Privacy policy

1. The short version

• Without an account, your documents stay in your browser on your device. We do not receive them.
• With an account and the cloud on, your documents, pictures, versions, comments and teams are stored on our hosting at Cloudflare so you can open them on another device and share them.
• Background removal and other on-device models run in your browser; your picture is not uploaded for them.
• AI commands send your typed request and a trimmed text summary of your artboard (not pictures) to an AI provider. Image generation, where it is switched on, sends the artboard image.
• Usage statistics are off unless you say yes, and never contain what you wrote or drew.
• We do not sell your data and show no advertising. We do not train AI models on your work; AI commands may be processed by Google Gemini, which may use them to improve its services (see “AI features, and who receives what”).

2. Who we are

Paletoo is provided by Individual Entrepreneur Andrii Ruslanovych Mamontov, a sole proprietor registered in Ukraine (“we”, “us”). We are the controller of the personal data described in this policy, within the meaning of the EU and UK General Data Protection Regulation (GDPR) and the “owner of personal data” (володілець) under the Law of Ukraine “On Personal Data Protection”.

Address for legal notices: 90 Kniazia Volodymyra Velykoho Ave, apt. 23, Odesa, Odesa Oblast, Ukraine, 65069. E-mail for privacy questions and requests: [email protected]. We have not appointed a data protection officer; write to the address above for anything about your data.

3. What we collect, and why

Your account. Sign-in is run by our provider Clerk. If you sign in with email or with Google, Clerk handles your email address, name, profile picture and sign-in credentials or Google account identifier. We keep your account id, and a copy of your name and email so that collaborators can see who you are (for example in a share list or next to a comment).

Your documents on your device. By default a document is saved in your browser’s own storage (IndexedDB) on your device. We cannot see it, and clearing site data in your browser deletes it.

Your documents in the cloud. When you are signed in and the cloud is on, a document is saved to our storage at Cloudflare: its record (name, owner, size, dates) in a Cloudflare D1 database, and the document itself, its versions and its thumbnail in Cloudflare R2. Pictures and fonts you add are stored as files under your account (up to 1 GB per account). A version is kept every 10 minutes of work, and versions you name are kept too; the automatic copies saved in between are removed after one hour. A document you move to the trash is kept for 30 days and then deleted for good, with the files that only it used.

Pictures and fonts you upload. They are part of your document. They are stored on your device and, with the cloud on, in the cloud as described above.

Sharing and collaboration. If you create a share link, we store a secret link token and its settings (view or edit, copying allowed, on or off) and note which signed-in people opened it. Comments you write are stored with your author id and shown to people with access to the document. Teams store the team name, its members and their roles, an invite link token, and the fonts a team uploads. People you share with can see your name and email.

Working together live. While several people have the same cloud document open, a Cloudflare service passes between them who is present (name and role), where each pointer is, what each person has selected and which page is open. This is not stored: it exists only while the document is open.

Feedback. When you press Send in the feedback form we store the text you wrote and its type, plus what the form shows you first: browser and operating system, app build, language, current tool, what kind of thing is selected, counts of layers and artboards, window size, the last few command names you used (up to 20) and the last few error lines (up to 10, with links, paths and quoted text removed). The form also offers, each as a box you can untick before Send: a screenshot of the editor’s window as it is under the form (panels, menus and the canvas, with any areas you marked with “Show on screen” drawn on it; the form shows you this picture before you send it), ticked unless you untick it; the last few command names (ticked); and, if you are signed in, your account’s email address, so that we can reply (ticked; the feedback is then also listed for you under “Your feedback”, with its status). Your document is attached only if you tick “Attach this document” (unticked unless you tick it). If you opened a tester’s invite link, its short code goes with the feedback. Feedback is stored in a Cloudflare D1 database and R2 storage.

Crash reports. When the editor itself fails (an error in its own code), it sends one short technical report to our own server, at most a few per visit: the error’s message with links, paths and quoted text removed, the names and line numbers of the program files where it happened, browser and operating system, app build, interface language and which screen of the site was open (never the address of a shared link). It contains no document content, nothing you typed, no name or email. Reports are sent whether or not you agreed to usage statistics, because we need them to fix the editor, and are stored with feedback, in the same Cloudflare D1 database (no longer than 24 months).

