Who we are

This policy covers the Palet site at palet.so and the Palet app at app.palet.so. If you have a question about your data, email [email protected].

Your design files stay on your device

The documents you make in Palet, and the images you place or trace in them, are stored in your browser’s local database (IndexedDB) on your device. They are not uploaded to our servers. Tracing an image into vectors also runs in your browser.

Your files leave your browser only when you export them, as a .palet.json file you save yourself. This also means we can’t see, back up or recover them: if you clear your browser’s site data or lose the device, files you haven’t exported are gone.

What we store on our servers

To give you an account and a workspace, our database holds:

Your account: your email address, your name, whether your email is verified, and when the account was created and last updated.
Your profile photo, if you add one. It is stored as an image in our database (up to 200 KB) and you can remove it at any time.
Your workspace: its name, its members and their roles (owner, admin or member).
Invitations: when you invite someone, their email address, the role offered, who sent the invitation, its status and when it expires.
Sessions: one record for each device you’re signed in on, with the IP address and browser (user agent) it was created from and when it expires.
Sign-in links: a single-use token tied to your email address. A link expires after 5 minutes and is deleted once it is used.
Abuse limits: to stop sign-in emails from being used for spam, we record each link we send under your email address, and under your email address with your IP address. These records expire after 15 minutes and 60 minutes.
API keys you create: a name, the key in hashed form (we can’t read it back, which is why it is shown to you only once), its first few characters so you can tell keys apart, and usage counts and dates used for rate limiting.

We don’t ask for a password, a phone number or payment details.

How we use it

To sign you in, keep you signed in and keep your account secure.
To show your name and photo to you and to people in your workspace.
To send the emails you ask for: sign-in links and workspace invitations.
To limit abuse, such as repeated sign-in requests.

We don’t sell your data, and we don’t use it for advertising.

Email

Sign-in links and invitations are sent through Resend from updates.palet.so. They contain the link and, for invitations, the workspace name and the name of the person who invited you. We don’t send marketing email from the app.

Cookies and local storage

The app at app.palet.so sets one cookie to keep you signed in (the session cookie), and a small cookie that remembers whether the sidebar is open. It also keeps your theme and the way you like your file list shown in your browser’s local storage, next to your files.

There are no tracking or advertising cookies, and no analytics, on palet.so or in the app. The site at palet.so sets no cookies.

Subprocessors

These companies help us run Palet and process data on our behalf:

Provider	Purpose	Data
Vercel	Hosting for the site, the app and the API	Your IP address and browser details for each request, and the account data the API handles
Neon	Database	The account, workspace, session, sign-in and API key records listed above, and your profile photo
Resend	Sending sign-in and invitation emails	The recipient’s email address and the content of the email
Google Fonts	Serves the typeface on palet.so (not in the app)	Your IP address and browser details when your browser fetches the font

How long we keep it

We keep your account data for as long as your account exists, and delete it when you ask us to. Sign-in links and abuse-limit records expire on their own within the hour, as described above. When we delete your account, we delete the records listed above that belong to it.

Your rights

Access: ask us for a copy of the data we hold about you.
Correction: change your name and workspace name in the app, or ask us to correct anything else.
Deletion: email [email protected] from your account’s address and we’ll delete your account.
Your files: you already hold them. Export any file as .palet.json from the app whenever you like.

Children

Palet is not for anyone under 16, and we don’t knowingly hold data about them.

Changes to this policy

If we change how we handle your data, we’ll update this page and the date at the top. If Palet starts storing your files on our servers, or paid plans start, we’ll update this policy before that happens.

Contact

Email [email protected]. See also our terms of service.