Privacy Policy

Last updated: 12 October 2026

This policy explains how GafferPlot handles your personal data. GafferPlot is made and operated by Svetoslav Tcheresharski ("we", "us"), an independent developer in Sofia, Bulgaria. We are the data controller. The policy covers the GafferPlot web app at gafferplot.cherry-lighting.com and the GafferPlot app for iPhone and iPad. GafferPlot Remote is a separate app with its own privacy policy.

The short version: we collect what we need to run your account and sync your work, nothing more. We do not sell your data, show ads or track you across other apps and websites. The iPhone and iPad app contains no analytics.

1. What we collect

Account data: your email address. If you sign in with a password, it is stored only in hashed form by our authentication provider; we never see it.
Sign in with Apple (app): Apple gives us an account identifier and an email address. You can choose to hide your real address, in which case Apple gives us a private relay address. If you choose to share it, Apple also gives us your name.
Google sign-in (website only): Google gives us your email address and basic profile information such as your name.
Your projects: the lighting plots you create, including fixtures, DMX patches, power and rigging data, notes, and any photos or plans you place under a plot. They are stored on your device and, while you are signed in, synced to our cloud database so they appear on every device you use.
My Library: fixtures and sets you save, synced like your projects.
Subscription and usage data: your plan, trial dates and how many exports you have used, so we can run the free and Pro tiers. For subscriptions bought on the website we store the customer and subscription identifiers from our payment provider. For subscriptions bought in the app we store the details Apple sends us about the purchase: the product, purchase and expiry dates, a transaction identifier and whether it was a test purchase.
Live share: when you start a live share, your plot is sent to anyone who opens the share link while sharing is on. It passes through our infrastructure provider's real-time service and is not stored there.
Website analytics (website only): we use Umami, a privacy-friendly analytics service that uses no cookies, does not identify you and does not follow you across sites. It tells us in aggregate which pages and features are used. The iPhone and iPad app has no analytics.
Emails you send us: if you contact support, we keep the conversation to help you.

Device permissions (iPhone and iPad): the app uses the camera only when you choose to take a photo of a location or plan to place under your plot, and adds images to your Photos only when you choose to save one. It does not read your photo library, contacts or location.

2. Why we use it, and on what legal basis

To provide the service you signed up for (contract): your account, syncing your projects, exports, live share, subscriptions and trials, and essential account emails such as confirmation and password reset.
To keep GafferPlot secure and improve it (legitimate interests): preventing abuse, fixing errors and understanding, in aggregate, which features are used.
To meet legal duties (legal obligation): for example, keeping records of payments for tax purposes.

3. Payments

We never see or store your card details.

On the website, payments are handled by Creem, our payment provider and Merchant of Record, under its own privacy policy.
In the iPhone and iPad app, payments are handled by Apple through In-App Purchase, under Apple's privacy policy. When you subscribe, the app sends Apple your GafferPlot account identifier, so the subscription unlocks Pro on your account and no one else's. Our server checks each purchase with Apple and receives Apple's notifications about renewals, cancellations and refunds.

4. Who processes your data for us

We use these service providers, each of which processes data only to provide its service to us:

Supabase: database, sign-in and server functions. Servers are in the EU (Frankfurt).
Hostinger: hosting of the website and web app.
Our email provider: delivery of account emails.
Creem: website payments.
Apple: App Store purchases and Sign in with Apple.
Google: Google sign-in on the website.
Umami: website analytics.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We do not sell your personal data, we do not show third-party advertising, and we do not track you across other companies' apps or websites.

5. Deleting your account

You can delete your account at any time, in the app or on the website, under Settings → Account → Delete account. This immediately removes your projects, My Library, your profile and your sign-in from our database.

A website subscription is cancelled automatically when you delete your account.
An App Store subscription cannot be cancelled by us. Cancel it first in your iPhone or iPad under Settings → your name → Subscriptions; the app reminds you before you delete.

Projects kept on your device are removed by the app when you delete your account, and all app data is removed when you uninstall the app.

6. How long we keep data

We keep your data while your account is active. After you delete your account, it is removed from our live database straight away. Copies may remain in our providers' routine backups until those backups expire on their regular schedule. We keep limited purchase records for as long as tax and accounting law requires. Website analytics are kept only in aggregate.

7. Your rights

Under the GDPR you can ask for access to, correction of, deletion of, or a portable copy of your personal data, and you can object to or restrict certain processing. You can also export your projects yourself at any time from the app. To exercise these rights, contact us at the address below.

You also have the right to complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (cpdp.bg); you can also contact the authority in your own country.

8. Security

All data travels over encrypted connections (HTTPS). Each account can access only its own data, enforced on our database server. Passwords are stored only in hashed form.

9. Children

GafferPlot is a professional tool for film and stage lighting crews and is not directed at children. We do not knowingly collect data from anyone under the age required to consent in their country.

10. Changes

We may update this policy; the "Last updated" date shows when it last changed. We will tell you about significant changes in the app or by email.

11. Contact

Svetoslav Tcheresharski, Sofia, Bulgaria. For privacy questions or to exercise your rights: hello@gafferplot.cherry-lighting.com