Seasonal tools and their pages. When you press “Get the link” in the advent calendar, the photo postcard or “My year”, what you made is stored so that the link works: its words (names you typed included), the pictures you added (re-encoded on your device first, so a photo’s location and camera data never leave it; for a postcard with a cut-out subject, only the cut-out — the rest of the photo stays on your device) and a 1200×630 preview picture for messengers, in Cloudflare R2, with a record (tool, title, language, dates, how often it was opened, and your account id when you are signed in) in Cloudflare D1. Anyone with the link can open the page; it is not listed anywhere and asks search engines not to index it. No account is needed: the browser that made it keeps a secret edit key (we keep only a one-way hash of it), with which it can be changed or deleted; signed in, your account can too. Opens are counted anonymously — one number for the page, and one for each door or slide — with no cookie and nothing about who opened it. We also count, per tool and per day, how many wizards were started, results published, opened and shared, and how often “Make yours” was pressed: numbers only.

Usage statistics (optional). If statistics are on in the version you use and you press “Share” on the “what we collect” screen (it asks when you first open the editor, and is always in the ? menu), the editor sends short events such as “document opened”, “tool, panel or command used (its name, and whether by a key, a menu or ⌘K)”, “property changed (its name, never its value)”, “element, template or font inserted (its catalogue id)”, “search made (how many results and how long the query was — never the words)”, “export or AI tool started, finished or failed”, “a click that did nothing”, “a window closed without using it”, “the plans window opened or a payment started”, where the visit came from (the campaign tag of the link you followed, such as utm_source, and the kind of site that sent you — search, social, email — never its address), if you opened a tester’s invite link (paletoo.com/?invite=…) its short random code — which also goes with feedback you send, so we know it came from a tester — session length and error codes, in groups to our own server, which stores them in our Cloudflare D1 database; if we also set up PostHog in the EU (Frankfurt), a copy goes there. Events are made only of fixed names, small numbers and yes/no values from a closed list: never document text, layer names, pictures or things you typed. They carry a random identifier made in your browser after you agree and a random identifier of the visit; if you are signed in, our server adds a one-way scrambled form of your account number (so visits from your devices can be counted together, and so a plan you bought can be counted in these statistics — the payment itself is matched on our server, never sent by the editor), never your name or email. Our server also notes the device type (computer, tablet, phone) and browser family from the request; it does not store your IP address. If you choose “Not now” or “Don’t share” (or never answer), nothing is sent; after “Not now” the editor asks again in a week. Statistics are on in a version only when we have set it up; where they are off, nothing is sent whatever you answer, and the screen does not ask. You can change your answer later.

Payments. When paid plans are on sale, payments are taken by a third-party payment provider named on the checkout page. Your card or bank details go to that provider, not to us. We receive what we need to give you the plan and keep our accounts: your plan, its status and renewal date, the amount, currency and tax charged, your country (for tax), and the provider’s customer and transaction references.

Technical data. Our hosting provider, Cloudflare, receives your IP address and normal request data to deliver the site and protect it from abuse. Our servers use your IP address only in a shortened, one-way hashed form to count requests per minute or per day (for the AI, picture-search, analytics and feedback limits) and to slow down repeated wrong access codes. Cloudflare also tells our server your country; we use it only to choose the first language of the interface and keep it in a small cookie for one day.

4. AI features, and who receives what

AI commands (the “ask” box that edits your layout). We send your typed request and a trimmed summary of the open artboard to our server, which forwards it to Groq (open-weight models) and, if Groq fails, to Google Gemini. The summary contains layer names (cut to 40 characters), the text inside text layers, sizes, fonts, colours, positions and effect names. It does not contain pictures. Our server does not log your request or the provider’s answer; it keeps per-day counters of how many requests an account and a hashed IP address have made. AI commands also work without an account, counted by hashed IP address.

Image generation (materials and the render tool, only where we have switched it on). We send the artboard image you choose to render, an optional mask and your prompt to OpenAI, through our server. It needs an account; we keep counters of images made per day and who made them.

Expand photo and Fill selection in the cloud. We send, through our server, a reference picture of at most 512 px a side (the photo with the area to fill painted grey), the size wanted and the words you typed, if any, to Cloudflare Workers AI (the FLUX.2 klein model); the picture it makes comes back to your document. It needs an account; our server keeps per-day counters, not the pictures or the words.

Text for the seasonal tools (“Fill with AI” in the advent calendar, “Rewrite with AI” in the postcard, “Make it funnier” in My year). We send your short request — the occasion or scenario, the language, the tone, and the words you typed for it (names included, if you typed them) — to Cloudflare Workers AI (a small open-weight instruct model) through our server; the answer is text that the tool shows you. It works without an account; our server keeps per-day counters per account id or hashed IP address, not the request or the answer.

