Privacy Policy

The short version

• We collect what we need to run your pal — and you can read most of it yourself in the glass box.
• We don’t sell your data, show you ads, or train AI models on your conversations.
• Your AI conversations are processed by your own API provider, under your own key.
• You can delete your pals or your whole account, for real, at any time.

What we collect

• Account info — your email address, and your preferences (such as theme and notification settings).
• Your API key — the AI provider key you connect. It’s encrypted at rest and used only to operate your pal.
• Your pal’s content — the identity, memory, and daily-note files your pal writes; your chat messages; and anything you create through skills, such as calendar entries and library items.
• Operational data — basic logs and counters needed to run and protect the service (for example, a daily web-search count used to enforce limits, and security/error logs).
• Subscription info — if you subscribe to pal.fun Plus, we store your subscription status and a customer reference from our payment processor. We do not store your card number — our payment processor handles that.

We do not intentionally collect sensitive categories of personal data; please don’t put information into pal.fun that you wouldn’t want stored to provide the service.

How we use it

We use your data to create and run your pal, remember your conversations, deliver notifications you’ve asked for, keep the service secure, and improve how it works. That’s it. We don’t use your conversations to train AI models, and we don’t sell or rent your personal data to anyone.

Service providers we share with

To run pal.fun we rely on a few service providers, and only share what each needs:

• Your AI provider (such as Anthropic or OpenAI) — receives your pal’s conversation content to generate responses, using the key you provide and under that provider’s own terms and privacy policy.
• Email delivery — when your pal emails you (for example a reminder or check-in), our email provider processes the message and your address to deliver it.
• Web search — if web features are enabled, search queries your pal runs are sent to our search provider to return results.
• Payments — if you subscribe to pal.fun Plus, our payment processor (Stripe) handles your payment and card details to process the transaction and manage your subscription, under its own terms and privacy policy.
• Hosting and database — our infrastructure providers store the data described above on our behalf.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of our users and the public.

Cookies

We use a small number of first-party cookies that are necessary to run the service — chiefly a session cookie to keep you logged in, plus a token used to protect forms from cross-site request forgery. We don’t use third-party advertising or tracking cookies.

How we protect it

We take security seriously by design: a strict content-security policy, protection against cross-site request forgery, and encryption of your API key at rest. No system is perfectly secure, but we build to reduce risk and keep our attack surface small.

Your choices and rights

• See it — the glass box lets you read your pal’s identity, memory, and notes directly, any time.
• Change it — ask your pal in chat to update or remove things it remembers about you, and it will.
• Delete it — you can delete an individual pal or your entire account from settings; this removes the associated data.
• Notifications — turn your pal’s emails off any time from settings or the unsubscribe link in any email.

Depending on where you live, you may have additional rights to access, correct, export, or delete your personal data. To make such a request, email hello@pal.fun and we’ll respond as required by applicable law.

Data retention

We keep your data for as long as your account is active or as needed to provide the service. When you delete a pal or your account, we remove the associated content; some limited records may persist briefly in backups or where retention is required by law, after which they are deleted.

Children

pal.fun is not directed to children under 13, and we don’t knowingly collect personal information from them. If a pal is created for a child, it must be set up and supervised by a responsible adult. If you believe a child under 13 has given us personal information, contact us at hello@pal.fun and we’ll delete it.

Changes to this policy

We may update this policy as the service evolves. We’ll change the effective date above and, for material changes, give notice where appropriate.

Contact

Questions about your privacy? Email us at hello@pal.fun.