A board hangs on a wall where guests can read it, so being straight about what it stores matters more here than in most products. This notice says exactly what HoangCore LLC keeps, why, for how long, and who else sees it.
Your account. Your email address, a name if you give one, and your password — hashed, never stored in a form anyone can read. The date you confirmed your email and the date you last signed in.
Your team. The email address and role of anyone you invite, and which boards each person may work on.
Your boards. Their names, timezones, themes, the widgets on them and how those widgets are configured. The wifi password, and any other field a widget marks as secret, is encrypted at rest with libsodium and decrypted only when a board you authorized is being drawn or when you're editing it. So is a booking calendar's link, if a board follows one: whoever holds that link can read the calendar, so after you paste it we never show it again, not even to you.
Calendars on a board. On Pro or an Event Pass, a calendar widget shows what's coming up from a calendar you link (Google, Outlook, iCloud or another). Its link is one of those secret fields: it's shown to the people who can edit the board, masked for anyone who can only view it, and never sent to a TV. Our server reads the calendar and keeps the next two weeks of its events, only their titles, places and times, never a description or who's invited. The board shows those titles and places, so share a calendar with only what that room should see. The copy is refreshed every 15 minutes while a board shows it, kept for up to a week after that so the board doesn't go blank when the calendar can't be reached, and then deleted.
Headlines on a board. On Pro or an Event Pass, a headlines widget shows the newest posts from a news or blog feed you link. Our server reads the feed and keeps its 20 newest posts as plain text: each one's title, the start of its text, when it was posted, the site's name and its link (which the board never shows), never a picture. The copy is refreshed every 15 minutes while a board shows it, kept for up to a week after that so the board doesn't go blank when the feed can't be reached, and then deleted.
Birthdays and milestones on a board. On Pro or an Event Pass, a celebrations widget shows your team's birthdays, work anniversaries and welcomes. For each person you add we keep a first name and the initial of their last name (a whole last name is shortened to its initial before it's stored), what they're celebrated for, and the date. A birthday is only a month and a day: we never ask for the year and don't keep one. An anniversary or a welcome keeps its year, so the board can count the years, or show the welcome once. A photo, if you add one, is re-saved like every picture you upload. The board shows only the people whose day is today or this week. Ask people before you add them. They're gone from the board when you take them off the list or remove the widget; a photo is kept with the board's other pictures for as long as the board is.
Numbers from a sheet. On Pro or an Event Pass, a numbers widget can show cells from a Google Sheet you publish to the web. Its link is one of those secret fields: whoever holds a published sheet's link can read the whole sheet, so it's shown only to the people who can edit the board and never sent to a TV. Our server reads the tab at most every five minutes while a board shows it, and keeps only the cells the widget names, as plain text, never the rest of the sheet. The copy is kept for up to a week after that so the board doesn't go blank when the sheet can't be reached, and then deleted. Numbers you type in yourself are kept like any other widget setting.
Alerts on a board. When someone on your team puts an alert on a TV, we keep its words, its tone and style, who put it up and when, and when it comes down. It's deleted within a day of coming down, by itself or taken down (for the first ten minutes, Undo can put it back). Severe weather alerts, if a board is set to show them, come from the warnings its weather widget already asks the National Weather Service about; nothing else is sent to anyone, and no alert is ever pushed to a phone, emailed or texted.
Your TVs. For each paired TV: a name you choose, which board it shows, when it was paired and when it last checked in. We store a hash of its access token, never the token itself.
Billing. If you pay us: a Stripe customer id, your subscription's status and renewal date, and a record of what was charged. Your card details go straight to Stripe and never reach our servers.
Guests don't have accounts and we don't ask them to identify themselves.
Messages. The message, and the first name they choose to type. Optional — many leave it blank.
Photos. The picture, and a name and a short caption if they give them. When the host has the rude-word check on, a caption goes through it like a message does, and a caption it flags waits for the host. Every photo is decoded and re-encoded when it arrives, which removes EXIF metadata — including the GPS coordinates a phone usually writes into a party photo. The original file is never kept. We store a display copy and a thumbnail, and nothing else.