On-device models (Remove background, Select subject, Retouch, Upscale, and the postcard’s cut-out). The model files are downloaded to your browser (from our R2 storage, and the ONNX Runtime engine from the jsDelivr CDN) and run on your device. Your picture is not sent anywhere for these tools.

Bible text in the series tool is requested chapter by chapter from the public-domain service getbible.net through our server; only the translation, book and chapter are sent.

In short, who receives what:

• AI commands: Groq, and Google Gemini when Groq fails.
• Image generation: OpenAI.
• Expand photo, Fill selection in the cloud and the seasonal tools’ text: Cloudflare Workers AI.
• The Art tab: Ukrainian or Russian search words the editor cannot translate itself go to Cloudflare Workers AI to be put into English (only the words).
• Remove background, Select subject, Retouch, Upscale and the postcard’s cut-out: nobody. They run on your device and never upload your picture.

We do not train AI models on your documents, pictures or requests. Each provider handles what it receives under its own terms for API customers; Groq, OpenAI and Cloudflare state there that they do not use it to train their models. For Gemini we use Google’s free tier, whose terms let Google use what it receives — your typed request and the artboard summary, including the text in your text layers — to improve its products and services, and people at Google may read it for that. So do not type confidential information into AI commands, and do not run them on an artboard with confidential text. We send AI providers nothing beyond what this section describes.

5. Paletoo in AI assistants (Claude, ChatGPT)

You can connect Paletoo to an AI assistant — Claude by Anthropic, ChatGPT by OpenAI, or another app that supports the Model Context Protocol — so that it makes and changes designs in your Paletoo files for you. Only you can connect it: the assistant sends you to paletoo.com, you sign in to your Paletoo account and press “Allow”. It needs an account.

What the assistant receives from Paletoo, and only when it asks for it while you use it:

• the list of your designs: their names, ids, links and when they were last changed;
• what a design holds: its artboards, the words in its text layers, its photos and its colours;
• preview pictures of a design, rendered by Paletoo — by your own editor while you have the design open, otherwise by our server in a browser at Cloudflare that opens the design for that moment only;
• the styles, templates and looks Paletoo offers.

Nothing else about your account reaches the assistant: not your e-mail address, your payment details or designs it does not ask for. What the assistant receives is processed by its provider (Anthropic or OpenAI) under that provider’s own terms and privacy policy, which you accepted with them; what they keep of your conversation depends on them and on your settings there, not on us. Paletoo itself sends nothing that passes through the connector to any other AI provider.

What the assistant can do: make new designs in your files, change the designs you ask it to, add photos, templates, looks and effects, and — only when you ask it for a link to send — turn on a design’s share link (to view or to edit, as you choose). The link it gives you otherwise opens the design for you alone. It cannot delete anything, invite people or spend credits. When it looks for a photo by words, only those words go to Unsplash, through our server.

What we keep for it:

• The connection: which app you allowed (the name it gives itself and the address it returns to) and its sign-in tokens, stored only as one-way fingerprints (hashes). An access token works for one hour; a refresh token works once and expires after 60 days unused.
• For an app that registers itself with Paletoo, the IP address it registered from, to limit abuse: erased after one hour.
• How many designs the assistant made for you each day (a date and a number), for the daily limit: 30 days. Which style a design it made started from: until you delete your account.
• Preview pictures: deleted as soon as the assistant has received them; those our server renders are kept up to one day so that asking again does not render them again, then deleted automatically; one that arrives too late for the assistant is deleted automatically within a day. To render one, our server’s browser opens only that design, with a pass that works for that design alone for three minutes (we keep only a one-way fingerprint of it).
• Which layers of a design the assistant made or changed, and which version of it came before its first change, so that your editor can mark those layers and offer “Undo all”: until you undo or dismiss it there, or delete your account.
• The designs it makes are ordinary documents in your files, kept like any other (see “How long we keep data”). While you have a design open, the assistant appears in it as a named cursor; that is not stored.

You can disconnect an assistant at any time: account menu → “Account settings” → “Connected apps” → “Disconnect”. Its tokens stop working at once and are deleted. You can also remove the Paletoo connector in the assistant’s own settings. Deleting your Paletoo account disconnects every assistant and deletes everything listed above. Designs the assistant made stay in your files until you delete them.

