Privacy Policy

This policy explains what information the hosted Palloo service collects, why, how long we keep it and what choices you have. "We" and "us" mean the operator of Palloo.

We don't sell your personal information, and we don't use it for advertising.

1. What this policy covers

This policy covers the hosted Palloo service: the website at palloo.app, the app at app.palloo.app, its API and the hosts that serve its media. It doesn't cover self-hosted Palloo instances. Those are run by their own operators, who are responsible for their own privacy policies.

Palloo is designed so that separate instances can connect with each other in the future (federation). That isn't available yet. When it is, some information will be shared with other instances, and we'll update this policy first (see section 8).

2. What we collect and why

Your account and profile

• Account basics: your account ID, username, display name and when you joined, so you have an account and others can see who you are.
• Your password, stored only as a secure hash (argon2id). We never store your actual password.
• Your email address, if you add one, and whether it's verified. We use it for verification, password resets and notices about your account. Verification links expire after 24 hours and password reset links after 1 hour; we store these links only as hashes and clear out expired ones.
• Avatar and banner images, including any server-specific avatar or banner, any separate dark mode avatar or server icon, and animated banners. They're public, served through a content delivery network. We re-encode images when you upload them, which strips out location (GPS), camera details and other hidden metadata.
• Your status: your chosen status (online, idle, do not disturb or invisible) and any custom status text. Your live online status and typing indicators are only kept for a few minutes and never written to our database. If you're invisible, you're stored as offline.
• Your settings, such as who can send you friend requests and DMs, and your notification settings.
• Badges and perks: profile badges, the ones you chose to hide, and features unlocked for your account.
• Your account signing key. Palloo gives each account a key to prove its identity for future features like account moves. The private half is encrypted.
• Domain handles, if you set one up: the domain, its verification status and checks, and who invited whom to a shared domain. A domain that stops verifying is released after 7 days.
• Organization verification, if you apply: the details you submit (name, description, domain, members) and our review decision.
• How you joined: whether you signed up through an invite, a vanity invite, the public server directory or directly, which invite and its creator, and the server you joined through it.
• Terms acceptances: each version of the Terms of Service you accepted, when, and whether you accepted at sign-up or after a change. We don't record your IP address or device for this.
• Account status: for example, when an account was deactivated or scheduled for deletion, or why it was suspended.

Sessions and devices

• Sessions: when you sign in, we create a session that keeps you signed in for up to 30 days. We store its token only as a hash, along with your browser's user agent, when it was created and when it was last used (to the nearest 5 minutes). You can review and end sessions in your settings. Sessions end when you sign out, reset your password, are suspended or delete your account.
• Push notifications: if you turn them on, we store the address and encryption keys your browser's push service gives us, tied to that session. We also keep short-lived counters (about 10 minutes) to limit how many notifications we send.

What you post and do

• Messages in servers and DMs: the text, mentions, author, time and when it was last edited. We only keep the latest version of an edited message (a report can keep the reported version, see below).
• Files you upload: the file, its name, description (alt text), type, size, image dimensions, a blurred preview, a fingerprint of the file (a SHA-256 hash) and who uploaded it. Download links are signed and expire, after 24 hours by default.
• Friends, friend requests and blocks.
• Server membership: the servers you're in, your nickname, roles and when you joined. Server moderators can also set channel permissions that name you.
• Read state: what you've read and your mention counts, for unread indicators.
• Servers you own: their names, icons, banners, channels, invites and vanity invite. If you list a server in the public server directory, its listing (description, categories, keywords, language, rules channel, member and online counts, and the number of recent joins) is public, and our review decisions about it are recorded.
• Bots, webhooks and slash commands you create or use. We store webhook tokens only as hashes.

