Your data and your rights
Last updated 14 September 2026
Where your data actually is
Everything you create in Palarid is written to storage inside your own browser, on the device you are using. There is no account, no server-side database and no copy held by us. Nobody at Palarid can read it, and we could not produce it if asked to.
Palarid uses three browser stores:
| Store | What lives there |
|---|---|
| Local storage | Most tool data — notes, habits, budgets, logs, settings |
IndexedDB (palarid) | The Life Graph — linked tasks, entities and events |
| Cache Storage | The app itself, so it can load offline. No personal content. |
Your rights under UK GDPR
Because your data never reaches us, most rights are exercised directly by you rather than by making a request to us:
- Access — everything is already on your device. Export it at any time.
- Portability — export produces a plain JSON file you can keep or move.
- Erasure — delete it yourself, in the app or through your browser; see below for exactly what each control covers.
- Rectification — edit anything directly in the tool that created it.
- Objection and restriction — stop using a feature, or clear the site's data.
For the limited technical data our host processes (IP address and user-agent in server logs), contact huseyin_h@hotmail.co.uk.
What the in-app controls cover
Export (Settings → Data → Export everything) writes one JSON file containing your local storage entries and the Life Graph — tasks and linked records from IndexedDB — together with the app version and date it was made. Files made before v4.72 (September 2026) contained local storage only; that gap was disclosed here from July until it was closed. Since v4.89 the file also records how many entries it holds and a SHA-256 checksum, so an import can tell you whether the file is unchanged since it was made. You can choose to protect the file with a passphrase: it is then encrypted on your device with AES-GCM, using a 256-bit key derived by PBKDF2-HMAC-SHA256 with 600,000 rounds (the same construction as the Secrets vault). The passphrase is never stored or sent and cannot be recovered. Importing a file previews what it holds, takes a snapshot of your current data first, and never deletes anything already on the device. Credentials (API keys and the Secrets vault) are never written into an export.
Clear all data deletes local storage, the Life Graph database and the offline copies, and reports what it did. One honest caveat: if Palarid is open in another tab, the database deletion waits until that tab closes — the control tells you when that happens. Your browser's own control (Settings → Privacy → Site settings → palarid.com → Delete data, wording varies) remains an equivalent way to remove everything.
Automatic daily snapshots, kept in this browser, cover local storage only; the Life Graph already lives in the same database they are written to. Download a file for anything you cannot afford to lose — a copy inside the browser dies with the browser.
Losing data by accident
Because storage is local, clearing your browsing data, using private/incognito mode, or a browser evicting storage under pressure will remove your Palarid data permanently. There is no backup on our side to restore from. Export a copy periodically if it matters to you.
If you use a shared device
Anyone with access to your browser profile can open Palarid and see your entries. There is no password on the app itself. The optional Secrets vault is separately encrypted with a master password, but everything else is readable by whoever is signed in to that device.
← Trust Centre · Privacy · Cookies · Terms · Accessibility