Privacy

Paloma app privacy notice

Effective October 1, 2026; updated October 28, 2026 (optional app measurement update). Paloma: Conversation Cards is operated by SRW Growth Management LLC. Contact support@playpaloma.app for support and privacy requests.

This notice covers the iPhone app and its connected services. The website waitlist has a separate notice and removal instructions.

Paloma offers conversation questions. You can read them aloud and skip any question. Paloma does not record or listen to your conversations, request your spoken answers, or import your private messages. It does not require a birth date, identity document or age-verification check. The App Store displays its separate content rating and applies Apple's account and purchase controls.

Information on your iPhone

Saved questions, named sets, revisit dates, favorites, manual topic exclusions, preferences and question history are stored on your iPhone. When you allow AI sharing and request fresh questions, up to 100 recent question identifiers from that history are sent to Paloma’s service as part of the fresh-question request, as explained below. Search runs locally. Delete my Paloma data removes these Paloma content records as well as requesting applicable service cleanup.

Optional reminders use iPhone notifications. Paloma asks for permission when you schedule a reminder. Reminder text is neutral and does not contain the question or your set name. Your selected revisit dates do not automatically enable notifications.

If you choose to share a question, you see a preview and select the destination through the iPhone share sheet. The receiving app or person handles its own copy. Deleting Paloma data cannot remove copies you already shared.

Optional question ratings

A thumb up or down is saved locally. When rating sharing is available, a separate choice asks whether you want to share deliberate ratings to help evaluate and improve questions. You can decline and keep using the available cards. Sharing ratings does not enable passive usage measurement, personal learning or shared learning.

If you agree, Paloma sends your rating or removal, a fingerprint of the exact wording, its reviewed/AI source and content versions, and a revision number. Feedback uses a separate random credential whose keyed hash is stored by the service. It does not include your spoken answer, raw question text, subscription identity, session or exact reading time. A fingerprint can identify a known question, including an Intimate question you rate, so this feedback is pseudonymous, not anonymous.

Pending changes can wait on your iPhone for up to 30 days. Server votes and removal records expire 30 days after their last accepted change; an offline upload may therefore expire later on the server. Mutation counters also expire within 30 days. Scheduled cleanup removes expired records.

You can change or remove a rating, or stop sharing in Privacy. Stopping sharing clears queued changes and requests deletion of shared ratings and counters. Unfinished cleanup remains pending and retries. A credential-hash revocation record remains for 31 days to reject late uploads. Deleting all Paloma data includes this cleanup. Ratings inform product review; an individual rating does not automatically rewrite a question.

Subscriptions and service access

Connected features use a random service identity. Apple and RevenueCat provide purchase and entitlement information so Paloma can confirm subscription access, restore purchases and prevent fraud. You do not create a named Paloma account. These identifiers and purchase records are still personal information. Apple processes payments; Paloma does not receive your payment card or bank-account number.

RevenueCat processes purchase history and the service identifier for subscription functionality and purchase analytics. Its service may determine country from the transaction or an IP address. Cloudflare also processes network information to deliver and protect requests. Paloma does not request GPS access. See RevenueCat's customer-data information.

Paloma does not display targeted advertising or use your conversation interests to target advertising.

Optional app measurement

Paloma can use Meta’s SDK to measure app installs, app launches and whether three different cards appeared. Measurement starts only on an eligible App Store installation with a current service configuration, the local Ad measurement choice on, and the Meta measurement notice acknowledged. You can turn it off and keep reading the available cards. These choices do not change separate AI or rating permissions.

The app includes Meta’s SDK, which creates a random installation identifier in the app’s files when the software loads, even before measurement starts. Before its first authorized activation, Paloma does not initialize the SDK, give it app activity or send that identifier to Meta. Turning measurement off stops new Paloma initialization and event handoffs; SDK activity and previously queued data can continue after initialization, as explained below.

This local identifier has no automatic expiration. Delete my Paloma data clears Paloma’s content and sharing records but does not currently remove this separate SDK-owned file. Deleting the app removes its active local files; device backups are managed separately by iOS and your backup choices.

Paloma checks its own service for measurement configuration without including your Paloma service identity, Meta’s local identifier, question content or conversation answers. The endpoint does not store a per-person configuration record. Cloudflare processes IP addresses and technical request information to deliver and protect requests and may retain separate traffic and security records under its service settings and policies. The application-log retention below does not cover every Cloudflare record.