Safety and moderation

• Reports you file or that are about you: who filed it, who or what it's about, the category, any note, its status and what was done about it.
• Report snapshots: when a report is filed, Palloo keeps a private copy of the reported content and the conversation around it (which can include other people's messages and file details), so moderators can see what was reported even if it's later edited or deleted.
• Profile image evidence: when a report is filed about someone, Palloo keeps a private evidence copy of that person's avatar and banner, including any dark mode avatar (and, for a report in a server, their server avatar and banner). Moderators can see these copies when reviewing the report, except in child safety reports. They're never shown publicly.
• Moderation logs: servers keep a log of moderation actions (such as kicks, bans, timeouts, deleted messages and changes to roles and settings) with the reason given. Our team keeps a similar log of actions taken across Palloo.
• Bans and timeouts, with the reason and who issued them.
• AutoMod: servers that turn on AutoMod store their rules. When a rule blocks or flags a message, the server's moderators get an alert with the message's text in a channel they choose, and the action is recorded in the server's moderation log. The message text in the moderation log is removed after 90 days; the alert stays until a moderator deletes it.
• Child safety evidence: every uploaded image is checked against lists of known child sexual abuse material before it's published. If there's a match, or a report in the child safety category, the file is quarantined so nobody can see it, and the original is preserved in a separate, private evidence store along with its fingerprint, the match details and the account involved. The law requires us to preserve this and report it to the authorities.
• Quarantined files are removed from view and stored privately, never served to anyone, while they're reviewed.

Technical information

• IP addresses: the edge proxy in front of Palloo records your IP address in its access logs (without the page you visited or other request details), for security and abuse investigations. We also use your IP address briefly, from seconds to about an hour, to rate limit sign-ups, logins, uploads and other actions. The Palloo application itself doesn't store IP addresses in its database or write them to its own logs.
• Captcha: when you sign up, reset your password or after several failed logins, we may ask you to complete a Cloudflare Turnstile check. Cloudflare receives your IP address and your answer.
• Background tasks: to send email and notifications, we briefly store what's needed (for example, your email address and the email's contents). If a task fails, its error details can include an email address or push address.
• Data exports: the copy of your data you can download from your settings.
• Backups: copies of our database that let us recover from a disaster.

3. How long we keep it

• While you have an account, we keep your account, profile and settings until you change or delete them.
• Messages and files stay until you, a moderator, or the deletion of the channel or server removes them. When you delete your account, they stay, shown as "Deleted User", unless you choose to delete them too (see section 5). When a message is deleted, its files become unreachable within about an hour, unless a report is holding them.
• Unfinished uploads expire after 1 hour and uploaded files that are never used after 24 hours.
• Sessions expire after 30 days, and are deleted when you sign out, reset your password, are suspended or your account is removed. Expired sessions aren't cleaned up automatically yet.
• Timeouts are deleted 24 hours after they end. Bans last until they're lifted.
• Report snapshots are deleted 90 days after the report is closed, unless action was taken, in which case they're kept as long as the report. Reports nobody has touched for 180 days are closed automatically. If the server is deleted, its report snapshots are deleted 90 days later.
• Profile image evidence from a report is kept for up to a year after it's saved, then deleted automatically. The only exceptions are while the report is still open or when a legal hold applies.
• Child safety evidence is kept for one year from when it was preserved, then deleted automatically, including every stored version of the file. It's kept longer only while a report about it is still open, or under a legal hold for a valid preservation request or court order.
• Rate limit records last from seconds to about an hour. An address refused an upload twice is blocked from uploading for an hour.
• Failed background tasks are kept for 7 days.
• Data exports are deleted 7 days after they're ready, and the record of the export 30 days after that. You can request one export every 7 days.
• Released usernames are held for 180 days after an account is removed, so nobody else can grab your name right after you leave. A released vanity invite code is held for 90 days.
• Database backups at our hosting provider are taken daily, with 7 days of point-in-time recovery. We also keep encrypted off-site backups for 35 days, locked so nobody can delete them early, and then deleted automatically. Deleted information can remain in backups until they expire. When we test that a backup can be restored, the temporary copy is deleted when the test ends.
• Records kept after your account is removed: some records stay with the anonymous placeholder that replaces a deleted account: badge history and perk records, how the account joined, which versions of the terms it accepted, its account status, reports, moderation logs (our team's log can include the account's old username) and the public half of its signing key.

