Account and ChatGPT privacy

Your conversation stays with you

Paloma returns approved conversation questions. The plugin receives your selected audience, collection and mood, the number of questions requested, and identifiers of cards already shown or skipped to avoid repeats. These choices can reveal interests. The account database does not store your question request history.

Paloma does not ask you to submit your answers, record audio or import a private conversation. Its question tool has no field for your answers or the chat transcript. Information you type into ChatGPT remains subject to ChatGPT’s own settings and policies; do not put another person’s private information into a tool request.

Account sign-in

Auth0 provides sign-in. Information you enter on its sign-in screen, such as an email address and password, is handled by Auth0. Paloma verifies a signed access token containing a sign-in identifier, permitted actions, application identity and timestamps. Paloma does not receive your password.

Paloma stores a derived account identifier and identity hash, a derived billing lookup identifier, creation time, and the connection state needed to apply access and account controls. These identifiers are pseudonymous, not anonymous. The account database does not need a copy of your email address or name. Auth0 may retain those details in your sign-in profile.

The website keeps its access token in the open tab’s memory. A short-lived sign-in transaction is kept in that tab’s session storage and removed when the callback is processed or the sign-in is cleared. Signing out of this tab does not necessarily sign you out of Auth0 or ChatGPT. Those services manage their own sessions and cookies.

Existing Plus access

When existing Plus verification is enabled, Paloma uses RevenueCat to check the current subscription, approved product and entitlement, ownership, subscription period and access status for a trusted account identifier. It does not accept a customer identifier or a claim of payment supplied in a question request as proof of access.

Purchases, billing changes and new subscriptions are disabled on this service. Paloma does not receive a card or bank-account number. Existing purchase providers retain their own billing records. Connecting an iPhone purchase to this production account service is not enabled.

Disconnecting and deleting

Signing out of a tab, disconnecting Paloma, and deleting a Paloma account are separate actions. Use the account controls when shown, or contact support if you need help. A privileged account change requires a recent verified sign-in and an explicit confirmation.

Deleting the Paloma account blocks that identity from recreating the account and removes its app purchase links and pairing state. The service retains a minimal hashed identity fence and account/operation records without automatic expiry to enforce deletion and reject replayed access. A pending provider-cleanup job contains an encrypted sign-in identifier; that encrypted value is erased when cleanup completes. Connection status and completion records can remain.

The shared Auth0 sign-in profile is retained. Paloma’s automated cleanup revokes only the grants for its designated website and ChatGPT applications. It does not delete unrelated application access or end every Auth0, Google, Apple or ChatGPT session. The account page distinguishes local deletion from pending connection cleanup. For a broader sign-in profile erasure request or a question about retained records, contact support so we can assess the relevant data, provider and applicable rights.

Account deletion or disconnection does not cancel or refund a subscription. Manage renewal or request a refund with the original purchase provider. Deleting a Paloma account does not remove a ChatGPT conversation or copies you chose to share.

Hosting, providers and retention

Cloudflare hosts this service and its account database. It processes network and request information, including IP addresses, to deliver and protect the service; Paloma also uses the request IP for short-term rate limiting. Auth0 handles authentication and sign-in security. RevenueCat handles subscription verification when enabled. ChatGPT receives the question results returned to your conversation. These providers may process information in the United States and other countries where they operate.

Active account records remain while needed to operate the account. Minimal deletion fences and operation records have no automatic expiry, as explained above. Provider cleanup can remain pending during a service or provider failure. Removing an active record does not instantly erase database recovery copies, infrastructure security records or a provider’s independently retained information. Their retention depends on the provider and service settings; this notice does not promise immediate erasure of every copy.

This plugin account service does not use advertising tracking or a separate analytics script. It does not use your question choices to target advertising. Technical requests and provider security records remain separate from that statement.

Support and your rights

Emailing support@playpaloma.app sends your address, addressing details and chosen correspondence through Cloudflare Email Routing to our Apple iCloud support inbox. Replies may come from an iCloud address. Do not send passwords, access tokens, payment card numbers or someone else’s private conversation.

Support correspondence has no automatic deletion schedule. We retain it as needed to handle a request, document its resolution and meet applicable legal or security obligations. You can ask for its deletion. Provider copies may remain after mail is deleted.

We use information to provide the requested service, verify access, protect accounts, respond to support and handle privacy requests. Depending on applicable law, these activities rely on providing the service, legitimate interests in operating and protecting it, consent where required, or legal obligations. You may ask for access, correction, deletion or a portable copy, or raise an objection or privacy concern. Rights and exceptions depend on the request and jurisdiction. We may need a proportionate way to verify control of the relevant account; never email a password as proof.

You may also complain to your applicable privacy authority. If these practices materially change, we will update this notice and provide any notice or choice required before the change applies.