PalmSays gives traditional Indian palmistry interpretations of a photograph of your palm, for reflection and entertainment. This page explains, item by item, what personal data the app and this website use, why, where it goes, and how you remove it. The rules for using PalmSays and buying readings are in the terms of use.
The short version
- No server keeps your palm photo. It is analysed by Cloudflare Workers AI and by our line scanner on Modal (USA), through our own server. A copy stays only on your device (inside the app, or in this browser for a website reading) so your report can show the lines on your own palm, until you delete it.
- We keep the traced line points, the written observations and the reading they produced, so your history works.
- In the app, your name, age, city and birth time stay only on your phone.
- No advertising, no selling of data and no tracking across other apps or sites. This website counts visits with Google Analytics; in Europe and the UK, only if you say OK.
- You can delete your readings, or your whole account, at any time: in the app or on the delete-account page.
What we collect and why
This table covers your account and readings, in the app and on the website (one account works in both).
| Data | Why | Where it is kept | How long |
|---|---|---|---|
| Email address, checked with a one-time 6-digit code we email you, and a password if you set one in the app (stored only as a secure hash) | Your account, so your readings and free-reading count survive a new phone | Supabase (our database provider) | Until you delete your account |
| If you sign in with Google: your name, email address and the link to your Google profile photo, from Google's sign-in | To sign you in. The website shows only your initial and never loads the photo | Supabase, with your account | Until you delete your account |
| A random guest account id (no name or email), made when you start without signing up | So your first free reading and its history work before you add an email | Supabase | Until you delete your account |
| Palm photograph | To see the lines of your palm for one reading | Sent over an encrypted connection to our server functions, which pass it to Cloudflare Workers AI (describes the palm) and to our palm-line scanner on Modal in the USA (traces the lines). Neither keeps it, and it is not written to any server storage. A smaller copy is kept on your device (inside the app, or in this browser) to draw the lines on your report. | Never stored by any server. The copy on your device is deleted when you delete that reading (in the app: all readings, your account, or uninstalling; on the website: removing it or clearing this site's browser data) |
| What the scan found: the traced line points (at most 100 per line), 21 points that mark your hand's shape, and written observations (for example "heart line: long, curved"), with the reading text | To show your reading and your history | Supabase, linked to your account | Until you delete them or your account |
| Which hand, and whether it is the hand you write with | Palmistry reads the two hands differently | Supabase and your device | Until you delete them or your account |
| In the app: your name, age, city and birth time (asked before your free readings), language, streaks, lessons and readings saved for family members | Personalisation and learning features | Only on your phone | Until you delete them in the app, delete your account, or uninstall |
| A count of the free readings used on this phone | So each phone gets its free readings once | Only on your phone | Until you uninstall the app. It stays when you sign out or delete your account |
| A one-way code (hash) of your email address, made after removing dots and "+" tags, and how many free readings it has used. The code cannot be turned back into your email | Only to stop the same email getting the free readings again after an account is deleted | Supabase | Kept after you delete your account, for this purpose only |
| A salted one-way code (hash) of your internet (IP) address. It cannot be turned back into the address | Only to limit how many free guest readings, and crash reports without an account, one network can send | Supabase | At most 2 days |
| A cost record for each AI step of a reading: which model ran and how much processing it used. No photo and no reading text | To keep the service within its budget and spot abuse | Supabase, not readable by any user | 180 days. When you delete your account, the link to you is removed and only the numbers stay |
| Purchase records (product, order id, purchase token) | To add paid readings you bought and to prevent duplicate charges | Supabase; payment itself is handled entirely by Google Play | Until you delete your account, unless the law requires longer |
| Usage counts: daily totals of a few steps (for example a scan started or a report opened), with the app version. Only totals per day: no account, name, email, photo, device or install ID is attached, so a count cannot be linked to you | To see where people get stuck and improve PalmSays. In the app you can turn it off: Profile, then Anonymous usage counts | Supabase | Up to 400 days, as daily totals only |
| App crash reports: the error message, the screen it happened on, app version, Android version. Email addresses and tokens are removed; no photo, reading or name is included | To find and fix crashes | Supabase, linked to your account if you are signed in | 14 days, or until you delete your account |
We never receive your card or UPI details, and this website never asks for them. We do not infer health, ethnicity or any other sensitive trait from your hand, and readings never give medical, financial or legal advice.
On the website
You can read the guides and use the tools on palmsays.com without an account. There are no ad trackers and no advertising.