Version 1.0.2 includes a separate owner verification screen. Opening that screen does not start measurement. A one-time authorization supplied by Paloma’s owner, an eligible App Store installation, your local measurement choice and a separate Meta notice are required before the software can start through this verification screen. The private authorization request sends Paloma’s service only the app’s bundle identifier, version/build, a random process nonce and the one-time code in an authorization header. It does not include your service identity or a device identifier. Paloma stores a consumed-operation marker to prevent code reuse, rather than a per-person verification history. Scheduled cleanup removes that marker after the code’s redemption deadline plus a 24-hour grace period; outages can delay physical cleanup. Hosting traffic/security records and recovery history are separate.

When measurement is enabled or an owner verification is authorized, Meta can receive the SDK installation identifier, app version/build, device and operating-system information, locale/time zone, screen dimensions and other technical characteristics, IP/network information, event times and app/session activity. The SDK can add technical app metadata such as the app identifier, registered link schemes and screen/controller class, installation and session identifiers or timestamps, any stored campaign identifiers, and reports of tracking-permission status. Paloma’s manual measurement events concern app activation and reaching three visible cards. Paloma does not supply card wording, card identifiers, collections, moods, ratings, spoken answers, AI requests, Saved content, your service identity, email address or purchase information as Meta event parameters. The SDK can generate its own configuration, permission/status, session and queued traffic, so the two manual events do not describe every SDK request.

The purpose is aggregate app-install and engagement measurement, including evaluating Paloma’s advertising and verifying measurement delivery. Paloma disables advertiser-ID collection, sets the SDK’s application-tracking restriction, and requires the device’s advertiser-tracking state to be false before SDK startup and new manual event handoffs. The operating system controls that advertiser-tracking state. Paloma makes no App Tracking Transparency request and does not enable RevenueCat purchase forwarding to Meta. This does not make SDK transmissions identifier-free or anonymous. Meta’s handling is subject to its Business Tools Terms and Privacy Policy. Meta’s Business Tools Terms permit retention of Event Data for up to two years. Paloma does not promise earlier automatic deletion or immediate deletion of provider copies.

Owner authorization lasts at most two minutes in the current process and can end sooner. Closing or backgrounding Paloma, local withdrawal, deletion and expiry stop new Paloma handoffs; work already queued or sent to the SDK can continue. The code can be redeemed once by the first eligible installation that holds it; it is not pre-bound to a named person or handset. Keep it private. After redemption, the authorization applies only to that process, does not enable other installations and cannot renew in the same process. Changing the measurement choice or deleting Paloma data does not retract earlier SDK requests or automatically remove Meta-held copies. Contact support@playpaloma.app for a privacy request; do not email app credentials or a verification code.

Ordinary measurement depends on a current service configuration and your local choice. You can turn it off in Settings → Privacy → Ad measurement. If the service withdraws or expires the configuration, Paloma stops new handoffs after it observes that change or its current permission expires. Turning the local choice back on takes effect on a later app launch when measurement is available and the required notice has been acknowledged. It does not backfill cards viewed while measurement was off.

The separate one-time owner verification does not enable ordinary measurement for other installations. The same limits on SDK queues and previously sent data apply to both ordinary measurement and verification.

Fresh questions and AI providers

Paloma versions 1.0.1 and 1.0.2 use Anthropic for fresh-question generation and quality and safety checks after you allow sharing with Anthropic. Earlier app versions continue to send their AI requests to OpenAI. Permission that named OpenAI does not authorize requests to Anthropic. When you update, Paloma asks for the new sharing choice before sending a new Anthropic request. A previous choice not to share remains off until you choose otherwise in Privacy.

Before a first request to the applicable provider, Paloma explains the sharing and asks for permission. Saying Not now is saved; you can change the choice in Privacy. Stopping AI sharing prevents new requests and does not undo processing already completed. Reviewed cards and subscription status do not depend on giving this permission.

When you agree and request fresh questions, your collection, question depth or mood, and selected topic brief go through Paloma's service to the provider identified in your sharing choice, along with writing instructions. Candidate questions are checked for quality and safety. A continuation may include up to ten earlier generated questions from that provider to reduce repetition. This is question wording, not your answers. Paloma does not read your Saved collection to construct the continuation. Paloma's service also receives up to 100 recent question identifiers from your local question history as part of the fresh-question request. Those identifiers and your service identity are not included in the AI provider's writing request. Collection and topic choices can reveal interests, so this processing is not described as anonymous.

Paloma can retain encrypted generated results for interrupted-request recovery. Retrieval closes after ten minutes; scheduled maintenance removes the encrypted result. An outage can delay physical cleanup. Resuming an earlier request does not change its AI provider.

