PRIVACY POLICY
Last updated October 2, 2026
This Privacy Policy explains how Palette LLC (doing business as “Palette,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use the Palette mobile application and any related website or service that links to this Policy (collectively, the “Services”). It applies globally, with additional rights for residents of the European Economic Area (“EEA”), the United Kingdom (“UK”), and certain U.S. states described below.
AT A GLANCE
Palette is a social review platform for movies, shows, books, and music. We use personal information to create and operate accounts, display content and social activity according to privacy settings, help users find people they know, send account and social notifications, keep Palette secure, and understand how the app is used. We do not sell personal information, show targeted ads, use AI to profile users, or personalize recommendations.
TABLE OF CONTENTS
1. WHO WE ARE
Palette LLC is the controller or business responsible for the personal information described in this Policy, except where a service provider or other third party is independently responsible for its own processing.
Palette LLC
49 W 70th St, Apt 2
New York, NY 10023, United States
Email: hq@joinpalette.app
Our EU and UK representatives are listed in Section 19.
2. PERSONAL INFORMATION WE COLLECT
The information we collect depends on how you use Palette and which optional permissions you enable.
Information you provide directly
- Account information: phone number and username.
- Profile information: an optional profile photo and any other profile content you choose to add.
- User content and social activity: reviews, ratings, lists or mixes, likes, followers, following relationships, and other content or interactions you create through Palette.
- Privacy and account settings: whether your account is private or public, notification preferences, and related settings.
- Support and privacy communications: information you provide when you contact us, submit a privacy request, or make a data-protection complaint.
- Age-eligibility information: we ask for age or date of birth during signup to confirm that a user meets Palette’s minimum age requirement. We do not retain the date of birth or age after that eligibility check, except to the extent needed to apply age-appropriate protections or comply with law.
Information collected automatically or through Firebase
- Device and app information, such as device model, operating-system version, app version, and identifiers needed to operate the app or deliver notifications.
- Usage and analytics information from Firebase Analytics, such as automatically logged app events, app interactions, session or engagement information, and other analytics events configured by Palette.
- Technical and network information that may be processed by Firebase or infrastructure used to provide the Services, such as IP address and request metadata.
Contacts and information received from other users
If you grant Palette access to your contacts, we process contact information made available by your device, such as names and phone numbers, for the limited purpose of helping you identify Palette accounts belonging to people you may know. We do not use your address book for advertising or promotional marketing.
Because contact matching is optional, we may also process a phone number or other contact identifier about you that appears in another user’s address book, even if you did not provide that information directly to us. We use this information only for contact matching and related integrity or security purposes.
Sensitive information
Palette does not ask users to provide, and does not intentionally infer, sensitive or special-category information such as race or ethnicity, religious or philosophical beliefs, political opinions, health information, or sexual orientation. Users should avoid including sensitive information in reviews, profile content, or other user-generated content unless they intentionally choose to share it and understand the consequences of doing so.
3. PUBLIC AND PRIVATE ACCOUNTS
Palette is a social service. Depending on your account settings, your username, profile photo, reviews, ratings, lists or mixes, likes, and follower/following relationships may be visible to other users or the public.
If your account is private, Palette limits visibility of your reviews, ratings, lists or mixes, followers and following, and likes according to the app’s privacy settings. Some basic account information may remain visible where necessary to operate social features.
For users under 18, Palette applies a high-privacy default: the account is private by default. Visibility can be changed only through age-appropriate controls. Adult users can choose between public and private account settings in the app.
4. HOW WE USE PERSONAL INFORMATION
We use personal information for the following purposes:
- Create and authenticate accounts and keep accounts working.
- Provide requested social features, including profiles, reviews, ratings, lists or mixes, follows, likes, and privacy settings.
- Help users find people they know when they choose to enable contact matching.
- Deliver transactional, account, and social push notifications.
- Understand app usage, troubleshoot issues, improve reliability, and evaluate product features.
- Protect users, prevent abuse or fraud, investigate incidents, and maintain service integrity and security.
- Respond to support inquiries, privacy requests, and data-protection complaints.
- Comply with law, lawful legal process, and regulatory obligations, and establish, exercise, or defend legal claims.
- Complete or evaluate a financing, merger, acquisition, reorganization, sale of assets, or similar corporate transaction subject to appropriate safeguards.
Palette does not use personal information to send promotional email, does not use push notifications for promotional marketing, and does not use personal information for targeted advertising.
5. EU/UK LEGAL BASES
If the EU GDPR or UK data-protection law applies to you, we process personal data only where we have a lawful basis. Our principal bases are summarized below.
| Purpose | Typical data | EU/UK legal basis |
|---|---|---|
| Create and operate accounts and requested social features | Account, profile, user content, social graph, settings | Performance of our contract with you; legitimate interests where appropriate |
| Check minimum-age eligibility and apply age-appropriate protections | Age or date of birth during signup; eligibility result or protection status where needed | Legitimate interests in enforcing eligibility rules and protecting younger users; legal obligations where applicable |
| Optional contact matching | Contact information and account identifiers | Consent where required; you can revoke Contacts permission in device settings |
| Transactional and social push notifications | Push token, device/app data, notification events | Consent where required and/or performance of requested service features; you can disable notifications in device settings |
| Analytics and product improvement | Firebase Analytics events and device/app information | Consent where required by EU/UK device-storage or privacy rules; otherwise legitimate interests where permitted |
| Security, abuse prevention, and service integrity | Account, technical, network, and activity data | Legitimate interests in safety, security, fraud prevention, and service integrity; legal obligations where applicable |
| Support, privacy requests, and complaints | Contact information, account data, request/complaint details | Legal obligations and legitimate interests in responding to users and maintaining compliance records |
| Legal claims and compliance | Relevant account, content, technical, and request data | Legal obligation; legitimate interests in establishing, exercising, or defending legal claims |
| Corporate transactions | Data reasonably relevant to the transaction | Legitimate interests in carrying out a corporate transaction, subject to applicable law and your rights |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. If you withdraw consent for an optional feature, that feature may no longer work.
