Privacy Policy

Last updated: May 13, 2026

1. What We Collect

When you create an account, we collect:

  • Email address — for authentication and account recovery
  • Name — for display within the app
  • Password — stored securely as a hash, never in plain text

If you sign in with a third-party provider (currently Google), we receive your name and email from that provider. We do not access your contacts, posts, or any other social data.

2. What We Store

We store the learning data you create while using the app:

  • Vocabulary words, progress levels, and review history
  • Stories generated with AI based on your vocabulary
  • Images you upload or generate for vocabulary cards
  • App preferences and settings

3. How We Use Your Data

Your data is used exclusively to provide the Palu service — vocabulary tracking, spaced repetition, AI-powered stories, and example sentences. We do not sell, share, or use your data for advertising.

4. Third-Party Services

We use the following third-party services:

  • OpenAI — to generate vocabulary explanations, example sentences, and AI stories, and to transcribe speech to text. Your vocabulary words and text inputs are sent to OpenAI's API for processing.
  • Google Generative AI — to generate images for vocabulary cards. Prompts based on your vocabulary words are sent to Google's API.
  • FAL.ai — to generate images for vocabulary cards. Prompts based on your vocabulary words are sent to FAL's API.
  • Amazon Web Services (AWS) — for application hosting, database, and image storage.
  • PostHog — for product analytics and session insights. Account email may be associated with analytics events for usage analysis.
  • Sentry — for error and crash monitoring. Stack traces and limited application context are sent to help us fix bugs.
  • Google — only if you choose to sign in with Google.

5. Data Retention

Your data is retained as long as your account is active. You can delete your account at any time from the Settings page, which permanently removes all your data from our servers.

6. Data Deletion

You can delete your account and all associated data at any time by going to Settings > Delete account within the app. For more details, see our Data Deletion Instructions.

7. Security

We use HTTPS encryption for all connections, hash passwords with bcrypt, and follow standard security practices to protect your data.

8. Children's Privacy

Palu is intended for users 18 and over. We do not knowingly collect data from anyone under 18. If you are a parent or guardian and believe your child has provided data without your consent, contact us and we will promptly remove it.

9. Changes

We may update this policy. If we make significant changes, we will notify users via email or an in-app notice.

10. Contact

For questions about this policy, contact us at support@paluup.com.