Privacy Policy

Data controller

Palmuse is operated by Weiwei Jia, Ziolkowskistr. 19, 39126 Magdeburg, Germany. For privacy questions or data requests, contact support@palmuse.app.

What Palmuse is

Palmuse provides AI-assisted palm reading and palm match features for entertainment and self-reflection. Palmuse does not provide medical, legal, financial, psychological, or professional advice.

Information we process

• Palm photos you submit for a reading or match flow.
• Guest identifiers and account information if you choose to sign in.
• Purchase and entitlement information needed to unlock paid features.
• Basic technical information such as device type, app version, language, error reports, and app usage events.
• Support messages you send to us, including any contact email you choose to provide.

Palm photos

Palm photos are used only to create the reading, match preview, or unlocked report you request. Photos are processed temporarily and are deleted within 24 hours. Palm Match invite links expire within the same 24-hour window.

For asynchronous reports, a photo may be kept temporarily while the result is being generated. After a job finishes or fails, Palmuse deletes the temporary file where possible; the automated cleanup process removes any remaining upload files within the 24-hour window. We do not use palm photos to train our own models.

How we use information

• To generate and show readings, match previews, and unlocked reports.
• To maintain purchase access, guest access, and account features.
• To improve app reliability, prevent abuse, and protect the service.
• To respond to support requests.

AI, analytics, and service providers

Palmuse uses service providers to operate the app, including hosting and infrastructure providers, Google Gemini API for AI-assisted readings, Firebase services when you sign in, Google Play or Stripe purchase services where applicable, and email delivery for support notifications.

Palmuse records essential operational metrics and privacy-filtered error logs for service reliability to understand whether core flows work, restore purchases, prevent abuse, and improve reliability. We keep these records focused on product operation and do not sell personal data.

Diagnostic records can include the app page, feature action, device platform, app/release version, API route and status, response time, an anonymous session identifier, an error fingerprint, and a short redacted error trace. They do not include palm photos, request bodies, authentication or payment credentials, full IP addresses, referrers, or complete browser user-agent strings. Account-linked records are removed when the account is deleted.

Web payments are completed on Stripe Checkout. Stripe processes the payment and billing details you enter. Palmuse receives the Checkout session/payment identifier, purchased product, payment status, amount, currency, and limited billing contact details needed for fulfillment, support, fraud prevention, accounting, and legal compliance. Palmuse does not receive or store your full card number.

Service reliability and payment operations

The owner can explicitly mark their own browser’s test requests using a 7-day diagnostic cookie. This marker is not set for ordinary app users and grants no access to admin reports.

Palmuse uses aggregate usage counters to improve core flows, including photo capture, analysis, result-reading milestones, price displays and checkout attempts. Counts are grouped by UTC day, app version, platform, device language and region setting, approved entry-source categories, feature and product/price variants. The device region setting is not a detected location. These counters contain no account, installation, device or session identifier, exact event time, photo, prompt, reading text or payment token. Analytics creates no tracking identifier and stores no analytics events on your device; counters are temporarily merged in memory. They are not joined to account or purchase records, used for advertising, or used to reconstruct individual journeys. Aggregate step ratios count events, not people; they do not measure individual retention.

Some versions retrieve shared feature settings at startup and keep a local copy for the next launch. Product features are released by platform and app version, not by your device region. If English wording for India is enabled, a device-region hint may accompany a requested English reading solely to select wording; that hint is not saved with your reading or account. The separately described anonymous regional counters remain aggregate data. Device language and region do not set your billing country or price: Google Play supplies its localized product details. Local app state may include a first-open boolean, activity/streak counters, saved-reading references and an experimental price-arm label. These local values are not new user identifiers and are not sent as individual tracking records.

To operate the requested service and diagnose technical faults, our backend records daily API request/status counts and average response times by fixed service category, and AI execution type, model, prompt version, token counts where available, latency, retries and fixed failure categories. AI records use a server-generated operation ID with no account, device or analytics session linkage. They contain no palm images, prompts or reading text. Verified purchase monitoring supports payment fulfilment/accounting; it contains product, store/platform and verified amount/currency where available, with a purchase ledger reference for deduplication, without payment tokens or credentials. These records are not used for advertising or to reconstruct individual browsing journeys.

Aggregate usage counters are retained for 90 days. New technical AI/API/revenue monitoring facts are retained for 45 days; separate privacy-filtered diagnostics and account-linked AI usage records are normally retained for 90 days. Purchase lifecycle reconciliation records are retained for 400 days; entitlements and financial records are kept separately as needed for access, fraud prevention and legal accounting obligations. Monitoring tables are excluded from new database backups. Anonymous counters provide no individual record to retrieve or erase. You can delete your account and linked records or contact support@palmuse.app about privacy rights and objections. Contract performance, proportionate legitimate interests in reliability/security, consent where required, and applicable legal obligations apply to the relevant personal-data processing; aggregate counts are not treated as evidence of consent.

Before storing a submitted photo, Palmuse removes embedded metadata, including supported location tags. For AI processing we also correct orientation and may resize the photo before sending the processed image to Google Gemini API. Palmuse does not use your photos to train its own models and keeps photos for no longer than 24 hours. Google processes API inputs and outputs under the applicable Gemini API terms, including provider retention for safety and abuse monitoring; this does not promise zero retention by the provider. Palmuse accepts only JPEG, PNG and WebP photos; photos in other formats such as HEIC, HEIF or AVIF are rejected and not stored, because their metadata cannot be removed reliably.

Legal bases

For users in the European Economic Area, we process data where it is necessary to provide the requested app features, to fulfill purchase and support obligations, to comply with legal requirements, or based on our legitimate interest in securing and improving Palmuse. Where consent is required, you may withdraw it at any time.

Retention

• Palm photos: deleted within 24 hours.
• Palm Match invite links: expire within 24 hours.
• Purchase and entitlement records: kept as needed to restore paid access, prevent duplicate use, and meet legal or tax obligations.
• Support messages and operational logs: kept only as long as needed for support, security, and service operation.
• Aggregate usage counters: 90 days. Technical monitoring: 45 days. Separate diagnostics and account-linked AI usage: 90 days. Purchase lifecycle reconciliation: 400 days; financial records have separate legal retention.

Your choices

You can use Palmuse as a guest for supported flows, sign in to save your journey, and delete your account and associated data in the app under Profile > Delete Account. You can also submit a request without the app through our account-deletion page. For other privacy questions, contact support@palmuse.app.

International users

Palmuse is designed for users in the United States and Europe, including Germany. If you are located in the European Economic Area, you may have GDPR rights such as access, correction, deletion, restriction, objection, and data portability.

Complaints

If you are in the EEA, you may also contact your local data protection authority. In Germany, you can contact the supervisory authority responsible for your place of residence or for Saxony-Anhalt.

Contact

For privacy questions, contact Palmuse at support@palmuse.app.