PlausioPrivacy Policy for Plausio
Last updated: October 11, 2026
This is a translation of the German original. In case of discrepancies, the German version prevails. https://plausio.app/datenschutz/
This Privacy Policy applies to this website and the Plausio app for Mac, iPhone and iPad from the App Store. It explains which data is generated when you use the app, where it goes and what rights you have.
This Website (plausio.app)
Controller: COPAtec GmbH, In der Henn 47, 50354 Hürth, Germany, info@copatec.de (represented by its Managing Director Gerd Bernhardt).
Hosting: This website is delivered via Firebase Hosting by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit it, Google, acting as our processor, processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer, and browser and operating system information. This serves the secure and reliable delivery of the site (Art. 6(1)(f) GDPR). A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Firebase privacy information: https://firebase.google.com/support/privacy
No cookies, no tracking: This website does not set cookies, uses no analytics or marketing tools, and loads no fonts or scripts from third parties.
Contact by e-mail: If you write to us, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer required for this purpose and no statutory retention obligations apply.
Your rights (access, rectification, erasure, restriction, objection, data portability, complaint to a supervisory authority) are described below in Section 8; they apply to the website accordingly.
1. Summary
- Plausio processes data locally on your device. We do not operate any servers of our own for Plausio and have no access to your analyses, reports, chats or API keys.
- Plausio contains no analytics or tracking tools and no advertising.
- For analyses, Plausio retrieves public comments directly from your device via the official interfaces of YouTube, X and Instagram – for YouTube by default using a key of ours stored in the app, for X and Instagram using your own access credentials.
- For the AI assessment, Plausio sends content to the AI provider that you select and set up yourself: Anthropic (Claude), OpenAI, Google (Gemini), DeepSeek or your own Ollama server – in each case using your own API keys. Before the first transfer to a provider, Plausio asks for your consent. The local analysis and Apple Intelligence work entirely without any transfer to AI providers.
- Reports containing retrieved comments are automatically deleted after 30 days.
2. Controller
COPAtec GmbH
represented by its Managing Director Gerd Bernhardt
In der Henn 47
50354 Hürth
Germany
E-mail: info@copatec.de
Register court: Amtsgericht Köln (Local Court of Cologne), HRB 91009
3. Processing on Your Device
| Data | Storage location | Access by us |
|---|---|---|
| Analysis reports, history | locally in the app on your device | no |
| Chat histories for reports | only in memory while in use | no |
| API keys and access credentials (Anthropic, OpenAI, Google Gemini, DeepSeek, Ollama, X, Instagram, your own YouTube key if applicable) | your device's keychain | no |
| App settings, consents given for AI providers | locally on your device | no |
| retrieved comments and account information (YouTube, X, Instagram) | locally; automatic deletion after 30 days | no |
You can delete reports in the app at any time. When you delete the app, the app data stored locally is removed. Depending on the system, keychain entries may be retained; therefore, delete your keys in the settings beforehand if you want to remove them.
4. Transfer to Third-Party Providers
When you start an analysis or ask a question in the chat, Plausio sends requests directly from your device to the providers listed below. For technical reasons, your IP address and connection information are also transmitted. We do not obtain knowledge of these requests.
The legal basis is the performance of the function you requested under the contract of use (Art. 6(1)(b) GDPR). For the transfer to AI providers, Plausio additionally obtains your consent before the first transfer to the respective provider (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: in the settings under AI → Provider → "Revoke permission to transfer data".
4.1 AI Providers (of Your Choice)
Data is only sent to providers that you have set up with your own API key (for Ollama, with your server address) and for which you have permitted the transfer. For this purpose, you enter into a separate contract with the provider; which company is your contractual partner and how long the provider stores requests is determined by that contract and the provider's privacy notices.
- Purpose: content analysis (assessments of disinformation, bot behavior, narratives and discussions) and answers to your follow-up questions about reports.