4. How we use information

We use information to:

• provide Palloo and the features you use,
• keep your account and Palloo secure,
• prevent spam, fraud and abuse,
• moderate content and handle reports,
• comply with the law, including reporting child sexual abuse material, and
• send you messages about your account.

5. Deleting your account

You can delete your account in your settings by confirming your password and username. Your account is deactivated right away and signed out everywhere. You can cancel within 14 days by signing back in.

After 14 days, your account is permanently removed. We delete your password, email address, avatar and banner, settings, friends and blocks, server memberships, read state, invites you created, bots you own and your sessions and push subscriptions. Your username becomes a placeholder and your display name becomes "Deleted User".

Your messages and DMs stay in their channels and conversations, shown as "Deleted User", unless you delete them yourself or choose the option below. DM conversations stay available to the other person. Reports, moderation logs and evidence follow the timelines in section 3.

Deleting your messages and files with your account. When this option is offered, you can tick "Also delete my messages and files" when you delete your account. It's off unless you choose it, and we suggest downloading your data first. Nothing is deleted during the 14 days, and cancelling keeps everything. Once the 14 days are over, we delete your messages in servers, threads and DMs along with their files. This can't be undone. Large histories are removed gradually, so it can take a while to finish. Some things stay, shown as "Deleted User":

• messages and files that have been reported, are held as evidence or are under a legal hold. We check them again every 7 days and delete them once nothing holds them;
• "started a thread" notices and the first message of a thread, which keep the conversation's structure;
• messages posted by your bots or by webhooks;
• copies of reported content kept in report snapshots, which follow the timelines in section 3.

We record that the deletion happened and how many messages and files were removed, never their content.

6. Your choices and rights

• Get a copy of your data. You can download an export from your settings. It includes your account, settings, sessions, servers, friends and blocks, DMs, your messages, your uploads, reports you filed (without their snapshots) and your bots.
• Correct your information. You can change your profile, email address and settings at any time.
• Delete your account, and optionally your messages and files with it, as described above.
• Control who reaches you. Choose who can send you friend requests and DMs, hide message contents in push notifications, or appear invisible.

Depending on where you live, you may have other rights over your information, such as the right to object to how we use it or to complain to a data protection authority.

7. Who we share information with

We share information only as needed to run Palloo:

• DigitalOcean hosts Palloo: our servers, database, cache, file storage, content delivery network and load balancer.
• A separate backup storage provider stores our encrypted off-site backups. They're encrypted before they leave our systems, with a key the provider doesn't have, so the provider can't read them.
• Cloudflare runs the Turnstile captcha and receives your IP address and captcha answer.
• Browser push services (such as those run by Google, Mozilla, Apple and Microsoft) deliver your notifications. They receive encrypted notifications, which contain a message preview of up to 100 characters, or just "New message" if you hide notification content.
• Our email provider sends account emails and receives your email address and the email's contents.
• Our hash-matching provider checks uploaded images against lists of known child sexual abuse material.
• The authorities, including the National Center for Missing & Exploited Children (NCMEC), receive reports and preserved evidence when the law requires it. We may also disclose information in response to valid legal process.
• Other people on Palloo see your profile, status and messages as the app shows them.
• Other Palloo instances, once federation is available, will receive your profile and content in servers you share with their users. We'll update this policy before that happens.

If Palloo is ever involved in a merger or acquisition, information may be transferred as part of that deal.

8. Security

We protect your information with measures such as hashed passwords and tokens, encrypted connections, encrypted signing keys, serving uploaded files from a separate domain, and tightly restricted access to evidence storage. No service is perfectly secure, but we work hard to keep yours safe.

9. Children

Palloo isn't for children under the minimum age described in our Terms of Service. If we learn that a child under that age has an account, we'll close it.

10. Changes to this policy

We may update this policy as Palloo grows. We'll publish each new version here with a new version identifier and effective date.

11. Contact

A contact address for privacy questions and requests will be listed here before Palloo opens to everyone. Until then, you can download or delete your data yourself from your settings.