Help with the connector: [email protected]. How it works: paletoo.com/mcp/docs.

6. Pictures, fonts and other services your browser contacts

Unsplash and Pexels. When you search for photos, your search words go to our server, which asks Unsplash or Pexels. The photos then load directly from images.unsplash.com or images.pexels.com, so those services see your IP address.

Museum collections. The Art tab searches the open-access collections of The Metropolitan Museum of Art, the Art Institute of Chicago, the Cleveland Museum of Art, SMK (National Gallery of Denmark) and the Wellcome Collection. Your search words go to our server, which asks the museums; thumbnails, and for some museums the chosen picture, load directly from the museum’s image server, which then sees your IP address.

Fonts. The interface fonts (Inter, Roboto Mono) are served from our own site. The font library for your documents loads Google Fonts files from our copy in Cloudflare R2, falling back to GitHub (raw.githubusercontent.com, the google/fonts repository), and previews use Google Fonts’ stylesheet service (fonts.googleapis.com, fonts.gstatic.com), so those hosts see your IP address when you browse or use a Google font.

Sign-in and bot protection. Clerk’s servers run sign-in; the sign-in page and the Google sign-in step are pages on Clerk’s and Google’s own domains. If you choose Google, Google tells Clerk your name, email address and profile picture, under Google’s own privacy policy. Cloudflare Turnstile checks sign-up and sign-in forms for bots. Clerk’s own telemetry is turned off in our app.

7. Legal bases

Under the GDPR, and under Article 11 of the Law of Ukraine “On Personal Data Protection”, we process personal data on these grounds:

• To provide the service you asked for (performance of a contract): your account, cloud documents and pictures, sharing, comments, teams, live collaboration, AI features you use, the seasonal tools’ pages you publish, feedback you send and, when you buy one, your paid plan.
• Your consent: optional usage statistics. You can withdraw it at any time on the “what we collect” screen; this does not affect what was sent before.
• Our legitimate interests in keeping the service secure, working and fairly shared: request limits based on hashed IP addresses, bot protection, the country cookie for the first language, the anonymous counts of the seasonal tools’ pages, and fixing the problems you report and the ones the editor’s crash reports show. We have weighed these against your interests; you can object (see below).
• Legal obligations: keeping payment and tax records, and answering lawful requests from authorities.

8. Cookies and local storage

We use only what the service needs to work, plus your own preferences; there is no advertising or cross-site tracking.

• Sign-in: Clerk sets session cookies (such as __session and __client_uat) so you stay signed in.
• Country cookie: mdtools_cc, your two-letter country, for one day, only to choose the first interface language.
• Site access cookie: while parts of the site are protected by a password (before launch), mdtools_gate remembers for 30 days that you entered it.
• Preferences in your browser (localStorage): interface language, light/dark theme, editor view settings (such as rulers and layout grids), your AI credit balance and its history while it is kept in the browser, your answer on statistics and, if you agreed, its random identifier.
• Documents in your browser (IndexedDB): your local documents, versions and pictures.
• Seasonal tools (localStorage): the work in progress, the list of what you published with its edit keys (“Mine”), and on a recipient’s device which advent doors are already open.

These are strictly necessary for the service or store a choice you made, so they do not need a cookie banner. You can delete them in your browser settings; you will then be signed out and local documents will be lost.

9. Service providers and other recipients

We use these providers to run the service. Those marked “processor” handle data only on our instructions; the others receive data as independent controllers under their own privacy policies when your browser or our server asks them for something.

• Cloudflare, Inc. (USA; global network), processor: hosting, database, file storage, live-collaboration rooms, request limits, bot protection (Turnstile).
• Cloudflare Workers AI (Cloudflare, Inc., USA; global network), processor: Expand photo and Fill selection in the cloud (FLUX.2 klein), and the seasonal tools’ AI text.
• Clerk, Inc. (USA), processor: accounts and sign-in.
• Google (USA / Ireland): Google sign-in (independent controller), Gemini for AI commands (under the terms of Google’s free tier, which let Google use that data to improve its services; see “AI features, and who receives what”), Google Fonts (independent).
• Groq, Inc. (USA), processor: AI commands.
• OpenAI (USA / Ireland), processor: image generation, where it is on.
• PostHog (EU hosting, Frankfurt), processor: an optional copy of the usage statistics, only if we set it up.
• The payment provider named at checkout, when paid plans are on sale: payments, fraud checks and, if it acts as the seller of record, invoicing and sales tax.
• Unsplash, Pexels, the museums listed above, getbible.net, GitHub and jsDelivr (independent): photo and art search, Bible text, font and engine files.

