Privacy Policy
Last updated: October 22, 2026
- We collect only what's needed to run your account and the course: your email, your progress, and anything you choose to submit, like a review.
- Stripe handles payments. We never see or store your card number.
- We keep a security log (including IP addresses) to protect accounts and payments, for 90 days.
- We don't sell your data, run ads, or use tracking or analytics cookies.
- Email us any time to see or delete your data.
1. What we collect
| Data | When | Why |
|---|---|---|
| Email address and password (stored securely by Firebase Authentication, never by us in plain text) | You create an account with email | To log you in and tie your purchase to you |
| Name, email address and profile photo link from your Google account | You choose "Continue with Google" | Same as above. We use your first name to greet you in the course. |
| Purchase status (paid or not) | After you check out | To unlock the course. This is set by our server when Stripe confirms payment. |
| Course progress: lessons, sections and knowledge checks completed | As you work through the course | So you can pick up where you left off on any device |
| Your review: star rating, comments, first name (optional) and whether we may publish it | Only if you submit the end-of-course review | To improve the course and, only if you tick the consent box, to feature your review on our website |
| Security log: your IP address, browser type, the page you visited and the site that sent you there, sign-ups, sign-ins (including failed attempts and the email typed), password resets, checkout steps, purchases, and changes to your account record | When you visit the site, sign in, check out or use the course | To detect and stop account takeovers, payment fraud and attempts to get around the paywall |
| Messages you send us | You email us | To answer you |
Payment details (card number, billing address) go straight to Stripe and are governed by Stripe's Privacy Policy. Stripe tells us that a payment succeeded; it doesn't give us your card number.
2. How we use it
- To provide the course: logging you in, unlocking content you paid for, and saving your progress.
- To handle payments and refunds.
- To answer support requests and send messages about your account or purchase.
- To improve the course, using reviews and feedback.
- To keep accounts, payments and paid content secure, using the security log.
We don't sell or rent your personal information, and we don't use it for advertising.
3. Services we rely on
PlutoScan runs on these third-party services. Each receives only what it needs to do its job, and some of them see your IP address and browser details because your browser connects to them directly.
| Service | What it does for us |
|---|---|
| Google Firebase | Account login, the database that stores your progress and purchase status, the server functions that deliver course content, and the security log. A copy of the security log is kept in a separate Firebase project run by the same owner, used only for security monitoring. |
| Stripe | Secure checkout and refunds |
| GitHub Pages | Hosts the PlutoScan website |
| CoinGecko | Live coin data in the data widget and Research Scanner. Your browser requests this data directly, so CoinGecko sees the coins you search for, but not who you are. |
| Google Fonts and cdnjs (Cloudflare) | Deliver the site's fonts and icons |
We may also disclose information if the law requires it, or to protect PlutoScan and its users from fraud or abuse.
4. Data stored on your device
PlutoScan uses your browser's local storage, not tracking cookies. It holds:
- Your login session (managed by Firebase), so you stay signed in.
- A copy of your course progress, so the course loads quickly.
- Your watchlist, Research Scanner answers and any projects you add manually. These stay on that device only and aren't sent to us.
Clearing your browser's site data removes these. Your course progress is restored from your account the next time you log in.
5. How long we keep it
We keep your account data for as long as your account exists. If you ask us to delete your account, we delete your login, progress and review from our systems.
Security log entries are deleted automatically after 90 days. Security alerts raised from them (for example, many failed sign-ins from one IP address) are kept for up to one year. Stripe keeps its own payment records as required by financial regulations.
6. Your choices and rights
You can ask us at any time to:
- Send you a copy of the personal data we hold about you.
- Correct anything that's wrong.
- Delete your account and data. Deleting your account ends your course access.
- Stop featuring a review you allowed us to publish.
Email support@plutoscan.com from the address on your account. Depending on where you live, you may have additional rights under local law, and you can also complain to your local data protection authority.
7. Security
Passwords are handled by Firebase Authentication. Course content is only released by our server after it verifies your login and purchase. All connections use HTTPS. No system is perfectly secure, but we limit what we collect so there's less to protect.
8. Age requirement
PlutoScan is for adults aged 18 or older. We don't knowingly collect data from anyone under 18. If you think a minor has created an account, contact us and we'll delete it.
9. Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes, we'll also let account holders know by email.
10. Contact
Questions or requests: support@plutoscan.com