Privacy Policy

What we collect

• Profile cookie. A cookie called palm_career holds a random identifier that links your browser to your profile. It is needed for the game to work.
• Profile and progress. Your display name, avatar, coins, items, homes and other game progress.
• Social activity. Chat messages, direct messages, friends lists, guestbook entries and artwork you publish.
• Reports. Reports you make about other players or content, and reports others make about you.
• Prelaunch accounts. Palm Social is in public prelaunch; the game itself is not yet open to the public. If account registration is available and you create an account, we collect your email address and, if you choose password sign-in, store a salted PBKDF2 password hash rather than your password. We email 6-digit verification and password-reset codes; their HMAC-SHA-256 hashes are stored for a short time while the codes are valid. If Google or Apple sign-in is enabled and you use it, we receive the provider account identifier and email address.
• Account sessions. When you sign in, we set a 30-day palm_session cookie that is HttpOnly and SameSite=Lax (and Secure on HTTPS). The browser holds the session token; we store only its SHA-256 hash in our database. If you sign in from a browser that already has an unclaimed Palm game profile, we may link that one profile to your account. Profiles are not merged.
• Performance data. The game sends anonymous performance samples about once a minute — frame rate, load time, device performance tier, world number and a coarse map area — so we can make it run better. These samples contain no name, profile identifier, IP address or exact position.
• Error reports. If the game crashes, your browser may send an anonymous error report (a cleaned error message, the page path and a general browser name) so we can fix bugs.
• Hashed IP addresses. We use a one-way hash of your IP address to limit spam and abuse (rate limiting). We don’t store your IP address in plain form for this.

Your browser may also keep game settings in local storage on your device. We don’t ask for a legal name, postal address, phone number or payment details to create a prelaunch account.

How we use it

We use this information to run the game, save your progress, show your content to other players, keep players safe (moderation, spam and abuse prevention), fix bugs and improve performance.

Optional AI features

Some features — talking with in-game characters and AI art tools — can use AI. When these features are turned on, the text prompts involved are sent to Anthropic, our AI provider, to generate a reply. Only text is sent; we don’t send your cookie or contact details. When these features are turned off, nothing is sent to Anthropic.

What we don’t do

We don’t use advertising trackers, we don’t show personalised ads, and we don’t sell or share your personal information for advertising.

Who we share it with

Palm Social is hosted on Cloudflare, which processes data on our behalf to run and protect the service, including account and session data. Cloudflare sends account emails when its email service is configured; if we use Resend instead, Resend processes the recipient address and email contents to deliver them. When AI features are on, Anthropic processes the text prompts described above. Otherwise we only share information if required by law, or to protect the safety of players or others.

How long we keep it

• Public chat messages are deleted automatically after 24 hours.
• Your profile, progress, homes, artwork, friends and direct messages are kept while your profile exists. We may delete profiles that have been inactive for more than 2 years.
• Reports and moderation records are kept for up to 2 years, or longer if needed for an ongoing safety or legal matter.
• Detailed performance samples are kept for 2 days and per-minute statistics for 3 days; after that only combined, anonymous totals remain. Daily activity records used for player counts are kept for about 13 months.
• Error reports are kept in a small rolling log; older ones are removed automatically.

Your choices and rights

In-game account deletion will be available when game access opens. During prelaunch, email support@playpalmsocial.com from your account email address to request account and profile deletion. We may ask you to verify the request. When deletion is completed, we invalidate the account’s sessions and send a confirmation email.

You can also ask us to see, correct or delete your profile and content by emailing support@playpalmsocial.com with your display name. We may ask you to confirm the request from the same browser. We may keep limited, anonymized moderation information where needed for safety, abuse prevention or legal reasons. We won’t treat you differently for making a privacy request.

Do Not Track: we don’t track you across other websites, so we don’t change anything in response to browser “Do Not Track” signals.

Security

We use reasonable measures to protect your information, such as encrypted connections (HTTPS), rate limiting and access controls. No service is perfectly secure, so please don’t share personal information in chat or your display name.

Children and teens

Palm Social is not for children under 13, and we don’t knowingly collect information from them. Players aged 13 to 17 need a parent or guardian’s permission. If you believe a child under 13 is using Palm Social, contact support@playpalmsocial.com and we will delete the profile. Players under 18 can ask us to remove content they posted.

Changes and contact

We will update the “Last updated” date when this page changes and tell players in the game about important changes. Questions or requests: Josh Kirouff, independent developer behind KIRO Games, California, USA — support@playpalmsocial.com.