Anthropic normally deletes API inputs and outputs within 30 days. Longer retention can apply for policy enforcement or legal obligations. Content flagged for policy violations may be retained for up to two years, and related trust and safety classification scores for up to seven years. Paloma does not claim Zero Data Retention or that stopping sharing immediately deletes provider copies. See Anthropic's commercial API retention information.

For OpenAI requests from earlier app versions, Paloma disables ordinary response storage, but that does not eliminate all OpenAI retention. Standard API abuse monitoring can retain content for up to 30 days, subject to OpenAI's policies and exceptions. Earlier OpenAI processing remains subject to those policies after you update. See OpenAI data controls.

Reports and support

A question report normally contains an identifier and reason. Including question text is a separate choice. Do not include someone else's private conversation, app credentials, identity documents or payment details.

Emailing support@playpaloma.app sends your email address, addressing details and chosen correspondence through Cloudflare Email Routing to our Apple iCloud support inbox. We use these to respond, investigate problems and handle privacy requests. Replies may come from an iCloud address. You can contact us without using the app.

Support correspondence has no automatic deletion schedule. We retain it as needed to handle the request, document its resolution and meet applicable legal or security obligations. You can request deletion; any information still needed for a specific obligation may be retained for that purpose. Deleting mail does not immediately erase every provider copy; iCloud Trash can retain deleted messages for up to 30 days.

The initial connected release does not enable passive question measurement, personal or shared topic learning, private-message imports, secure in-app support cases or public question-link creation. If these are introduced, the applicable information and choices will be provided before their collection starts.

TestFlight testing information

If you install through TestFlight, Apple automatically shares beta crash logs and usage information with the app provider. TestFlight can also send feedback and screenshots you choose to submit. This is separate from Paloma's optional rating permission. We use beta information to investigate problems and improve the app. See Apple's TestFlight terms. Do not include private conversations or credentials in feedback or screenshots.

Hosting and retention

Cloudflare hosts Paloma's service and database. The beta database is placed in Eastern North America, with read replication disabled. Cloudflare D1 recovery history can remain available for up to 30 days depending on the Workers plan. Deleting a record from the active database does not immediately remove it from provider recovery history. The live-data deletion periods described below still apply. These database settings do not restrict every provider's processing location. See Cloudflare D1 recovery documentation.

Application logs record operation identifiers, errors, timings and service usage totals for reliability and troubleshooting. They are designed to omit question wording and conversation answers. Cloudflare's native Workers Logs retain logs for up to seven days depending on the service plan. Recovery history and provider records can remain after an active record is deleted. Our providers may process information in the United States and other countries where they operate.

Local saved content stays until you remove it. Service request/report records and completed deletion receipts generally expire after 30 days. Repeat-prevention fingerprints and minimal keyed purchase-related service links generally expire after 31 days. These support continuity and abuse prevention; they do not restore deleted history or impose a per-subscriber daily question quota. Expired database records are removed by scheduled cleanup. Service-wide cost totals without customer, question or transaction identifiers are kept separately and have no automatic expiry.

Delete my Paloma data removes Paloma content and sharing records and requests applicable service and vendor cleanup. The measurement component’s separate local identifier and limits on SDK/vendor cleanup are described above. A pending status means a step has not finished. The minimum retry reference can remain while vendor deletion is unresolved. A service acknowledgement does not mean that all vendor or backup copies disappeared instantly. RevenueCat deletion removes the customer's subscription-service record; Apple maintains its own purchase records under Apple's policies.

Deleting Paloma data does not cancel Apple billing. Cancel renewal in Apple subscription settings. Restoring a purchase does not restore deleted Paloma history.

Your choices and privacy requests

You can decline or withdraw optional AI and rating sharing in Privacy, delete Paloma data in the app, and contact support@playpaloma.app for access, correction, deletion or a privacy concern. We may need a proportionate way to verify control of the relevant data. Never email an app credential or secret.

We use information to provide requested services, administer subscriptions, maintain service security and reliability, handle support, and carry out the optional sharing you choose. Where a legal basis is required, these purposes rely on providing the service, the relevant consent, compliance with legal obligations or legitimate interests in operating and protecting the service, as applicable. Optional consent can be withdrawn for future processing.

Depending on applicable law, you may also have rights to object, restrict processing, receive a portable copy or complain to your local privacy authority. Response periods and exceptions depend on the request and jurisdiction. Nothing in this notice limits your legal rights. If we materially change these practices, we will update this notice and provide any notice or choice required before the change applies.

See Paloma terms and support.