Security and privacy
How Dplooy protects your account and your sites, what stays private, and what you are responsible for as a publisher.
At a glance
| Area | What Dplooy does |
|---|---|
| Connections | Every site and address is served over https. |
| Uploads | Pages, stylesheets and scripts are scanned for phishing and malware before they go live, and program files are never published. |
| Private sites | Password protection and an email gate on Plus and Pro. |
| Keys and apps | API keys are stored as hashes and shown once; connected AI apps use OAuth and can be revoked at any time. |
| Visitors | Form senders' IP addresses are never stored, and form spam is filtered before it reaches you. |
| Abuse | Reported sites are reviewed and harmful ones taken down. |
Account access
- Sign in with Continue with Google, or with an email address and password. Email accounts must verify their address before the dashboard opens.
- Accounts that use Google keep their password and two-step verification in the Google account.
- Change your password under Settings → Security. Changing it signs you out everywhere else the next time those sessions refresh.
- Forgot it? Forgot password? on the sign-in page sends a reset link that works for 1 hour.
Who can see a site
| Setting | Who can open it |
|---|---|
| Default | Anyone with the address. Addresses are not secret — treat every site as public. |
| Password (Plus and Pro) | Only people who enter the password; they stay in for 24 hours. After 5 wrong tries a visitor waits 15 minutes. |
| Email Gate (Plus and Pro) | Anyone who gives an email address, which you collect as a lead. |
| Share (Pro) | The people you invite see the site's dashboard — analytics, messages and bookings — from their own account. |
A password or email gate protects your pages, not every file: someone who knows the exact address of an image, PDF or script can still open it. And anything a page loads — JavaScript, JSON, a Data collection — can be read by anyone who can open the page. Never put passwords, API keys or private data in your site's files.
Upload scanning
Every website deploy — from the dashboard, GitHub, the Site Builder, the API or an AI assistant — has its pages, stylesheets and scripts scanned before it goes live, and so does every restore of an older version. Program files such as .exe are never published, and SVG images that carry scripts are refused. When something is found, nothing is published and you see which file was flagged and what kind of problem it is, such as a page that asks for passwords. Troubleshooting lists every reason.
API keys and connected apps
- API keys are created under Settings → API Keys, up to 5 at a time. Each is shown once and stored only as a hash, so Dplooy can't show it to you again. The last 50 requests of each key are logged, and revoking a key stops it at once.
- AI apps connected through the MCP server sign in with OAuth — no key changes hands. See and revoke them under Settings → Connections.
Visitors' data
- Forms — a sender's IP address is used for rate limiting in memory and then discarded. It is never stored or exported. Messages are kept for your plan's retention period.
- Bookings — guests' details are kept for your plan's period after the booking date, then deleted.
- Email gate — each lead records the email address, when it was captured, the number of visits, the last visit, the visitor's IP address and the referring site, and exports as CSV.
- Media Library — JPG and PNG photos converted on upload lose their location and camera details. See Media Library.
You decide what your site collects, so you are responsible for telling your visitors — for example in a privacy notice on the site. See Dplooy's own privacy policy.
Delete your account
Under Settings → Security, Delete account — then type DELETE to confirm — permanently deletes your account: your sites and their files, analytics and custom domains, Site Builder drafts, media, data collections, booking pages, email-gate leads, API keys and connected GitHub account, and your place on sites others shared with you. It can't be undone, so download anything you want to keep first.
Deleting your account doesn't cancel a paid plan. Cancel it under Manage Subscription first.
Report abuse
Found a Dplooy site used for phishing, malware, spam or other harmful content? Send the address and what you saw to abuse@dplooy.com. See Report abuse for how reports are handled.