Privacy

What Plimsby holds, and why

Plimsby holds what it needs to give you an account and keep your workspaces, and uses it for nothing else. None of it is sold, shared, or used for advertising.

• Your account. The email address you sign in with, which is also where a password reset goes; your password, kept only as a one-way hash that cannot be turned back into it; and when the account was created.
• Where you are signed in. For each session, the browser and device it signed in from, the network address it came from and roughly where that is, and when it was last used. The sessions page shows you all of it, so that you can recognize a session that is not yours and end it. A session that has ended stays listed for thirty days and is then deleted.
• Your workspaces. Everything you keep in each one, held by the app it belongs to, and the grants between your workspaces. This is the service itself.
• A record of changes to the account. When the password was changed, when the address was changed or a change was undone, when a deletion was asked for or canceled, and when a session was ended. It holds identifiers rather than your address, and it is what lets a restore from backup re-apply these changes instead of quietly undoing them.
• The messages sent to you. Links to confirm an address or reset a password, and notices when the address on the account changes or a deletion is scheduled or canceled. Plimsby sends no newsletters and no marketing.
• Logs. Plimsby’s services record what they do with internal identifiers for the account, its sessions, and its workspaces, and never your address, your name, or anything you keep. Every request to the site is also recorded with the network address and browser it came from and the page it asked for.

One cookie keeps you signed in. It holds a reference to your session, which the hub keeps, and it is scoped to plimsby.com so that every app on the platform sees the same sign-in. Plimsby sets no other cookie and runs no analytics. The light or dark theme you choose is kept in your browser and never sent.

Everything the account holds can be downloaded as one file from your account page, where the address on it can be changed and the account deleted.

Who handles it

Google, and nobody else. Plimsby runs on Google Cloud: the site, the services behind it, the database and its backups, and the logs. The database and its backups are in Google’s us-central1 region, in Iowa, in the United States. Mail to your address is sent through Google Workspace, from noreply@plimsby.com. Google handles this data on Plimsby’s behalf, under the terms of Google Cloud and Google Workspace.

Plimsby has no analytics provider, no advertising partner, and no other mail provider, and gives your data to nobody else.

What is left after you delete your account

Deleting the account signs it out everywhere at once and stops every app serving your data, so from your side it is gone straight away. For fourteen days you can sign in and cancel. After that, the account and every workspace in every app are erased, normally within the hour.

Some things outlast the erasure. Two are kept on purpose: the record that the deletion happened, and invoices, once there are any. The rest expire on their own schedule, and nobody edits them in the meantime. This is all of it:

• A record that the account was deleted

  Kept with no end date

  A one-way code made from the address with a secret key, and two timestamps: when the deletion was asked for, and when the erasure began. It holds no address and no name. Given the address, the code can be checked against it, but the address cannot be worked out from the code. It is kept so that the deletion can be proved, and so that nothing, a restore from backup included, can quietly bring the account back.

• Copies in database backups

  Seven days

  The database is backed up once a day and the last seven backups are kept, with seven days of the transaction logs that let it be recovered to any moment in between. Neither is edited, so the last copy holding your data expires on its own within seven days of the erasure.

• Service logs and job records

  Thirty days

  Internal identifiers for the account, its sessions, and its workspaces, in the logs Plimsby’s services write and in the records of the jobs that carry out the erasure. Never your address, your name, or anything you kept.

• Request logs

  Thirty days

  The network address and browser each request to plimsby.com and its apps came from, and the page it asked for. Google’s infrastructure writes them, and they cannot be edited one field at a time, so they are kept whole and deleted after thirty days.

• Copies of the messages sent to you

  Sixty days

  Plimsby’s own mailbox keeps a copy of each message it sends, so that a message that bounces can be read against the one it is about. A copy holds your address and any single-use link in it, and nothing else about you. Each copy is moved to the trash after thirty days, and the trash is emptied thirty days after that, so every copy is gone within sixty days.

• Mail delivery records

  Thirty days

  Google Workspace’s record of each message’s recipient, subject line, and times of sending and delivery. Subject lines say nothing about you.

• Invoices

  None today

  Plimsby charges for nothing, so there are no invoices. If that changes, invoices will be kept apart from the account for as long as tax law requires, and this page will say for how long before the first one is issued.

The deletion confirmation says the same before it asks for anything, and offers an export first.

Questions

Write to kelly@plimsby.com. The terms say what using Plimsby involves.

Last changed on Friday 2 October 2026.