pluris privacy policy

pluris does its work on your iPhone. Your contacts, your photos, your calls and your messages are read, compared and filtered on the device in your hand, and your passwords are kept in the iOS keychain. There is no account to create, no sign-in, and no red8.io server that receives any of it. The app downloads public lists of spam numbers, and nothing about you goes with those requests.

Last updated: 4 October 2026

pluris touches some of the most personal things on a phone, so this page goes through them one at a time and says exactly what happens to each.

The pluris app

Your contacts

pluris asks for access to Contacts so it can find duplicates, merge them, repair phone numbers and point out records that are missing something. All of that comparison — matching names, normalising numbers into international form, scoring how alike two entries are — happens on your device. pluris does not transmit your contacts, or any part of them.

pluris reads and writes your contacts through Apple’s Contacts framework, which means it works on whatever accounts you already use — iCloud, Google, or the phone itself — and any change it makes syncs the way your own account normally syncs. That syncing is between you and your account provider; we are not part of it.

When you delete or merge contacts, the originals go to a trash inside pluris, held on your device so you can restore them. Emptying that trash, or letting the optional auto-empty run, deletes them from your device permanently — there is no copy anywhere else to recover them from.

One thing you can choose to do: the search button beside a phone number in a contact opens a Google search for that number in your browser. Nothing is searched unless you tap it.

Hidden contacts and hidden photos

Since 26.4 you can hide a contact or a photo. Hiding means pluris copies the whole item — for a contact, its card, photo, account and groups; for a photo, every original file — and encrypts the copy on your iPhone with a key that is created on this device, kept in its keychain and never synced. pluris reads the copy back and checks it before anything is removed, and only then deletes the original from Contacts or, through Photos’ own confirmation dialog, from your library. The hidden set sits behind Face ID, Touch ID or your passcode.

Nothing about a hidden item leaves the device: the encrypted copies are excluded from your iCloud and computer backups, because the key that opens them exists only on this iPhone. That also means deleting pluris deletes them. To move them to another phone you export them yourself, as a file encrypted under a passphrase you choose, and import it there.

Your photos and videos

To find duplicates, pluris asks for access to your photo library and computes a small mathematical fingerprint of each photo and video. Both the fingerprinting and the comparison run on your device. pluris does not upload your photos or send them anywhere for analysis — there is no cloud processing step in this app.

Deleting a photo goes through Apple’s own deletion request, so iOS shows you its confirmation and the file lands in Photos › Recently Deleted under Apple’s usual grace period, not in a pluris-controlled bin. Compressing writes a smaller copy of each photo or video into your library, keeping its date, place and favourite, and then asks iOS to delete the originals — so iOS shows its own confirmation, and the originals wait in Recently Deleted for 30 days. The copies are made on your device; nothing is uploaded to be compressed.

Your passwords

Items in the password vault are stored in the iOS keychain, encrypted by iOS, in a keychain group that belongs to pluris and its AutoFill extension. They are marked to sync, so if iCloud Keychain is on they reach your other devices signed in to the same Apple Account through Apple’s iCloud Keychain. That syncing is between you and Apple; we are not part of it, and there is no copy of your vault on any server of ours.

If your iPhone has Face ID, Touch ID or a passcode set up, the vault asks for it before it shows anything, and locks again when pluris goes to the background. So that AutoFill can make suggestions, pluris gives iOS the website address and username of each login; a password itself is read only when you choose to fill it.

A deleted item is kept, still encrypted, for 30 days and then removed for good. It syncs like everything else in the vault, so emptying it on one device empties it everywhere.

Moving passwords with Credential Exchange (iOS 26) is a handover between two apps on your iPhone, brokered by iOS, and nothing is written to a file on the way. Exports you create — the encrypted archive, the logins CSV or the JSON — are written where you choose to put them, and from that point they are yours to look after. The CSV and the JSON are not encrypted, and pluris asks you to confirm that before writing either.

If you turn on automatic backups (Vault › More › Backups…), pluris writes an encrypted copy of the whole vault into its own app data after every change — encrypted to a key pair created for your backups, with the private half wrapped under a passphrase you choose. pluris keeps no copy of that passphrase and has no key of its own that opens a backup. These files are included in your iPhone’s iCloud or computer backup, which is what they are for; they are as exposed as an encrypted export, and no more. Backups older than 30 days are removed, and turning the feature off lets you delete them.

Sharing text to pluris from another app, through the share sheet, is read once by pluris’s share extension on your device, saved into the vault, and not kept anywhere else.

The hosted organiser (Pro, opt-in)

The vault organiser proposes better names, groups and categories for your items. On the Mac it normally runs a language model on your own Mac. With pluris Pro, on the Mac and since 26.4 on the iPhone, you can choose to run it on Google Gemini instead, through a small service of ours we call pluris cloud. This is off until you switch it on, and the switch sits under a description of exactly what is sent.