We may also disclose data if the law requires it, to protect the rights and safety of users or the public, or to a successor if the service is transferred (you would be told first).

10. International transfers

We are based in Ukraine, and several of our providers process data in the United States or elsewhere outside your country. Where the GDPR or UK law applies, transfers to providers outside the EEA and the UK rely on an adequacy decision (for example the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission’s Standard Contractual Clauses and the UK addendum, with the safeguards those require. Transfers abroad under Ukrainian law follow Article 29 of the Law “On Personal Data Protection”. You can ask us for more information about these safeguards.

11. How long we keep data

• Account data: while your account exists. You can delete your account yourself (account menu → “Account settings” → “Delete account”): your account, cloud documents with their versions, pictures and fonts, share links, team memberships, seasonal tools’ pages, AI-command counters and the copy of your name and email are then deleted at once; comments you wrote in other people’s documents stay there, without your name. If you ask us by email instead, we do the same within 30 days. Remaining copies in our providers’ backup and recovery systems are overwritten within a further 30 days.
• Cloud documents: until you delete them (30 days in the trash first) or delete your account.
• Versions: automatic copies in between, one hour; kept and named versions, until the document is deleted.
• Comments, share links and teams: until deleted, or until the document or team is deleted.
• Live collaboration: not stored; it exists only while the document is open.
• Seasonal tools’ pages (their words, pictures and preview): until deleted with the edit key or by the signed-in owner, and in any case deleted 12 months after the page was last opened (or changed). A picture uploaded but never published: one day. Their open counts go with them; the per-tool daily counts (numbers only): 12 months.
• Feedback and crash reports: until we have handled them and fixed the problem they report, and no longer than 24 months; older ones are deleted automatically.
• Usage events: 12 months, then deleted.
• Request counters: per-minute counters for minutes, render counters for up to 48 hours; daily AI-command counters (a date and a number per account id or hashed IP address) for up to 12 months, then deleted automatically.
• Payment and tax records: as long as Ukrainian tax and accounting law requires (generally at least three years after the year of the payment).
• Local data in your browser: until you clear it.

12. Your rights

Depending on where you live, and in any case under the GDPR (EU, EEA, UK) and Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to:

• know what data we hold about you, why, where it comes from and who receives it, and get a copy of it;
• have inaccurate data corrected, and have data deleted (for example by deleting your account);
• receive the data you gave us in a portable format (“Download my data” in the account menu gives you one file of what your account keeps, and each document can be exported from the editor at any time);
• restrict processing, or object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting earlier processing;
• complain to a supervisory authority: the data protection authority of the EU country where you live or work, the Information Commissioner’s Office in the UK, or the Ukrainian Parliament Commissioner for Human Rights in Ukraine. We would be glad to hear from you first.

You can delete your account and download a copy of its data yourself, in the account menu (“Account settings” → “Delete account”, and “Download my data”). To use any of these rights in another way, write to [email protected] from the email address of your account. We answer within one month (we may extend this by two more months for complex requests and will tell you why). We may ask you to confirm your identity. Deleting a document in the app moves it to the trash and removes it for good after 30 days, or at once if you delete it from the trash.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

13. Children

Paletoo is not intended for children. You must not use it if you are under 13. If you are under 16 (or under the age of digital consent where you live, if different), you may create an account only with the consent of a parent or guardian. We do not knowingly collect data from children without that consent; if you think a child has given us data, write to us and we will delete it.

14. Security

Traffic is encrypted (HTTPS). Cloud files are private to the account and the people it is shared with; a share link works only for someone who has its secret address, and you can switch it off or replace it. Access to the systems that hold your data is limited to what running the service needs. No online service is perfectly secure, so keep your own copies of important work. If a breach puts your data at risk, we will notify the authorities and you as the law requires.

15. Changes

We may update this policy. The date at the top shows the latest version. For material changes we will tell you in the product or by email before they apply; where a change needs your consent, we will ask for it.

16. Contact

Questions or requests: [email protected]. Post: Individual Entrepreneur Andrii Ruslanovych Mamontov, 90 Kniazia Volodymyra Velykoho Ave, apt. 23, Odesa, Odesa Oblast, Ukraine, 65069.