Palmora

Privacy Policy

Effective: 7 November 2026

Palmora ("we", "us") is an entertainment app operated by Adanie LLC, a limited liability company organised in Arkansas, USA. This policy explains what we handle when you use the Palmora app and palmora.io, and why.

The short version

• Your palm photo is sent once to be read, analysed in memory, and immediately discarded. We never store it, log it, sell it, or use it to train AI.
• You don't need an account. If you choose to sign in, we use your email only to sign you in and keep a text-only backup of your palm and matches. We send you news or offers only if you tick a separate box.
• Your reading is saved on your own device so the app can remember it. Deleting the app deletes it, unless you have turned on cloud backup by signing in. (If you use a match link, the readings for that match are kept on our server for up to 30 days so they can reach you.)
• We do not sell personal information. We do not show third-party ads.

What we process

Palm photos. When you scan a palm, the photo is sent over an encrypted connection to our server (hosted by Supabase) and passed to our AI provider (Anthropic) to describe the visible palm lines and write your reading. The photo is processed only for that request and is not retained by us. Our AI provider processes it under its commercial terms, which do not permit training on our customers' data.

Palm features and readings. The result is a short list of general line categories (for example "curved heart line") and a text reading. From the features we compute a palm signature — a random-looking code that lets the same hand get the same score. These are sent back to your device and stored there. When you match palms or request your Daily Palm, the palm signatures and features (never photos) are sent to our server to produce the text, and are not kept after the request.

Purchases. If you buy a subscription or a match report, payment is handled by Google Play or the Apple App Store. We use RevenueCat to confirm what you bought; it receives an anonymous app user ID and your purchase history, not your card details.

Notifications. If you allow it, the Daily Palm reminder is scheduled on your device. No push token is sent to us.

Fair-use limits. To stop the service being abused, each request carries a random install ID created by the app (not linked to your name, phone number or advertising ID) and a one-way hashed form of your network (IP) address. We count requests per install ID and per hashed address to apply daily limits. These counts are deleted after 30 days.

"Does this feel accurate?" votes. If you tap one of these buttons, we store only your answer, which part of the reading it was about, the palm signature and the random install ID. We use the votes to improve our readings.

Match by link. If you send a match link, our server keeps your palm signature and features, and the first name you choose to show, so the other person can match with you. When they scan their palm on palmora.io, their photo is handled exactly like yours (read once, then discarded), and their text reading and the match result are kept with the link so your app can collect them. Links and everything attached to them are deleted 30 days after they were created. Only open a link if you are happy to share a palm reading with the person who sent it.

Palm Cards by link. When you send a Palm Card as a link, our server keeps the card itself so the other person can open it: the gesture, the line you chose, the first names you typed (for and from), and your Palm Constellation — a star pattern drawn from the general categories of your palm lines (not your photo, not the shape of your hand). If the other person sends a card back from palmora.io, the same is kept for their card; if they choose to sign it with their palm, their photo is read once and discarded, exactly like yours, and only their star pattern goes on the card. Cards are deleted 30 days after they were made.

Account and cloud backup (optional). If you sign in, we use your email address to send you a one-time 6-digit sign-in code (sent through our email provider, Resend). While you are signed in, the app saves a copy of the text it keeps on your phone (your reading and palm signature, saved matches with the names you gave them, pending match links, your hand choice and the first name you chose) to your own private record on our server, so you can restore it on another phone. Photos are never backed up. We keep your account and backup until you delete your account, which you can do at any time in the app (My Palm → Account & Backup → Delete Account) or by emailing us; deleting it removes your email and backup from our server straight away.

News and offers (optional). We email you news or offers only if you tick the box for it when you sign in, or turn it on later in Account & Backup. You can turn it off there at any time, or use the unsubscribe link in any such email. We record when you gave or withdrew consent.

Technical data. Our hosting provider may keep standard, short-lived server logs (such as IP address and request time) for security and reliability.

Why (legal bases)

To provide the service you ask for (performance of a contract), to keep it secure (legitimate interests), and to meet legal obligations. Where the law requires consent, we ask for it.

Who helps us

Supabase (hosting, sign-in and server functions), Anthropic (AI processing), Resend (sending sign-in emails), RevenueCat (purchase validation), Google and Apple (app distribution and payments). They act on our instructions and only for these purposes.

Your choices and rights

You can delete your saved reading at any time by deleting the app or clearing its data. If you signed in, you can delete your account and cloud backup in the app (My Palm → Account & Backup → Delete Account). Because we do not store your photos, and other server data is deleted automatically within 30 days, there is usually nothing further for us to delete; if you believe we hold data about you, email us and we will help. Depending on where you live (for example the EU, UK, Australia or California) you may have rights to access, correct, delete or object to processing, and to complain to your local regulator.

Children

Palmora is not directed to children under 13 (or the higher minimum age in your country) and we do not knowingly process their data.

International transfers

Our servers are in the United States. Where data moves across borders we rely on our providers' standard contractual safeguards.

Changes

If we change this policy we will update the date above and, for material changes, tell you in the app.

Contact

Adanie LLC · [email protected]