1. Who provides Pal and how to contact us
This policy describes the Pal app and its cloud components. Pal is provided by Wenfeng Zhuo, an individual developer. Contact palagent.feedback@gmail.com for questions, access or deletion requests, or privacy concerns. Google, your AI providers, and other connected services also process information under their own policies. Your organization may control data in organization-managed accounts.
2. Information handled on your device and in your cloud
The Pal app handles Google account identifiers, email address, granted permissions, and authentication credentials on your device and when connecting directly to resources in your Google Cloud project. Authentication tokens and environment signing keys are stored in the device Keychain and marked not to migrate to another device.
Your device and cloud workspace can hold project and VM configuration, prompts, conversations, AI responses, command inputs and outputs, files and images you select, Canvas content, connected-service credentials, and data returned by connected tools. Depending on permissions you grant and tasks you run, agents can access Gmail, Calendar, and Drive data. RevenueCat processes store transactions, entitlement status, and an opaque account identifier. Pal also saves the legal-document versions and time you accepted them on your device.
3. Why and where information is processed
Pal uses information locally to authenticate you, provision and manage your cloud environment, show agent conversations, operate connected features, manage subscriptions, and remember your choices. Google Cloud hosts the VM, proxy, files, configuration, credentials, conversations, and other resources in your project. Requests between Pal and the VM pass through a proxy in that environment. Agents send provider requests from your VM.
The Pal developer does not operate a separate application backend that receives or archives your prompts, agent conversations, workspace files, Google Workspace content, or tool results. Operational and error logs may still exist on your device and within services in your cloud account.
4. AI providers and connected tools
Pal does not send your agent content to Anthropic, OpenAI, or Pal-operated servers. Your chosen agent runs in your Google Cloud environment and sends the context needed for your request to its AI provider: Claude Code sends data to Anthropic and Codex sends data to OpenAI. Context can include prompts, conversation history, files, images, tool results, and Google Workspace data returned by connected tools. Other tools receive data needed to perform actions you request.
Provider processing and retention depend on your account, authentication method, provider settings, and provider policies. Before connecting Google Workspace, you must configure every AI provider account used with it so neither the provider nor Pal uses Workspace data to train or improve generalized or non-personalized models. Processing may occur outside your chosen VM region. Review each provider’s terms, privacy policy, and data controls before submitting sensitive information.
5. Google access and API data
Initial Google authorization requests identity and Cloud Platform access so Pal can create and manage resources in your Google Cloud project. Gmail, Calendar, and Drive access is optional and requested separately when you connect Google Workspace. Immediately before that request, Pal explains the requested access, VM storage, and AI-provider transfer and records your affirmative choice. Approved credentials can be transferred directly from your device to your VM so agents can use those integrations, including while Pal is closed.
Pal uses Google API data only to provide the user-facing cloud and agent features you choose. It does not use Google Workspace data for advertising or sell it. An agent may transfer Google data to your selected AI provider or another connected service only as needed to perform actions you initiate and authorize. The use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Pal does not use or transfer Google Workspace API data to develop, improve, or train generalized or non-personalized AI or machine-learning models. You can disconnect Workspace in Pal to delete its credentials from the VM, and you can revoke Pal’s Google authorization from your Google Account’s third-party connections page.
6. Subscriptions and other recipients
RevenueCat processes purchase and entitlement information plus app or device information used by its SDK. Pal uses an opaque Google account subject identifier for subscription identity and does not send your Google email address to RevenueCat for that purpose. Apple processes App Store purchases under its own policies. Information you voluntarily send for support is available to the email service and the Pal operator. Other services receive information when you direct agents to use them.
7. Retention and deletion
Local app state persists until cleared. Logging out clears Pal’s saved workspace state and consent record, but may not remove every operating-system cache or backup. Cloud conversations, credentials, logs, files, disks, snapshots, and server storage can remain until separately deleted. Deleting an agent or stopping a VM is not a complete erasure operation.
Manage Google Cloud resources through Google Cloud and provider data through the applicable provider. Third parties retain their own copies according to their policies and legal requirements. Contact the Pal operator regarding support correspondence or other data the operator controls.
8. Your choices and rights
You can decline before using Pal, limit submitted information, review tool permissions, revoke Google or AI credentials, and manage device permissions. Settings → Terms & Privacy lets you withdraw the agreement recorded on the device. Withdrawal prevents further app use until you agree again; it does not recall information already sent, cancel subscriptions, delete data, or stop remote agents and resources.
Depending on your location, you may have rights to access, correct, delete, or export personal information, or restrict or object to processing. Email palagent.feedback@gmail.com to exercise rights concerning data controlled by the Pal operator.
9. Security and international processing
Pal uses Google authentication, device Keychain storage for credentials, and an authenticated proxy in your cloud environment. No software or network is completely secure. Secure your device, accounts, backups, credentials, and cloud permissions. Your chosen Google Cloud region does not determine every processing location; Google, AI providers, RevenueCat, Apple, and connected services may process information in other locations.
10. Eligibility and policy changes
Pal is intended for people legally able to accept its Terms and is not directed to children. Do not provide children’s or other people’s personal information without appropriate authority and safeguards. The effective date and version above identify this policy. Material changes require renewed acknowledgment in Pal. Acceptance does not waive privacy rights or authorize unrelated uses.