Back

Privacy policy

Draft

This is a draft for review by a lawyer before Plia opens to the public. Plia is a prototype. Last updated: 21 October 2026.

In short

  • You can use search, the Season screen and performance pages without an account. We don’t use advertising or tracking cookies.
  • With an account we keep only what the features need: your email, what you save, your schedule, what you mark as seen, your ratings and notes, and your settings. If you use them: your private calendar link and the ticket notifications you asked for.
  • Your profile and lists are private. Your ratings and notes are visible only to you. Plia shows no public ratings.
  • You can download your data or delete your account at any time in Menu → Profile.

Who is responsible

Plia is run by Mariia Mukhanchikova, Portugal, who is responsible for your data (the controller). Contact for anything about your data: pliaballet9@gmail.com.

What we keep and why

  • Your email address and sign-in details (sign-in method, when the account was created and last used): to sign you in and keep your lists in your account. If you sign in with Google, Google sends us your email address, your Google account number, and your name and profile picture. We keep only the email address and the account number (to recognise you next time); the name and picture are removed as soon as you sign in and are not stored or shown in Plia. We don’t get your Google password or contacts.
  • Saved performances (hearts) and your schedule, with the title, date and venue at the moment you saved them: to show them to you, also when a theatre takes a performance off its website.
  • Seen, your star ratings and private notes, including what you add by hand in your notebook (title, choreographer, company, place, date): to show your own history. Notebook entries stay private and never appear in the season. Ratings are also used for two more purposes:
    • Suggestions for you (later): performances you may like, based on the choreographers, companies and styles you rated. You can switch this off at any time in Menu → Profile → “Suggestions from your ratings”.
    • Anonymous statistics for the owner of Plia: overall figures only, for example which choreographers and theatres get higher ratings on average. Nobody sees your individual ratings or notes, and the figures are not linked to your email.
  • Your private calendar link, if you subscribe to your schedule in Google Calendar, Apple Calendar or another calendar: a long random address that shows your schedule as a calendar file. Anyone who has the link can see your schedule, so keep it to yourself. You can make a new link (the old one stops working at once) or turn it off in Menu → Profile. Your calendar provider (for example Google or Apple) fetches the file from this link and keeps a copy under its own privacy terms.
  • Ticket notifications (“Notify me when tickets go on sale”): which performances you asked about and in which city, when you asked, and whether and when we told you. We tell you once, by email to your sign-in address and, if you switched it on, by a notification on your device.
    • Email: sent through Gmail. Each email has a one-click link to stop these emails; you can also switch them off in Menu → Profile.
    • Copies of sent emails: Gmail keeps a copy of every email Plia sends (sign-in codes and ticket emails) in Plia’s mailbox: your email address, the time, and the code or the performance title and place. See “How long we keep it”.
    • Notifications on a device: only after you allow them on that device. We keep the device’s push subscription: an address at your browser’s push service (Apple, Google or Mozilla) and encryption keys. It contains no name or phone number. The notification travels through that push service. Switching notifications off on the device or signing out removes it.
  • Settings: for example whether suggestions and ticket emails are on.
  • Messages you send us with “Report a problem” or “Send feedback”: these open your own email app; the message arrives at pliaballet9@gmail.com and is kept in Plia’s Gmail mailbox, with your email address and what you wrote (and, from a performance page, a link to that page). We use it only to answer you and fix the problem.

Legal basis (Art. 6 GDPR):

  • Contract (Art. 6(1)(b)): your account and its features — Saved, My schedule, Seen, the notebook, ratings, suggestions and the calendar subscription.
  • Legitimate interest (Art. 6(1)(f)): technical logs, security, protection against abuse, backups and anonymous statistics.
  • Consent (Art. 6(1)(a)): “Notify me” emails and notifications on your device. You can withdraw consent at any time in Menu → Profile or with the link in each email.

We don’t sell your data, don’t show ads and don’t build advertising profiles.

On your phone

Plia uses only what it needs to work: a sign-in cookie that keeps you signed in, and the app’s own storage on your phone (for example, performances saved before accounts existed, which move to your account when you sign in). No analytics or advertising cookies.

Where your data is stored

  • Supabase (database and sign-in): servers in the European Union, Ireland.
  • Vercel (hosting of the app): the app’s server functions run in the European Union, Ireland; pages are delivered through Vercel’s worldwide network.
  • Google: if you choose “Continue with Google”; sign-in codes and ticket emails are sent through Gmail, and messages you send us arrive in Gmail.
  • GitHub (Actions): the scheduled job that sends ticket notifications reads, for that moment only, the email address and device subscriptions of people who asked to be told; it keeps no copy and logs only counts. GitHub also stores our encrypted nightly backup copies of the database for 30 days. Only we can open them.
  • Push services of your browser (Apple, Google, Mozilla): deliver notifications to your device, if you switched them on.

Supabase stores the database in the European Union (Ireland). Vercel, GitHub and Google (sign-in with Google, Gmail for emails, and Gemini, which writes performance descriptions and gets no data about you) are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and the EU Standard Contractual Clauses. Push services of Apple, Google and Mozilla deliver notifications to your device under their own terms.

How long we keep it

  • Your account and lists: until you delete your account. An account nobody has signed in to for 24 months is deleted with all its data; we email you 30 days before.
  • Ticket notifications you asked for: until you remove them in Menu → Profile or delete your account. A device’s push subscription: until you switch notifications off, sign out on that device, or the browser tells us it no longer exists.
  • Copies of the emails we sent you (sign-in codes, ticket emails) in Plia’s Gmail mailbox: deleted after 30 days, also after you delete your account (these copies are not deleted at the same moment as the account, but within those 30 days).
  • When you delete your account, everything in your account is deleted at once: your email, saved performances, schedule, Seen, ratings, notes, settings, your calendar link (it stops working) and your ticket notifications and device subscriptions, and your sign-in details (email address, Google account number).
  • We make an encrypted backup copy of the database every night and keep each copy for 30 days. When you delete your account, it is removed from the database at once and disappears from the backup copies within 30 days, when the last copy made before the deletion expires. We use backups only to restore the service after a failure.
  • Messages you send us with “Report a problem” or “Send feedback”: kept in Plia’s Gmail mailbox and deleted after 12 months.
  • Technical logs of our providers (for example IP address and time of a request) are kept for a short time for security, up to 1 day.

Your rights

You can see, download, correct and delete your data, object to its use (for example, switch off suggestions) and ask us to restrict it. Download and delete are in Menu → Profile; for anything else, write to pliaballet9@gmail.com. You can also complain to a data protection authority, for example the Comissão Nacional de Proteção de Dados in Portugal (www.cnpd.pt) or the one where you live.

Children

An account is for people aged 16 or older.

Artists’ names

Performance pages show the names of choreographers and performers as published by the theatres, with their role in the performance only.