What is sent is the redacted prompt: the titles, groups, categories and notes of your vault items, with every secret replaced by a placeholder before the prompt is built — never a password, key or recovery phrase. Our service checks that the request comes from a genuine copy of pluris and that you hold a Pro subscription, using the signed purchase record Apple issues; it does not log the prompt or the answer; and it passes the prompt to Google’s Vertex AI under Google Cloud’s terms, which do not allow it to be used to train Google’s models. What our service keeps is a count of the tokens used each month, keyed by the identifier on that purchase record, so your monthly allowance can be enforced. It never sees your Apple Account or your name.

On the iPhone this is the only way the organiser can run, and it is offered only with Pro; without the switch on, the iPhone app makes no such request, and the duplicate check that needs no model still runs on the device. Every run says beforehand that it goes to Google Gemini via pluris cloud and afterwards what it cost. Switching the option off stops any further prompts, and nothing about your vault is retained on the way.

Blocking and labelling calls

Call blocking on iOS works in a particular way that is worth understanding, because it is what makes this private. pluris does not watch your calls. It hands iOS a list of numbers to block or label, and from then on iOS does the blocking itself, inside the system.

The consequence is that pluris cannot see who called you, when, or whether anything was blocked at all — iOS reports none of that back to an app, by design. It is also why the app can show you how many numbers are on your list but never a count of calls actually stopped. pluris has no access to your call history, and it does not ask for any.

Filtering messages

If you switch on message filtering, iOS passes pluris messages from senders you do not know — never messages from people in your contacts, and never your conversation history. pluris decides what to do with each one using the keyword lists and rules stored on your device, and answers iOS with a category.

That decision is made on the device. Apple’s design allows an app like this to consult a server before answering; pluris is built without one, so it has nowhere to send the text of a message. Messages judged to be junk are moved by iOS into the Junk folder in Messages — they are filed, not deleted, and pluris keeps no copy.

With Pro, you can report a message as junk from the Messages report sheet. pluris adds the sender to your block list on your device and answers iOS with a junk report; the reporting extension names 7726, the short code carriers use for spam reports, as its destination, so any report iOS sends goes there and not to us.

The requests pluris makes

pluris downloads a public, community-maintained list of known spam numbers over HTTPS, from a public code repository, so Call Shield can start out useful rather than empty. It checks at most once a day when you open the app, and downloads the list again only when it has changed. The download happens with or without Pro; the numbers are used for blocking with Pro.

With Pro you can also add lists of your own under Spam List Sources. Each must be an https address, and pluris downloads it from the address you gave.

These requests go one way. They are files being downloaded: no identifier, no contact, no number of yours and nothing about your usage is sent with them. The host sees a request arrive from an internet address, as any website would. Apart from these downloads, and the hosted organiser described above when you have switched it on, pluris makes no network requests of its own; purchases go through Apple, and iCloud Keychain sync is handled by iOS.

Where your settings live

Your block list, caller labels, prefix rules, keyword lists, tags and contacts trash are stored on your device, in pluris’s own storage and in a shared container that lets the call and message extensions read them. None of it is backed up to a server of ours, and deleting the app removes it.

Your vault is the exception: it lives in the keychain described above rather than in the app’s own storage, so it is still in your iCloud Keychain after the app is deleted. To remove it, use Erase Vault… in the vault’s More menu first.

Purchases

pluris Pro is sold through Apple. Payment details are handled by Apple under Apple’s privacy policy and never reach us; we receive only anonymous sales reports.

No analytics, no advertising, no account

The app contains no analytics, no advertising and no crash-reporting service, and no third-party kit that collects data about you. There is no sign-in and no profile of you anywhere, because there is no account to hold one. pluris does not track you across other apps or websites, which is why iOS never shows you a tracking prompt.

pluris asks for Contacts, for your photo library, and for Face ID to unlock the password vault and the hidden items. It does not ask for notification permission, your location, your microphone or your camera.

This website (pluris.io)

This site sets no cookies, runs no analytics and loads no third-party scripts, so there is nothing here to consent to. It is a set of static files served through Cloudflare, which handles the request and keeps the standard security and performance logs any host keeps, under its own privacy policy.

Nothing on this website can reach the app or anything in it.

Children

pluris is not directed at children under 13, and we do not knowingly collect data from them.

Your rights

We hold no account, no profile and no copy of your data, so there is nothing for us to retrieve, correct or delete on request — what pluris keeps is on your device, and your vault is in your own iCloud Keychain. If you would like to ask what we hold, write to us and we will answer honestly, which in this case is: nothing that identifies you.

Contact

Questions about this policy: privacy@red8.io.