A name on a welcome. If a host greets a guest by name, the first name the host types. Only the first word is kept, so a last name never reaches us or the screen. A welcome starts out set to hide after the event, and the name is gone when the host changes it or removes the widget.
Stays on a rental board. On Pro, a host can have a board follow their listing's booking calendar. We then keep the dates of each stay, and a guest's first name only when the host types one or asks us to take it from the booking's title, which some property managers' calendars include (Airbnb's and VRBO's don't). Nothing else from a booking is kept: no title, no description, no phone digits. A name shows on the TV only during its stay. It's deleted within two days of check-out, and the stay itself within a week.
Votes on a poll. On Pro or an Event Pass, a host can put a question on the TV for guests to vote on from their phones. We keep which answer each phone picked, and a keyed hash of the random key in that phone's guest cookie (see Cookies, below), so a guest can change their mind but can't vote twice. A vote says nothing about who cast it, and the same phone hashes differently on every question. Votes are deleted on the same schedule as messages and photos, or as soon as the host resets them.
A table plan. On Pro or an Event Pass, a host can put their guest list on the TV with each guest's table, so guests can look up their own on their phones. We keep each name and table as the host pastes them, and nothing else about the guests. What a guest types to find themselves is used to answer them and isn't stored. A table plan starts out set to hide after the event, and the list is gone when the host changes it or removes the widget.
Addresses and phones. We store a keyed hash of the guest's IP address, never the address itself. With a photo we also keep a keyed hash of the random key in their phone's guest cookie (see Cookies, below), never the key. They exist only to stop one person flooding a board, and neither can be turned back into an address or a key.
Guest content waits for the host's approval by default. It belongs to the host's account and is deleted on the same schedule as everything else there. Until then, the host can download the photos that went up on the TV and print the messages as a guestbook.
Whose data it is. The host decides what a board is for, what goes on it and who can see it, so in the words data protection law uses, the host is the controller of what their guests send and we're the processor: we handle it to run the board they asked for, and for nothing else. If you're a guest and you'd like a message or a photo taken off a board, the host can do it straight away — ask them, or email us and we'll pass it on.
Four, all necessary, none of them for tracking:
There is no analytics script on this site and no third-party tracker.
That's the whole list. If we ever add to it we'll update this page, and if the change affects what happens to your data we'll email the account's admins as well.
We don't share your data with anyone else, and we don't sell it. If we're ever legally compelled to hand something over, we'll tell you unless we're forbidden to.
There is one situation where your data would move, and it's fair to say so before it happens rather than after. If PlazaScreen is sold, merged into another company, or transferred as part of a restructuring, your account and everything in it would go with the service — otherwise the only option would be to shut it down and delete your boards, which is worse for you, not better.
That is not the same as selling your data, and we won't use it as a way around the sentence above: it only happens alongside the service itself, to whoever runs it next. We'll email the account's admins before it happens. Whoever takes it on is held to this notice as it stands until they give you notice of a change — and if you don't like the change, you can export everything and close the account.
On servers in the United States. If you're outside the US, using the service means your data is processed there.
Depending on where you live, you may have rights to access, correct, delete or port your data, or to object to how it's handled. Email us and we'll honor them; we don't require you to prove a jurisdiction first.
The service isn't aimed at children and we don't knowingly collect their data. A child might well send a photo to a family board — that content belongs to the host's account, and the host can remove it at any time.
Passwords are hashed. Secret widget fields are encrypted at rest. Board links are unguessable random tokens rather than names. Uploaded files are validated, re-encoded and served only through a handler that checks permission first — never from a public directory.
No system is perfect. If you find a problem, tell us at security@plazascreen.com and we'll act on it. We won't threaten anyone for looking, and we'd rather hear it from you first. The same address is published at /.well-known/security.txt.
If this notice changes in a way that matters, we'll email the account's admins before it takes effect.
HoangCore LLC
Privacy: privacy@plazascreen.com
Anything else: hello@plazascreen.com
See also the terms, or support if you have a question rather than a legal one.