Privacy Policy

Last updated: May 31, 2026

Introduction

Welcome to Paletty ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our mobile application.

Information We Collect

We may collect the following types of information:

  • Account Information: Email address, username, display name, and profile information you provide.
  • Content: Photos, colors, and captions you create and share through the app.
  • Usage Data: Information about how you interact with the app, including features used and time spent.
  • Device Information: Device type, operating system version, and unique device identifiers.
  • Advertising and Consent Information: Advertising identifiers when permitted by your device settings and consent choices, approximate location inferred from IP address, ads shown to you, ad interactions, and privacy or advertising consent choices.

Device Permissions

To provide our services, we may request access to your device's:

  • Camera: To allow you to capture photos for your daily color palette.
  • Photo Library: To allow you to select existing photos to analyze and share.

You can manage these permissions in your device settings at any time.

How We Use Your Information

We use the collected information to:

  • Provide and maintain our services
  • Personalize your experience
  • Show, personalize when permitted, measure, and improve advertising
  • Communicate with you about updates and new features
  • Ensure the security and integrity of our platform
  • Comply with legal obligations

Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

  • With your consent
  • To comply with legal requirements
  • With service providers who assist in operating our app
  • With advertising partners who help deliver, measure, prevent fraud for, and personalize ads where permitted by law, your consent choices, and your device settings

Third-Party Services

We use the following third-party services to operate our app:

  • Supabase: We use Supabase for authentication, database, and storage services. Your data is stored securely on Supabase's infrastructure. For more information, see Supabase Privacy Policy.
  • Firebase Analytics: We use Firebase Analytics to understand how users interact with the app. This helps us improve features and user experience. For more information, see Firebase Privacy Policy.
  • Firebase Crashlytics: We use Crashlytics to collect crash reports and diagnostic information to identify and fix technical issues.
  • Firebase Cloud Messaging: We use Firebase Cloud Messaging to send push notifications to your device.
  • Google AdMob and Google User Messaging Platform: We use Google AdMob to show native ads in the app and Google User Messaging Platform to manage advertising privacy messages and choices. These services may process data such as IP address, device identifiers, advertising identifiers when permitted, ad views and interactions, performance data, and diagnostics. For more information, see Google Privacy Policy, Google ads technologies and privacy information, and How Google uses information from sites or apps that use our services.

These services may collect and process your data according to their own privacy policies.

Advertising and Ad Choices

Paletty may show advertising, including native ads in the feed. Ads may be served by Google AdMob and may be personalized only when the applicable consent, age, regional privacy, and device permission requirements allow it.

On iOS, access to the advertising identifier (IDFA) is controlled by Apple's App Tracking Transparency permission. If you do not allow tracking, if you withdraw personalized ads consent, or if applicable law requires a more restrictive setting, we request non-personalized or limited ads where available. Core app access does not depend on accepting personalized ads.

Where required, Google User Messaging Platform may show a privacy message and may provide an advertising privacy options entry point. You can also manage Paletty's optional privacy preferences from the app's Privacy Center or your device settings.

International Data Transfers

Because we use global infrastructure providers, your personal data may be transferred to and processed in countries outside your country of residence, including outside the EEA, UK, or Switzerland.

  • Supabase: Authentication, database, and storage data may be processed in the region configured for our Supabase project and by Supabase subprocessors in other jurisdictions, including the United States.
  • Firebase (Analytics, Crashlytics, Cloud Messaging): Usage, diagnostics, and notification-related data may be processed on Google infrastructure in multiple regions, including the United States.
  • Google AdMob and User Messaging Platform: Advertising, consent, device, diagnostic, and ad interaction data may be processed on Google infrastructure and by eligible ad technology providers in multiple regions, including the United States.

Where required by applicable law, we use appropriate transfer safeguards, such as the European Commission's Standard Contractual Clauses (SCCs), and apply supplementary technical and organizational measures.

You may request additional information about applicable transfer safeguards by contacting us at paletty@appgarage.app.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Your Rights

You have the right to:

  • Access your personal data (Right of Access)
  • Correct inaccurate data (Right to Rectification)
  • Request deletion of your account and associated data (Right to Erasure)
  • Restrict certain processing (Right to Restrict Processing)
  • Request a copy of your data in a portable format (Right to Data Portability)
  • Object to certain processing activities (Right to Object)
  • Withdraw consent at any time for consent-based processing

Additional Information for GDPR Users (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, we process your personal data under one or more of the following legal bases:

  • Contractual Necessity: To provide core app features such as account creation, profile management, posting, and storage.
  • Consent: For optional processing such as analytics, crash diagnostics, marketing notifications, and personalized advertising when enabled by you.
  • Legitimate Interests: To protect service security, prevent abuse, and improve reliability.
  • Legal Obligation: To comply with applicable laws, regulations, and lawful requests.

To exercise your privacy rights, contact us at paletty@appgarage.app with the subject line "GDPR Request". Please include the email address associated with your account and the type of request you are making.

We may request additional information to verify your identity before fulfilling your request. We aim to respond within 30 days. Where permitted by law, this period may be extended for complex requests, and we will notify you if an extension is required.

Children and Age Requirements

Paletty is not intended for users who are below the minimum digital consent age required by applicable law.

For GDPR-related jurisdictions, the minimum age may vary by country (typically between 13 and 16). We apply a country-based age policy and use 16 as the default where no lower country-specific threshold is configured.

If a user is below the country-specific minimum age, parental or guardian consent is required before personal data processing for account use. If required age information or consent is missing, access may be restricted until verification is completed.

If we learn that personal data was processed without the required legal basis for a child account, we may suspend the account and delete or restrict related data as required by law.

Account Deletion and Data Retention

When you request account deletion, your account may be deactivated promptly so you can no longer access the service.

Our deletion workflow removes or deactivates associated records for your account, including:

  • account and profile records
  • post and post-image metadata
  • post color metadata
  • follow/block relationship records
  • report records linked to your account or your posts

Deletion of associated data is processed asynchronously and is generally completed within 30 days from your request.

Backup copies may remain for up to an additional 30 days before being deleted or overwritten in the normal backup cycle.

We may retain limited information when required by law or for legitimate purposes such as fraud prevention, dispute resolution, and security enforcement.

Data Controller Information

For personal data processing under this policy, the data controller is:

  • Controller: App Garage (Paletty Service)
  • Jurisdiction/Address: Republic of Korea. For formal postal correspondence, request full mailing details via the contact email below.
  • Contact: paletty@appgarage.app

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

paletty@appgarage.app