Counting visits (Google Analytics)
We use Google Analytics to count visits: which pages are opened, roughly where visitors are (country and city, worked out from the IP address, which Google Analytics does not store), the kind of device and browser, and the site or search that led here. It sets its own cookies in your browser (_ga and one starting with _ga_), which last up to 13 months after your last visit and tell one browser from another. Google keeps the visit data tied to them for up to 14 months. We have switched off advertising features and Google signals, so this data is not used to show you ads or to follow you on other sites. Your palm photo, your reading, your name and your email are never sent to Google Analytics.
In the EU, the EEA, the UK and Switzerland, nothing is loaded from Google Analytics and no such cookie is set unless you press OK on the bar at the bottom of the page (we tell where you are from your device's time zone). Everywhere, you can change your choice here, and it applies to this browser:
The photo tools
The tools under Tools that use your photo (hand type, fingers, left and right hand, photo check, palm signs) run on your phone or computer: the photo never leaves your device and nothing is uploaded or saved. If you carry a photo on to the next tool, it waits in this browser tab only until that page reads it.
The website reading
The palm reading on this website is not open yet; today readings happen in the Android app. When it opens, this is what will happen to your photo:
- Before anything is sent, your browser makes the photo smaller and removes hidden data such as your location.
- Two small copies go through our server to two services. Modal (USA) traces your lines. Cloudflare Workers AI reads your palm's features. Neither stores the photo.
- We save your traced line points, 21 points that mark your hand's shape, and your written reading to your account — not the photo. You can delete them any time on the Account page.
- A copy of the photo stays in this browser so you can see your reading again. Clearing browser data removes it.
- If you sign up, we keep a one-way code of your email so the free reading can't be repeated — even after you delete your account.
- A quick Cloudflare check (Turnstile) stops bots. Visits are counted with Google Analytics; in Europe and the UK, only if you say OK.
A website reading is saved in this browser's own storage (IndexedDB): the smaller photo, the observation and the report, so you can open it again. It stays until you remove it or clear this site's data in your browser. If you are signed in, the reading (without the photo) is also saved to your account, so you can see it on the Account pageand in the app's History.
Signing in on the website
You can sign in with Google or with a 6-digit code sent to your email. It is the same account as in the PalmSays app. Signing out on the website signs out this browser only.
What this website keeps in your browser
Only in this browser (its local storage), never sent to us unless stated:
- Your Day or Night choice and the language you picked for a reading.
- When you are signed in: your sign-in session, until you sign out or clear browser data.
- A name you type on the Account page, and any details you type for a reading (name, how to address you, birth date or age, birth time). These stay in this browser and are not sent; only the hand in the photo and whether you write with it go to the reading.
- A small note that this browser has signed in before, so we can offer the right sign-in button. It is not personal data.
Clearing this site's data in your browser removes all of it.
Who processes data for us
- Supabase: database, sign-in, the one-time email code, and server functions.
- Cloudflare: hosts this website; Workers AI analyses the palm photo and returns written observations, then writes the report text from those observations (no photo is sent for that) and keeps nothing; Turnstile (a quick bot check on the website reading).
- Modal (USA): runs our palm-line scanner. It receives the palm photo from our server, returns the traced lines, and keeps nothing.
- Google: Google Play (app distribution and payments), Google Analytics on this website (counting visits) and, if you choose it, Google sign-in.
They act on our instructions, only for the purposes above. Some of this processing happens outside India, for example the line scanner in the USA.
Your consent and your rights
Before your first reading we ask for your explicit consent to analyse the photo. You may withdraw consent at any time by deleting your data or your account, which is as easy as giving it. You have the right to access, correct and erase your personal data, and to nominate another person to exercise these rights.
- See your readings: in the app's History, or on the website's Account page. For a copy of everything we hold about you, write to us (below).
- Delete readings: in the app, Profile, then Delete account readings.
- Delete your account: in the app, Profile, then Delete my account; or on the web at palmsays.com/delete-account/, without installing the app.
Deleting your account removes it and everything linked to it on our side. Done in the app, it also removes from that phone your readings, profile, the saved descriptions of recent palm photos and any report files you shared. We keep only the one-way email code and, for up to 2 days, the one-way internet-address code described above. If our server cannot be reached, the app finishes the deletion the next time you open it with internet.
If you are in the EU, EEA or UK (GDPR)
If you use PalmSays from the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR applies. This section adds to the rest of this policy: the table above says what we collect, why, where it is kept and for how long.
Who is responsible for your data
The controller of your personal data is Deepak Chauhan, who runs PalmSays as an individual, from Nokha, Bikaner, Rajasthan, India. You can reach him at deepak@palmsays.com.