- Data transmitted: the public content to be analyzed (comment texts, timestamps, account names or aliases, public account details such as creation date and subscriber count), analysis instructions, your chat questions, your API key and your IP address.
Anthropic (Claude) – Anthropic, PBC, USA. Optionally, Claude checks claims via web search; for this purpose, Anthropic performs search queries derived from the analyzed content. Privacy notice: https://www.anthropic.com/legal/privacy
OpenAI – OpenAI, USA, or the company in the EU responsible for your contract. Privacy notice: https://openai.com/policies/row-privacy-policy/
Google (Gemini API) – Google Ireland Limited or Google LLC, USA. Depending on the tier of your Gemini API access (free or paid), Google may also use content to improve its services. Terms: https://ai.google.dev/gemini-api/terms, Privacy Policy: https://policies.google.com/privacy
DeepSeek – DeepSeek, People's Republic of China. There is no adequacy decision of the EU Commission for China. The level of data protection is not comparable to that of the EU; in particular, government authorities may have far-reaching access to data under Chinese law, and you may not have effective legal remedies available there. Plausio expressly points this out before the first transfer ("DeepSeek (China)"); the transfer takes place only on the basis of your explicit consent (Art. 49(1)(a) GDPR). Privacy notice: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
Ollama – If you set up your own Ollama server (e.g. on your computer or in your local network), the content is sent only to that server; no third party is involved. On iPhone and iPad, the system asks for permission to access the local network on first access. If you use the cloud service ollama.com instead, the content is sent to Ollama, USA. Privacy notice: https://ollama.com/privacy
Transfer to the USA: Insofar as a provider processes data in the USA, the transfer takes place on the basis of the EU-U.S. Data Privacy Framework, insofar as the provider is certified under it, and otherwise on the basis of the safeguards provided by the provider, such as standard contractual clauses (Art. 46 GDPR), or your consent (Art. 49(1)(a) GDPR).
4.2 Google / YouTube – Retrieval of Public YouTube Data
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, USA.
- Purpose: retrieval of publicly accessible YouTube data (videos, channels, comments, public channel information such as creation date) via the YouTube Data API.
- Key: By default, Plausio uses an API key stored in the app from our Google Cloud project; optionally, you can enter your own key in the settings. With our key, we only see aggregated usage statistics (e.g. number of requests and quota consumed), but neither the retrieved content nor IP addresses nor information about individual users.
- Data transmitted: requested video and channel IDs, the API key used, the app identifier and your IP address.
- See also the YouTube notice in Section 9.
4.3 X – Retrieval of Public Replies on X
- Provider: X Corp., USA; for users in the EU, Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland.
- Purpose: retrieval of public replies to posts you specify, together with public account information of the repliers (name, creation date, number of followers and posts), via the X API.
- Access credentials: your own bearer token from your X developer account. Billing takes place between you and X.
- Data transmitted: requested post IDs and search queries, your bearer token and your IP address.
- Privacy notice: https://x.com/privacy
4.4 Meta / Instagram – Retrieval of Comments on Your Posts
- Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
- Purpose: retrieval of the comments on posts of your own Instagram Business or Creator account via the Instagram Graph API (username, text, time, number of likes).
- Access credentials: your own access token from your Meta app and the ID of your Instagram account.
- Data transmitted: requested post IDs, your access token, your account ID and your IP address.
- Privacy notice: https://www.facebook.com/privacy/policy/
4.5 Apple Intelligence – On-Device Analysis and Chat
If you select "Apple Intelligence" for the analysis or the chat, content and questions are processed on your device using Apple's on-device language model. Plausio does not send any data to us or to third parties in this case. Apple's privacy policy applies to Apple Intelligence: https://www.apple.com/legal/privacy/
4.6 Purchases via the App Store
Purchases and subscriptions are handled by Apple via the App Store. We do not receive any payment data. The app verifies your purchases via Apple's StoreKit on your device. From Apple, we only receive aggregated sales statistics that cannot be linked to individual persons. Apple's privacy policy applies: https://www.apple.com/legal/privacy/
5. Third-Party Data in Public Comments
During analyses, Plausio processes publicly accessible content of persons who are themselves not users of Plausio – comments and replies on YouTube, X and Instagram, account names, public account information and timestamps.
