Legal
PALO Privacy Policy
Last updated: [date of publishing]
Draft for review. Have a lawyer check this page and fill in the [bracketed] items before PALO goes public.
Summary
We collect only what is needed to run your PALO account: your email, name, phone number, password (stored as a secure hash), the computer your account is used on, and optional usage statistics. We do not sell your data.
PALO never uploads your screen, screenshots, captured images, tasks, or anything you type. Image search happens only on your computer.
This policy is from [Owner legal name] ("we", "us"), the maker of PALO. Contact: [email protected].
What we collect and why
| Data | Why we need it | Where it is kept |
|---|---|---|
| Email address | Sign-in, email verification, password reset, important notices | Our account server (Supabase) |
| Name | Shown in your account, support | Our account server |
| Phone number | Account recovery and support contact | Our account server |
| Password | Sign-in. Stored only as a one-way hash, never in readable form | Our account server |
| Google account email and name (only with Sign in with Google) | Sign-in | Our account server |
| Device ID (a random code made from your computer's ID, not your files) | One computer per account rule | Our account server |
| Sign-in times, app version, IP address | Security, abuse prevention, fixing problems | Our account server logs |
| Usage statistics (optional, see below) | Improving PALO | Our account server |
| Problem reports you send (your message, your email, app version, and the activity log if you attach it) | Answering you and fixing bugs | Our account server or support email |
| Remembered sign-in and offline account cache | Staying signed in, short offline use | Your computer only, encrypted with Windows (DPAPI) |
| Tasks, captured images, settings | Running your tasks | Your computer only |
We do not collect your screen contents, keystrokes, files, contacts or location.
Usage statistics
PALO sends simple, anonymous counts to help us improve it: app version, Windows version, screen size, which features are used (for example how many steps of each type a task has), how long tasks run, and error messages. Statistics never include images, screenshots, text you type, task names or file names.
Statistics are on by default. You can turn them off at any time in Settings › Send usage statistics. When they are off, PALO sends nothing except what is needed to sign in and check for updates.
Who we share it with
We do not sell or rent your personal data, and we do not use it for advertising. We share it only with services that help us run PALO, and only as much as they need:
| Service | What it does for PALO | Data it handles |
|---|---|---|
| Supabase | Account server and database | All account data in the table above |
| Sign in with Google; sending verification and reset emails (Gmail); hosting the PALO download and updates (Google Drive) | Your Google email and name; your email address; your IP address when you download | |
| Cloudflare | Hosting the PALO website | Your IP address when you visit |
| GitHub | A second source for downloads and updates | Your IP address when you download |
These services may store data outside your country, for example in Singapore or the United States. We may also share data if the law requires it, or to protect users and our service from fraud or abuse.
Keeping and deleting your data
- We keep your account data while your account exists, including if you stop using PALO for a long time.
- You can delete your account in the app (Settings › Delete account). We delete your account data from our server within [30] days. Security logs may be kept up to [90] days, and anonymous statistics are not linked to you.
- Uninstalling PALO removes the data on your computer (you can choose to keep your tasks and images).
Your rights
Depending on where you live (for example under Thailand's Personal Data Protection Act or the EU GDPR), you can ask to see, correct, copy or delete your data, object to or limit how we use it, and withdraw consent (such as turning statistics off). Email [email protected] and we will reply within 30 days. You can also complain to your local data protection authority.
Children
PALO is for people aged 13 and over. We do not knowingly collect data from children under 13. If you think a child under 13 has an account, contact us and we will delete it.
Security
Passwords are stored only as salted hashes. All connections use HTTPS. Data saved on your computer is encrypted with Windows (DPAPI) so other Windows users cannot read it. Updates are digitally signed, and PALO refuses an update whose signature does not match. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.
Changes and contact
We may update this policy. If a change is important, we will tell you in the app or by email before it takes effect.
Questions or requests: Help › Report a problem in PALO, or email [email protected]. Data controller: [Owner legal name], [address or country].