Why we are allowed to use your data (legal bases)
- Your consent: analysing your palm photo and producing the reading from it (the traced line points, hand points and written observations), and any personal details you choose to type. You can withdraw consent at any time by deleting the reading or your account; this does not affect what was done before. Google Analytics on this website also runs on your consent in the EU, the EEA, the UK and Switzerland; you can withdraw it with the button under counting visits.
- Contract (providing the service you asked for): your account and sign-in, saving your readings and your free-reading count, and your purchases, so the readings you paid for reach your account.
- Legitimate interests (keeping PalmSays safe, fair and working): the Turnstile bot check, the salted one-way code of your internet address that limits free guest readings, the one-way email code that stops the free readings being claimed again, cost records to spot abuse, crash reports to fix errors, and anonymous daily usage counts. You can object to these (see your rights below).
- Legal obligation: keeping purchase records for longer when the law requires it.
We use your palm photo only to make your reading, never to identify you. A reading is produced automatically, but it is for reflection and has no legal or similarly significant effect on you.
Your rights
You have the right to:
- access your personal data and get a copy of it;
- rectification: have wrong data corrected;
- erasure: have your data deleted (you can do this yourself on the delete-account page or in the app);
- restriction: ask us to limit how we use your data;
- portability: receive the data you gave us in a common, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, as easily as you gave it.
To use any of these rights, email deepak@palmsays.com from the address of your account. We may ask you to confirm the request from that address, and we answer within one month.
Transfers outside the EU, EEA and UK
PalmSays is run from India, and our service providers process data in other countries, including the USA: Modal runs the line scanner in the USA, and Cloudflare, Supabase and Google may process data in other countries, including the USA (seewho processes data for us). Where your data leaves the EU, EEA or UK, these transfers rely on the safeguards in our providers' data processing terms, such as the European Commission's Standard Contractual Clauses and the UK's equivalent. You can email us to ask about these safeguards.
How long we keep it
Each item is kept only as long as the table above says: your account, readings and purchase records until you delete your account (purchase records longer only if the law requires it); the internet-address code for at most 2 days; crash reports for 14 days; cost records for 180 days; usage counts, as daily totals only, for up to 400 days. The palm photo is never stored on a server. The one-way email code is kept after deletion, only to stop the free readings being claimed again.
Complaints
Please write to us first so we can try to put things right. You also have the right to complain to the data protection authority in the country where you live or work, or where you think the problem happened: in the EU and EEA, see thelist of national authorities; in the UK, the Information Commissioner's Office.
If you are in the United States
We do not sell your personal information, and we do not share it for cross-context behavioural advertising(ads targeted at you based on what you do on other sites and apps). There are no ads and no ad trackers in PalmSays. Because we don't sell or share personal information, there is nothing to opt out of, and the same is true when your browser sends a Global Privacy Control signal.
What we collect, where it comes from (you, and Google if you use Google sign-in), why we use it, and the service providers that receive it are listed in the table and the processor list above. We don't use your palm photo to identify you or to infer anything sensitive about you.
Depending on the state you live in (for example California, Colorado, Connecticut, Virginia and others with privacy laws), you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, and to opt out of its sale, sharing or use for targeted advertising (which we don't do). We will not treat you differently for using these rights.
To make a request, email deepak@palmsays.com from the address of your account, or delete your account yourself on the delete-account page. Someone you authorise in writing can make a request for you. We confirm the request with the account's email address and answer within 45 days. If we turn down your request, you can appeal by replying to our answer, and we reply to an appeal within 45 days.
Age
PalmSays is intended for people aged 18 and over. We do not knowingly process the personal data of children. If you believe a child has used PalmSays, contact us and we will delete the data.
Security
Data travels over encrypted connections. Each account can only ever read its own readings, enforced by the database itself. Secret keys never ship inside the app or this website.
Grievances and contact
For any question, correction, deletion request or complaint, write to deepak@palmsays.com. We answer requests about your data within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India (and, in the EU, EEA or UK, to your data protection authority, as described above).
Grievance Officer: Deepak Chauhan, deepak@palmsays.com. As India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require, we acknowledge every complaint within 24 hours and resolve it within 15 days of receiving it.
Operator: Deepak Chauhan, Nokha, Bikaner, Rajasthan, India. PalmSays is run by an individual, not a company.
Changes
If this policy changes in a way that matters, the app will tell you, and this page will say so, before the change applies. The date at the top shows when this text last changed.