Who is the controller? Analyses are initiated exclusively by you and take place on your device; we have no access to the retrieved content or the results. You decide which content you analyze, to which AI provider it is sent and what you do with the results. You are therefore, as a rule, yourself the controller under data protection law for your analyses and their further use, and you must comply with the applicable laws as well as the terms of the platforms.
Legal basis and balancing of interests: Insofar as we are (jointly) responsible for this processing, we base it on Art. 6(1)(f) GDPR. The legitimate interests lie in exposing disinformation and coordinated inauthentic behavior in public discussions, in promoting media literacy, and in the freedom of expression, information, the press and science. The following applies:
- Only content that the data subjects have made public themselves is processed.
- Processing takes place locally on the user's device; no central database about persons is created.
- Plausio does not create profiles of individual persons; conspicuous accounts are displayed as aliases (K1, K2 …).
- Reports containing retrieved comments are automatically deleted after 30 days.
- The AI is instructed not to draw any inferences about special categories of personal data (e.g. religion, health, origin, sexual orientation) and not to speculate about the real identity of persons. Insofar as public content itself contains such information, its processing is based on Art. 9(2)(e) GDPR (data manifestly made public).
- Results are labeled as AI assessments – indications, not proof.
- Before first use, users must undertake to use Plausio responsibly (no surveillance, harassment, public shaming or doxing).
Notice for data subjects: Since we do not see the analyses and do not store any data about third parties, we cannot provide information about individual analyses. Please contact the person who performed the analysis or the respective platform. For general questions, you can reach us at info@copatec.de.
6. Contact and Support
If you contact us by e-mail, we process your details (e.g. name, e-mail address, message) in order to respond to your inquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once the inquiry has been dealt with, provided there are no statutory retention obligations.
Please do not send us any API keys and, if possible, no reports containing personal data of third parties.
7. Storage Period
| Data | Storage period |
|---|---|
| Reports containing retrieved comments (YouTube, X, Instagram; including account, channel and post information) | automatic deletion after 30 days |
| Other reports and history | until you delete them in the app or remove the app |
| Chat histories | until you quit the app or delete them |
| API keys, consents | until you delete or withdraw them in the settings |
| Support inquiries | until resolved, unless a retention obligation applies |
For data processed by third-party providers (Anthropic, OpenAI, Google, DeepSeek, Ollama, X, Meta, Apple), their retention periods apply.
8. Your Rights
Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, or with the authority at your place of residence.
Since most data is stored only locally on your device, you can view, export (Markdown export) and delete it there yourself. For data held by third-party providers, please contact the respective provider.
9. Notice on the Use of YouTube API Services
Plausio uses the YouTube API Services to retrieve publicly accessible YouTube content. By using the YouTube features of Plausio, you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms
Processing by Google is subject to the Google Privacy Policy: https://policies.google.com/privacy
Plausio does not require access to your YouTube or Google account. Plausio stores retrieved YouTube data locally on your device and automatically deletes it after 30 days. Plausio does not use cookies or similar technologies to store or read information on your device for YouTube or third parties. YouTube data is not shared with us or with third parties – with the exception of the transfer of the content to be analyzed to the AI provider that you select and permit yourself, as described in Section 4.1.
10. No Analytics or Tracking Tools, No Advertising
Plausio contains no analytics, tracking or advertising SDKs and does not create usage profiles.
11. Children
Plausio is not directed at children.
12. Changes to This Privacy Policy
We will update this Privacy Policy if the app or the legal situation changes. The version published at https://plausio.app/en/privacy/ applies.