Privacy Policy

Palette's privacy policy. How we handle uploaded photos, account data, usage logs, cookies, and third-party services.

Effective date: April 26, 2026

This Privacy Policy describes how Palette ("we," "us," or "our") collects, uses, and protects information when you use the Palette website at palette-analysis.pplx.app (the "Site"). Please read it carefully. If you have questions or a data subject request, contact us through the contact page.

How Palette Works Now

Palette is a server-assisted editorial color analysis tool. Unlike our earlier architecture, we now operate a backend. When you upload a portrait and request an analysis, your photo travels from your browser to our server (hosted on Vercel), which then calls OpenAI's image API using our own server-side API key to generate the infographic. We do not expose or share any user-provided API key — that model no longer exists.

This matters for privacy because data now passes through infrastructure we operate, not purely through your browser directly to a third party. This policy reflects that reality accurately.

What We Collect

1. Usage Events (All Visitors)

Every time you run an analysis, we record a usage event in our Supabase Postgres database. This record contains:

Actor identifier: either your account user ID (if logged in) or the value of an anonymous httpOnly cookie (palette_aid) if you are not logged in.
Analysis type: one of color, hair, makeup, eyewear, or style.
Hashed IP: a salted SHA-256 hash of your IP address, truncated before storage. We do not log or store raw IP addresses. The hash exists solely for abuse pattern detection.
Timestamp: the date and time of the generation.

We do not store your uploaded photo persistently. Photos pass through server memory during request processing and are not written to disk or retained after the API call completes.

Retention: Usage event rows are automatically deleted after 90 days.

2. The `palette_aid` Cookie (Anonymous Visitors)

If you are not logged in, we set an httpOnly cookie named palette_aid containing a random UUID. This cookie has no connection to your identity. Its sole purpose is to count your generations for rate-limit enforcement. It does not track your behavior across other sites and is not readable by JavaScript on the page.

3. Account Data (Registered Users, Optional)

Creating an account is not required to use Palette. If you choose to create one, we collect and store:

Email address: used for authentication and account management.
Password: Supabase Auth stores a bcrypt hash of your password. We never see or store plaintext passwords.
Saved analyses (when you explicitly save one): the generated image (in Supabase Storage), the analysis type, the season name or label extracted from the result, and the timestamp.

You can delete any saved analysis at any time from your account. Deletion removes both the stored image from Supabase Storage and the associated database row — permanently and immediately.

Retention: Saved analyses are retained until you delete them or close your account. Auth records (email, hashed password) are retained while your account exists.

4. Photos Transmitted to OpenAI

Your uploaded photo is transmitted from our server to OpenAI's API to generate the infographic. We do not persistently store your photo. OpenAI processes it under their own API data usage policy. Per OpenAI's published policy, API data is not used to train models and is retained by OpenAI for up to 30 days for abuse monitoring before deletion. We recommend reviewing that policy before uploading images, particularly images of identifiable individuals.

5. Analytics

We use Google Analytics to measure aggregate usage of the Site. This service sets cookies and collects data under its own policies. Our cookie consent banner, which implements Google Consent Mode v2, controls whether analytics is active for your session. Until you accept non-essential cookies, analytics is not enabled.

For full details on which cookies are set and how to manage them, see our Cookie Policy.

How We Use the Data

Data	Purpose	Legal Basis
Usage events	Rate-limit enforcement; abuse prevention	Legitimate interest
`palette_aid` cookie	Rate-limit enforcement	Legitimate interest (strictly necessary for service integrity)
Email, hashed password	Account authentication	Contract performance
Saved analyses	Providing the save/retrieve feature	Contract performance
Hashed IP	Abuse pattern detection	Legitimate interest
Analytics cookies	Aggregate usage measurement	Consent

We do not sell your personal data. We do not share it with third parties for their own marketing purposes.

Rate Limits

To provide a free service sustainably and prevent abuse, we enforce the following generation limits per visitor:

3 generations per day
10 per week
30 per month

These limits apply per actor (account ID or anonymous cookie). We reserve the right to adjust these limits over time; current limits are always displayed on the Site. Circumventing rate limits — for example, by cycling through VPNs or rotating anonymous cookies — violates our Terms of Service.

Third-Party Services

OpenAI

Your photo and the associated generation prompt are transmitted to OpenAI's API via our server. OpenAI processes this data under its API data usage policies.

Supabase

Our database, authentication, and file storage run on Supabase. Supabase's infrastructure is hosted in their default region. Supabase processes data under its own privacy policy and data processing agreement.

Vercel

The Site is hosted on Vercel in the United States. Vercel may collect standard server-side request metadata (request paths, response codes, timing data) for operational purposes.

Google

Google Analytics is active only after you consent via the cookie banner. Google's data practices are governed by Google's Privacy Policy.

Data Security

We take reasonable measures appropriate to the nature of the data we hold:

Passwords are hashed by Supabase Auth; we never have access to plaintext credentials.
Raw IP addresses are never logged; only a salted, truncated hash is stored.
Usage event rows expire automatically after 90 days.
Database access is restricted and authenticated.
All data in transit uses TLS.

No system is perfectly secure. We will notify affected users of any breach affecting personal data in accordance with applicable law.

Your Rights Under GDPR (EEA and UK Residents)

If you are in the European Economic Area or the United Kingdom, you have the following rights under the GDPR and/or equivalent UK law:

Right of access: Request a copy of personal data we hold about you.
Right to erasure: Request deletion of your personal data. For account holders, this means deleting your account and all saved analyses. For anonymous visitors, the data we hold is the usage events linked to a random cookie ID — we can delete these on request when you provide your palette_aid cookie value.
Right to rectification: Request correction of inaccurate data we hold.
Right to data portability: Request your data in a structured, machine-readable format.
Right to object: Object to processing based on legitimate interests. Note that usage events and hashed-IP data are strictly necessary for rate-limiting and abuse prevention; objection to this processing may result in termination of access.
Right to restrict processing: Request that we restrict how we process your data in certain circumstances.
Right to withdraw consent: For analytics cookies, you can withdraw consent at any time via the Cookie Settings option in the Site footer.

To exercise any of these rights, contact us via the contact page. We will respond within 30 days. The right to lodge a complaint with a supervisory authority remains available to you at all times.

Your Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

Right to know: Request information about the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
Right to delete: Request deletion of personal information we have collected about you.
Right to opt out of sale: We do not sell personal information. We do not share personal information with third parties for their own commercial purposes.
Right to non-discrimination: Exercising your CCPA rights will not result in any penalty or difference in service.

Submit CCPA requests via the contact page. We will respond within 45 days, extendable by an additional 45 days where reasonably necessary.

Children

Palette is not directed at children under 13. Users in the EEA must be at least 16 to create an account (or have verifiable parental consent where local law permits a lower age). We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us via the contact page and we will address it promptly.

Links to Other Sites

The Site may contain links to third-party websites. This Privacy Policy does not apply to those sites.

Changes to This Policy

We will update this Privacy Policy when the Site's data practices change materially. When we do, we will update the effective date at the top of this page and, for significant changes, post a notice on the Site. Continued use of the Site after changes are posted constitutes acceptance of the updated policy.

Contact

For privacy questions, data subject requests, or concerns:

Contact page — Email: hello@palette-analysis.pplx.app

We aim to respond to all privacy inquiries within 5 business days, and within statutory deadlines for formal data subject requests.