disclose information when required by law or when necessary to protect the company, the site, or other people.

05 Retention and security

We retain correspondence and technical records only as long as needed for the purposes above, including reasonable security, legal, and recordkeeping periods. We use access controls and encryption in transit, but no internet service is completely secure.

06 Your choices

Depending on the law, you can ask to see, correct, delete or restrict the personal information tied to your message. Send requests to hello@theplain.works. We may need to verify the request and may retain information where the law permits or requires it.

07 YouTube API Services

Our internal video uploader uses YouTube API Services to upload videos we make to our own YouTube channels. Only our staff use it, and only with channels the company owns. By default it runs as a dry run that sends nothing to YouTube; a real upload happens only when our staff start it in live mode. Anyone who uses it agrees to be bound by the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

• What it accesses. After a channel owner signs in with Google and approves access, the uploader uploads a video as private, with its title, description, tags, thumbnail and captions. It then reads back that video’s status and the signed-in channel’s ID and name, to confirm the video is private and on the intended channel. If YouTube reports the video as anything other than private, the uploader sets it to private. The access we request also includes read-only YouTube Analytics. We may use it to read how our own channels’ videos perform; the uploader does not read analytics today.
• What it stores. The sign-in tokens Google issues are kept only in the protected system keychain of a company-controlled computer, never in files, logs or source code. For each upload we keep a local record of the video ID, title, channel ID, upload time and privacy status, plus a fingerprint of our own video that we use to avoid uploading near-duplicates.
• How it uses and shares data. We use this data only to upload and check our own videos. The uploader does not access information about other YouTube users or channels, and it does not comment, like, subscribe or delete videos. We do not sell or share YouTube API data with anyone, and we do not use it for advertising. The uploader sets no cookies and stores nothing on anyone else’s device.
• Revoking access. A channel owner can remove the uploader’s access at any time on the Google security settings page. Removing access stops the uploader from using the tokens. We delete the stored tokens for a channel when we disconnect it or when its owner asks us to. We do this ourselves; it is not automatic.

Questions about the uploader: hello@theplain.works.

08 Pinterest

We use an internal tool to make pins from our own content for our brands’ Pinterest business accounts. Once Pinterest approves our access, the tool can publish those pins to the same accounts through the Pinterest API; until then we upload them ourselves with Pinterest’s bulk upload file. Until we switch publishing on for an account, the tool only records the request it would send, without credentials, and sends nothing. Only our staff connect accounts, using Pinterest’s own sign-in, and we never collect Pinterest passwords. Pinterest’s handling of your information is described in the Pinterest Privacy Policy.

• What it accesses. We ask the account owner to approve these Pinterest permissions: read and manage boards (boards:read, boards:write), read and write pins (pins:read, pins:write), and read basic account details (user_accounts:read). The tool uses them to confirm it is the right account, to find the board for a pin, and to create the pins it makes.
• What it stores. The sign-in tokens Pinterest issues, with the account’s Pinterest user ID and username, are kept in the protected system keychain of a company-controlled computer, never in files, logs or source code. The short-lived access token may also be kept as an encrypted secret in the Cloudflare Worker that schedules our posts; the refresh token and our app secret stay in the keychain. We also keep records of the pins our tool makes.
• What it doesn’t do. The tool does not collect, store or share information about other Pinterest users. It does not follow, like, comment, message or save other people’s pins. We do not sell Pinterest data or use it to train AI models.
• Disconnecting. To disconnect an account or ask about this tool, email hello@theplain.works. We delete the stored tokens when we disconnect an account or when its owner asks us to. We do this ourselves; it is not automatic.

09 Product privacy information

This notice doesn’t replace the terms, privacy policy or data-processing information of any product we make. Use the legal and support links inside the product you use. The Content Pipeline disclosure describes the limited Google account access used by that internal tool.

Besides YouTube and Pinterest, that tool has publishing connections to our own LinkedIn, Instagram, Threads, Facebook Page, Bluesky and dev.to accounts. It uses the sign-in tokens or API keys we store for them only to publish our approved posts to those accounts and to read back the status of the post it just made. These may be kept in our keychain or as encrypted secrets in the Cloudflare Worker that schedules our posts. The tool has no connection to X or TikTok; a team member posts there by hand.

10 Changes and contact

We will update the date above when this notice changes. To reach us about privacy or anything else, email hello@theplain.works and put the topic in the subject line.