What we keep, and what we never write down

When you type a message it is sent to Pally's server, passed to a language model, and the reply is sent back to your browser. Nothing in that path writes the message anywhere.

• There is no conversation, message or transcript table in the database. None was created.
• Message text is never written to application logs. The chat endpoint logs only counts, timings and error codes.
• There is no account, no cookie and no device fingerprint for the companion. Two visits from the same browser are not linkable by us.
• The conversation lives in your browser's memory. Closing the tab ends it; Clear and Burn session empty it immediately.

Honest limitation: your messages do travel to a third-party model provider in order to be answered, and that provider has its own retention policy for API traffic. Pally cannot make a promise on their behalf. The provider currently in use is shown on the help page.

Businesses can buy aggregate, anonymised demand signals — for example "in this country, this week, interest in home and living was elevated". These come from counters, never from your words.

• The signal toggle is off by default. With it off, nothing about your conversation contributes to any counter.
• With it on, a broad category label (such as "home and living" or "travel and transport") is derived and a shared counter is incremented by one. The message itself is discarded in the same request.
• The classifier is built to refuse: anything touching health, crisis, identity, sexuality, politics, religion or anything it is unsure about produces no label at all.
• The counter row holds a country, a language, a broad category, a one-word topic, an intent quality, the hour and a number. It holds no identifier of any kind — not even a random one — so there is no row that is "yours".

• Cohort suppression. Any group smaller than 50 contributors is withheld entirely — it is never shown, never exported, never counted toward a total a buyer can see.
• Rounding. Published counts are rounded to the nearest 10, so a number can never track a single person appearing or leaving.
• Query limits. The availability endpoint is rate limited (60 queries per hour) so that a buyer cannot repeatedly narrow a filter and subtract one result from another to isolate an individual.
• Aggregate-only exports. The export builder can only emit grouped rows with counts. There is no code path that can produce a per-person record, because no per-person record exists.

Pally asks for a country, an optional region, a language and an age bracket. All four are optional and you can use the companion without answering any of them.

• If you tap "use my location once", your browser's coordinates are sent to a geocoding service, converted to a country and region name, and then discarded. Coordinates are never stored and never logged.
• Age is a bracket, never a date of birth. There is no field in the database capable of holding an exact birth date.
• Region is a free-text or list-selected name — never a postcode, address or coordinate pair.
• In this build the region and the age bracket never leave your browser at all: only the country and the language are sent with a message, and only the country reaches a counter.

The journal, the vent-and-burn pad and the comfort card never leave your browser. The journal is stored in this device's local storage under a single key; it is never transmitted to Pally's server. Exporting it is something you do deliberately, and "clear local journal" in the privacy panel removes it permanently.

These are ordinary accounts and they behave like it. Business users have an email, a name, a password hash and an organisation. Owner administrators authenticate against credentials held in server environment variables. Both use a session cookie. Every sensitive administrative action is written to an audit log with an actor, an action, a timestamp and a non-identifying summary.

Ads in the companion are rotated server-side. No profile, no behavioural targeting and no third-party tracking script is involved: the server picks an active campaign, optionally filtered by the country you chose yourself, and counts an impression. Clicking is counted as a number on the campaign — not as an event tied to you. Every ad is labelled "Ad", and demo campaigns are additionally labelled "demo". Affiliate links are disclosed as affiliate links wherever they appear.

• Conversations: never stored, so nothing to retain.
• Aggregate counters: retained indefinitely as non-personal statistics; they contain no identifiers.
• Audit logs: retained for the life of the platform, because they are the record of administrative accountability.
• Business account data: retained while the account exists, plus whatever a finalised jurisdiction review requires for financial records.

• Use Pally without answering any personalisation question.
• Leave aggregate signals off — the default.
• Clear the conversation, burn the session or clear the journal at any moment from the privacy panel in the companion.
• Because there is no account and no identifier for the companion, there is no data subject request to make: there is nothing to look up.