Privacy Policy
Palette is built by one person and designed to respect your privacy. Here's exactly what happens with your data.
What we collect
Palette stores the content you create: project titles, descriptions, notes, tags, links, status, group assignments, cover images, and canvas sketches. It also stores Library books created when you complete a project, and any Darkroom media collections you organize. Timestamps of when things were created and updated are also stored.
To create an account, Palette collects your email address. This is used solely to identify your account and, if needed, to contact you about your account or changes to the service. It is never used for marketing, shared with third parties, or sold.
Palette also collects your birth year when you sign up. It is used only to confirm you meet the minimum age (13) and to control access to age-restricted features like Circle Chat. Your birth year is never shown on your profile, and is never sold or shared. Note that your profile nickname is public — please don't use one that reveals personal information you'd rather keep private.
If you set a public profile nickname and avatar, those are stored and associated with your account. Your nickname is visible to other Palette users on public projects, in Discover, and in Circle.
Analytics
Palette uses two privacy-preserving analytics tools, purely to understand how the site is being used so it can be improved. Neither collects personal information, neither uses tracking cookies, and neither shares data with third parties.
Vercel Analytics tracks page views and performance metrics (like page load speed). It does not identify individual visitors.
Umami tracks anonymous counts of feature interactions — things like when a project is completed, when a guide is published, or when a Darkroom string is created. No identifying information is ever attached to these events.
Both tools have nothing to do with you personally — they exist only to help make Palette better.
What we don't collect
Palette does not collect your name, location, or any other identifying personal information beyond your email address and any profile information you choose to provide. There are no ad networks and no third-party data sharing.
How your data is stored
Project data is stored in Upstash Redis, a cloud database service. Images are stored in Cloudinary, a cloud media service. Both are reputable, established services with their own privacy and security practices.
The following data is stored as part of the social layer:
- Public project index — if you set projects to public, a lightweight summary (title, note snippet, cover image, nickname) is stored in a shared index used to power Discover. This is removed if you change your project back to private or link-only.
- Circle lists — if you add other users to your Circle, their user IDs are stored with your account. If another user adds you to their Circle, your user ID is stored with their account.
- Reactions — emoji reactions left on public or link-only projects are stored by note, associated with the reactor's user ID.
- Replies — text replies left on public or link-only projects are stored by note, associated with the replier's nickname.
- Guestbook entries — when a signed-in user signs your Library book, their nickname, avatar, message, and timestamp are stored with that book. Guestbooks are only accessible when your Library is public and the book is visible.
- Library books — when you complete a project, a book is created storing your customization choices, highlighted images, and optional reflection text. If your Library's bookshelf is set to public, your books are visible to anyone who visits your Library page.
- Darkroom — your Darkroom media collections are private by default. If you enable public access, your strings and their media are visible to anyone who visits your public Darkroom.
- Circle Chat messages — direct messages between mutual Circle connections are stored to deliver them reliably. Only you and the person you are messaging can read your conversation. We do not proactively read or monitor messages. The one exception: if a message is reported, we may review that specific conversation so we can act on the report.
Who can see your data
Your private projects, notes, and account details are visible only to you. The person who runs Palette (Jessica Loredo) has technical access to the database as the administrator, but does not read, use, or share your project content.
Public and link-only project content — including reactions and replies — is visible according to the visibility you set:
- Link-only — visible to anyone with the direct link
- Public — visible to all Palette users and anyone with the link, and surfaced in Discover
Your nickname appears publicly on any project you make public or link-only.
Your Library is private unless you set it to public. Individual books can be hidden even when your Library is public. Your Darkroom is private unless you enable public access.
Cookies and local storage
Palette stores your authentication token in your browser's local storage so you stay signed in between visits. No tracking cookies are used. No third-party cookies are set.
Images
Images you upload are stored on Cloudinary and accessible via their URLs. Canvas sketches you save to projects are also stored on Cloudinary. Cloudinary images are technically publicly accessible if someone has the exact URL, though URLs are auto-generated and unguessable. Cover images on public projects are surfaced in Discover and on your public project pages. Do not upload images you need to keep strictly private.
Replies, reactions, and guestbook entries from others
When someone leaves a reaction or reply on your public or link-only project, that content is stored in Palette's database associated with that note. You can delete replies from your public project page.
When a signed-in user signs your Library book, their guestbook entry is stored with that book and visible on your public Library page. If you need any of this content removed and cannot do it yourself, contact Jessica at hello@heartandhues.com.
Data retention
Your data stays in the database for as long as your account is active. Public index entries are removed automatically when you change a project's visibility. Circle data is removed if you remove someone from your Circle.
If you want your account or data deleted entirely, contact Jessica at hello@heartandhues.com and it will be removed promptly.
Changes
If the privacy practices change in any meaningful way, users will be notified by email. The current version of this policy will always be available in the app.