Palmastra

Privacy policy

Draft. To be reviewed by a lawyer before launch.

Last updated 16 October 2026

This policy explains what Palmastra collects, why, who it's shared with and the choices you have. It covers the Palmastra app and this website. Palmastra is based in New Zealand. If anything here is unclear, email [email protected].

The short version

  • We only collect what's needed to calculate your charts, read your palm and run your account.
  • Palm photos are deleted straight after analysis unless you choose to keep them.
  • We never sell your data and we don't show ads.
  • You can download or delete everything at any time from the app.

What we collect

  • Account details. Your email address and password (stored only as a secure hash).
  • Birth details. Name or nickname, date, time and place of birth for you and anyone you add, and how they relate to you.
  • Palm photos and findings. Photos you take for a palm reading, and the written findings (hand shape, lines, mounts, markings). Photos are deleted after analysis by default.
  • Readings and chats. The readings we write for you and your chat messages, so you can see them again.
  • Choices and consents. Your settings, your 18+ confirmation, and when you agreed to these terms and to palm photo analysis.
  • Subscription status. Whether you have Premium. Payments are handled by Apple, Google or Stripe. We never see your card details.
  • Website waitlist. Your email address, browser language and time zone if you join the waitlist.

If you use the app without signing in, your birth details and settings stay on your device and are not sent to us.

Why we use it

  • To calculate charts, transits and compatibility. This happens in our own code.
  • To write readings, answer chat questions and analyse palm photos. We send only the data each request needs to our AI provider (see below).
  • To run your account, keep it secure and give you the features you pay for.
  • To email you about your account. We'll only send marketing email if you've asked for it, such as the launch waitlist.

Our legal bases under the GDPR and UK GDPR are: performing our contract with you (running the app), your explicit consent (palm photos and marketing email), and our legitimate interest in keeping the service secure and working.

Who we share it with

We use a small number of service providers who process data for us under contract:

  • Supabase hosts our database, sign-in and file storage, in its Sydney, Australia region.
  • Anthropic provides the AI that writes readings, answers chat and analyses palm photos. It receives chart facts, palm findings, your questions and, for palm analysis, the photo itself. Anthropic does not use this data to train its models under its commercial terms.
  • Apple, Google, RevenueCat and Stripe handle subscriptions and payments.

Some of these providers are outside New Zealand and the European Economic Area, including in Australia and the United States. Where the law requires it, transfers are covered by standard contractual clauses or equivalent safeguards.

We don't sell or rent your data, and we don't share it with advertisers.

Palm photos

Palm photos are personal. We ask for your explicit consent before your first scan. Each photo is sent over an encrypted connection to private storage that only your account can reach, analysed, and then deleted unless you turned on "keep my photos". We don't use palm photos to identify you, and we never infer health from them.

How long we keep it

  • Account, birth details, readings and chats: until you delete them or your account.
  • Palm photos: deleted right after analysis by default. Kept photos stay until you delete them.
  • Waitlist emails: until launch plus 12 months, or until you ask us to remove you.
  • Backups: up to 30 days after deletion.

Your rights

Depending on where you live, including under the NZ Privacy Act 2020, the Australian Privacy Act 1988, the GDPR, the UK GDPR and India's Digital Personal Data Protection Act 2023, you can ask to see, correct, download or delete your data, object to or restrict some uses, and withdraw consent at any time. Most of this you can do yourself in the app (Account, then Download my data or Delete my account). Otherwise email [email protected]. You can also complain to your local privacy regulator, such as the Office of the Privacy Commissioner in New Zealand.

Age

Palmastra is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think a child has used the app, contact us and we'll delete their data.

Security

Data is encrypted in transit and at rest. Every database table has access rules so each account can reach only its own records. AI keys and admin keys are kept on our servers and never in the app.

Changes

If we change this policy in a way that matters, we'll tell you in the app before the change takes effect.

Contact

Palmastra (Palmastra Limited, registration in progress), New Zealand. Email [email protected].