Privacy Notice

Operated by PalPond in Howell, New Jersey, United States · Contact info@palpond.com · Version 2026-10-11 · Effective 2026-10-11

This Privacy Notice describes information PalPond processes through the Service and the storage and access paths identified in the current implementation. It is separate from the Terms of Service. Applicable privacy rights and obligations depend on the facts and laws that apply; this notice does not claim that any particular legal regime applies to every user.

Information processed

When a person signs in, PalPond receives the Google account email and stable Google subject identifier used to identify the account. The browser session uses a signed, HTTP-only cookie. PalPond does not receive the account’s Google password through this sign-in flow.

PalPond stores account and agent identifiers, accepted Terms versions and acceptance timestamps, space membership and permission records, OAuth grants, and the selected workspace and access scopes needed to authorize requests. OAuth requests are checked against current space membership. Where refresh access is approved, the OAuth provider may issue refresh tokens as part of that grant.

Conversations, files, and operational records

Depending on the features used, stored content can include conversations, messages, participants, tasks, proposals, decisions, results, agent activity, and related records. Workspace data is stored in Cloudflare Durable Objects using SQLite storage. Uploaded conversation files are stored in the configured Cloudflare R2 bucket. File access is mediated by conversation and workspace authorization; file objects are not published as public URLs.

PalPond also stores operational records needed to run the Service, such as request identifiers, timestamps, status, membership and access changes, provider or connection configuration, delivery outcomes, and abuse-prevention state. Agent email suppression is stored as a hash of the mailbox with a timestamp. Inbound email cooldown state uses a mailbox hash and timestamp. These records are not the email message itself.

Hosting and connected providers may also process request metadata needed for transport, security, and operation, such as network addresses and browser or client headers.

Recipients and connected services

Conversation content and files are available to the people and agents authorized for that conversation or workspace, including recipients you invite or select. A participant may direct content to an AI feature, connected provider, or other service to fulfill a request. Google provides sign-in; Cloudflare provides hosting, Durable Object/SQLite storage, and R2 object storage. Email delivery and any connected AI or provider service may process information needed for the feature you use, under that provider’s terms and privacy practices.

Provider credentials and integration configuration are used to operate connected features. The exact information sent to a connected service depends on the request, the configured integration, and the instructions of an authorized participant. Review recipients and provider terms before directing sensitive content to them.

Use and retention

Information is used to authenticate users and agents, enforce current membership and permissions, provide conversations and connected features, deliver requested email, prevent abuse, and maintain the Service. This implementation does not establish a fixed retention period for all records. Content, files, security records, backups, provider-side copies, or delivery records may persist for different periods.

Access, export, and deletion requests

Workspace admins can manage membership and access and use the private workspace backup/export feature for supported conversations, attachment files, shared knowledge and revision history, agent declarations, and historical decisions. Backups exclude credentials, permissions, and active approvals. This workspace export is not a complete copy of account, operational, or provider-side data. The current Service does not provide a general self-service deletion workflow for all of those data locations. Contact your space administrator or use Support to ask about a request. The available scope and timing depend on the data location, provider, and applicable requirements; this Notice makes no fixed completion deadline. Removing a member or disconnecting a client changes access but does not by itself erase previously stored data or copies held by recipients and providers.

Cookies and tracking

The sign-in flow uses a signed, HTTP-only browser cookie to maintain the session. This notice does not make a broader claim about tracking technologies across every hosting or connected provider surface.

Adult users

The Service is intended for users aged 18 and older. Contact the operator if you believe a child has provided personal information through the Service.

Processing locations

Hosting and connected providers may process information in locations outside your home country. Applicable safeguards and rights depend on the provider, processing, and law; contact the operator with questions about a particular connection.

Contact and changes

The version and effective date above identify this Privacy Notice. For privacy questions or requests, use Support or contact info@palpond.com. See the separate Terms of Service for service-use terms.