Privacy Policy

Last updated 16 October 2026 · UK GDPR & Data Protection Act 2018

1. Who we are

Palarid provides a free browser-based personal workspace at palarid.com. Under UK GDPR we are the data controller only for the limited technical data described below. For everything you create in the app, you are the controller and the sole holder of that data.

Contact: huseyin_h@hotmail.co.uk

2. What we collect

Data you create — notes, habits, budgets, health logs, saved passwords, files: stored exclusively in your browser's local storage and IndexedDB, on your device. It is never transmitted to us. We have no ability to read, recover or delete it.

Daily check-in and reminders — your check-ins (a mood, a win, tomorrow's priority) are stored on your device like everything else. Reminders are off unless you switch them on; switching them on asks your browser for permission to show notifications. They are produced by the app on your device while it is open, from your own check-ins and Bills — no push service is used and nothing is sent to us or anyone else. You can turn them off in the check-in card or withdraw the permission in your browser's site settings.

Technical data — our host, Netlify, processes your IP address and browser user-agent in server logs to deliver the page and to prevent abuse. This is standard for any website.

The former sign-up list — closed. Palarid is free and there is no paid plan, so the sign-up list for a planned paid tier has closed and no longer collects anything. If you joined it before, your email address (and any optional answer you gave) is held by our host, Netlify, in its Forms service. It will not be used to contact you or for anything else, and it is not shared or sold. Ask to be removed at any time using the contact address in section 1 and we will delete your entry. Lawful basis while it is held: consent — you can withdraw it.

Correction, 29 September 2026. The sign-up list has collected email addresses through Netlify Forms since it was added, but this policy did not describe it until today.

3. Lawful basis (UK GDPR Article 6)

• Legitimate interests — serving the website securely and preventing abuse.
• Consent — where you actively choose to use a feature that contacts a third party.
• Contract — not applicable. There is no account and no payment.

4. Third parties

Certain tools fetch live information. When one runs, your IP address is necessarily visible to that provider:

• Open-Meteo (api.open-meteo.com, geocoding-api.open-meteo.com) — weather, elevation and place lookup
• OpenStreetMap / Nominatim (nominatim.openstreetmap.org) and Esri (server.arcgisonline.com) — map tiles and place search, only once a map tool is opened
• Library of Congress (www.loc.gov, tile.loc.gov) — historical map images, and the words you type into the Historical Maps search box, only once Historical Maps is opened
• CoinGecko (api.coingecko.com) — crypto prices
• ExchangeRate-API (open.er-api.com) — currency rates
• Hacker News (hacker-news.firebaseio.com) — headlines
• Free Dictionary API (api.dictionaryapi.dev) — definitions, when you ask the assistant to define a word
• MuffinLabs (history.muffinlabs.com) — the "today in history" line in the Daily Brief
• Pixabay (cdn.pixabay.com) — the audio files Focus Music plays, streamed while you listen
• Pollinations.ai (text.pollinations.ai, image.pollinations.ai) — the AI features, by default. What you submit is sent there to generate a response.
• A provider whose API key you supply — instead of the default, and only if you enter a key. The app can talk to Groq (api.groq.com), OpenAI (api.openai.com) or OpenRouter (openrouter.ai). Your key is stored on your device and sent only to the provider it belongs to.
• unpkg (unpkg.com) — the map library, fetched only when a map opens, pinned to a version and checked against a hash. A QR-code library on jsDelivr (cdn.jsdelivr.net) is kept configured the same way for a future scanner, but no current tool loads it
• Netlify — hosting and the performance script noted above

That list is exhaustive for the app as shipped, and it is kept honest mechanically rather than by memory: the release gate reads every address the code can request and fails the build if one is missing here, or if this page names a service the code no longer contacts. It was wrong in both directions until 21 September 2026 — it named USGS, NOAA, NASA, Wikipedia and ipapi.co, whose tools were removed in the v4.69 cut, and it did not name MuffinLabs or Pixabay, which the app does contact.

If you add your own API key it is stored on your device only and sent only to that provider.

4a. The AI relay — new, and worth reading

Palarid used to have no server-side code at all. That changed: there is now a single small function that passes AI requests to the AI provider on your behalf, so that the AI works without you having to obtain and paste your own API key.

Why it exists. The provider key has to be kept secret. Palarid is a static site, so anything placed in the page is readable by every visitor — a key there would be public and abused within hours. Keeping it on the server is the only way to offer AI without asking each person for a key.

What this means for you, stated plainly:

• When you use an AI feature without your own key, the text of your prompt passes through Palarid's relay on its way to the AI provider. It did not do that before.
• The relay does not store your prompt, does not log its contents, and does not attach any identifier to it. It forwards the request and returns the answer.
• Our host, Netlify, records ordinary request metadata for the relay — your IP address and timestamp — in the same way it does for any page you load. Your IP is briefly held in memory to enforce rate limits, and is not written to storage.
• If you supply your own API key in Settings, the relay is bypassed entirely and your browser talks to your chosen provider directly. That is the most private option and it remains available.
• Every AI feature is optional. Nothing else in Palarid uses the relay, and every other tool continues to run entirely in your browser.

We are flagging this prominently rather than quietly amending the policy, because "nothing you type ever passes through our systems" was previously true and is no longer true for this one feature.

4b. Advertising — the exact position

As of 16 September 2026 no advertising is running anywhere on Palarid, and no advertising script is loaded. The site is built so that, if adverts are ever switched on, the following is true by construction rather than by promise — the release checks refuse a build that breaks it:

• Adverts can appear only on the Explore tools that hold nothing personal: Map, Weather, Trivia, Mood Board, Mind Map, Image Studio, Palette and Heatmap. Never beside your money, health, habits, notes, documents, passwords or vault, and never on the free calculator pages.
• The advertising library is not fetched until you open one of those eight tools. Until then the page is exactly as it is today.
• The provider would be Google AdSense. Its consent message would appear before any advert loads, and adverts are requested as non-personalised by default; any cookie Google sets is governed by that consent, not by Palarid.
• Palarid's own code remembers nothing about which adverts you saw.

If adverts are switched on, this section will say so with the date, and the cookies page will list what Google stores. "Advertising is off" will never be left on this page a day longer than it is true.

5. Sending information outside the UK

This section was missing from earlier versions of this policy. UK GDPR Article 13(1)(f) requires us to tell you when your information goes overseas and on what legal footing, so here it is.

Palarid holds no database of users and stores nothing you create. There is one piece of server-side code: a small function that forwards AI requests (see section 4a). Everything else is a static file. When you use a feature that calls an external service, your request — including your IP address, and for AI features the text you typed — reaches that provider wherever they operate. Most are in the United States.

Correction, 29 September 2026. Until today this table still listed ipapi.co, USGS, NOAA and NASA, although section 4 already said their tools were removed in the v4.69 cut (21 September 2026). Palarid has not contacted them since; the rows have been removed.

The safeguard. Transfers to the United States rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or on the International Data Transfer Agreement / Addendum where it is not. We are being straight with you: as a very small project we have not individually audited each provider's certification status. If that matters to you, the practical protection is to avoid the features that call them — every one is optional, and Palarid's core works with no network at all.

What never leaves. Your notes, tasks, money figures, health entries and vault contents are not transferred anywhere, because they are not sent to us in the first place.

6. Retention

Your data stays on your device until you delete it or clear your browser storage. We hold nothing, so there is nothing for us to retain or delete on your behalf.

Update, 28 July 2026: an earlier version of this policy disclosed that "clear all data" covered only browser local storage and missed IndexedDB and the offline cache. That defect is now fixed — the control deletes local storage, the main database and all offline copies, and reports what it did. One honest caveat remains: if Palarid is open in another tab, the database deletion waits until that tab closes; the control tells you when this happens. Clearing site data for palarid.com in your browser settings remains an equivalent alternative.

7. Children

Palarid is not directed at children under 13. It contains general reference information, including first aid and health tools, intended for adults.

8. Security

The site is served over HTTPS with HSTS. The optional password vault uses AES-GCM with a PBKDF2-HMAC-SHA256 key derived at 600,000 iterations, which is the current OWASP guidance; your master password is never stored and cannot be recovered by us or anyone else. Update, 14 September 2026: an earlier version of this page said the vault used 100,000 iterations and that raising it was a tracked task. The raise shipped in v4.51: a vault created at 100,000 still opens, and is re-encrypted at 600,000 the first time it is unlocked successfully — the stronger copy is only written after the password has been proven, so a failure leaves the old, working vault untouched. Because your data lives on your device, its security also depends on your device being secure.

See the security page for open issues, stated honestly.

9. Changes

Material changes appear here with a new "last updated" date. Where a previous statement was wrong, we correct it visibly rather than deleting it.

10. Complaints

You may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk · 0303 123 1113.

← Trust Centre · Your rights & the ICO · Your data · Cookies · Terms · Accessibility