6. ANALYTICS, TRACKING, AND ADVERTISING
Palette uses Firebase Analytics to understand how the app is used and to improve reliability and product experience. Firebase Analytics may automatically log certain events and process device and app information.
Palette does not sell personal information, use personal information for targeted advertising, create advertising audiences, or intentionally use IDFA or other advertising identifiers for ad targeting. Palette’s Firebase configuration is intended to keep advertising-identifier collection and advertising integrations disabled unless our practices, this Policy, and any required consent controls are updated.
Where EU or UK law requires consent before non-essential analytics technology stores or accesses information on a device or processes related analytics data, Palette will request that consent before enabling the relevant non-essential analytics. You may later withdraw consent through available privacy controls or by contacting us.
7. PUSH NOTIFICATIONS AND CONTACT MATCHING
Push notifications
Palette uses Apple Push Notification Service to deliver transactional and social notifications, such as activity involving your account. Palette does not use push notifications for promotional marketing. You can disable notifications at any time in your device settings.
Contact matching
Contact access is optional. If you allow it, Palette uses available contact information only to help you identify people you may know on Palette and for related integrity or security purposes. You can revoke Contacts permission through your device settings. Palette does not use contact information for advertising or promotional marketing.
8. CHILDREN AND TEEN USERS
Palette is intended for users age 13 and older. We ask for age or date of birth during signup to check eligibility and do not retain the date of birth or age after that check except as needed to apply age-appropriate safeguards or comply with law.
Users under 18 receive enhanced privacy protections appropriate to their age. Their accounts are private by default, and Palette is designed so that younger users are not required to provide more personal information than is reasonably necessary to use the Services. We do not use children’s information for targeted advertising or sensitive profiling.
In the UK, users age 13 or older may generally provide their own consent for online-service processing where consent is the applicable legal basis. In the EEA, the age at which a child may provide their own consent for consent-based online processing varies by country. Where applicable law requires parent or guardian authorization for an optional consent-based feature, Palette will not enable that feature for the child unless the required authorization has been obtained or another lawful basis clearly applies.
If you are a parent or guardian and believe a child under 13 has created an account or provided personal information to Palette, please contact us at hq@joinpalette.app. We will investigate and take appropriate action, including deletion where required.
9. WHEN WE SHARE PERSONAL INFORMATION
We do not sell personal information. We disclose personal information only as described below and only to the extent reasonably necessary for the relevant purpose.
- Google / Firebase. We use Firebase for authentication, hosting or backend services, and analytics. Google processes information in connection with those services under its applicable terms and data-processing commitments.
- Apple. We use Apple Push Notification Service to deliver notifications to Apple devices. Apple processes device and notification-routing information in connection with that service under its own terms and privacy obligations.
- Other users and the public. Information you make public through your account is visible according to your privacy settings and the social features you use.
- Professional advisers and service providers. We may disclose information to advisers, contractors, or vendors that help us operate, secure, or support Palette, subject to appropriate confidentiality and data-protection obligations.
- Legal and safety disclosures. We may disclose information when reasonably necessary to comply with law or valid legal process or to protect the rights, safety, and security of Palette, our users, or others.
- Business transactions. Information may be disclosed or transferred as part of a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law and appropriate safeguards.
10. INTERNATIONAL DATA TRANSFERS
Palette LLC is established in the United States, and Palette’s Firebase infrastructure is hosted or processed in the United States. If you use Palette from the EEA, UK, or another jurisdiction outside the United States, your personal information may therefore be processed in the United States and in other countries where our service providers operate.
Where applicable law treats a transfer as a restricted international transfer, we use an approved transfer mechanism or other lawful safeguard. Depending on the recipient and circumstances, these safeguards may include an applicable adequacy decision or data-privacy framework, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another approved UK mechanism. You may contact us for more information about safeguards that apply to your information.
11. RETENTION AND ACCOUNT DELETION
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and protect users and the Services.
| Data type | Typical retention approach |
|---|---|
| Account and user content | Generally retained while your account is active. When you delete your account, Palette deletes the account and associated personal information from active systems without undue delay, subject to limited legal, security, or technical exceptions. |
| Backups | Deleted account information may remain in protected backups until those backups rotate, generally within 30 days. Backup data is not restored for ordinary business use after deletion except where necessary for disaster recovery or legal requirements. |
| Contact-matching information | Retained only for as long as reasonably necessary to provide contact matching and related integrity or security functions, subject to applicable technical and legal requirements. |
| Analytics and technical data | Retained for the period reasonably necessary for analytics, security, troubleshooting, and service improvement according to configured Firebase retention settings and internal practices. Aggregated or de-identified statistics may be retained longer where they no longer identify an individual. |
| Privacy requests, complaints, and legal records | Retained as necessary to demonstrate compliance, resolve disputes, and meet legal obligations. |
12. PRIVACY CHOICES AND REQUESTS
- Account privacy: use the app’s privacy settings to make an adult account public or private. Users under 18 are private by default.
- Contacts: grant or revoke Contacts permission in device settings.
- Notifications: grant or revoke notification permission in device settings.
- Analytics consent: where required, use the consent or privacy controls made available in the Services or contact us to withdraw consent.
- Account deletion: delete your account through the app. Associated personal information is deleted from active systems as described in Section 11.
- Access, correction, portability, or other privacy requests: use the in-app support channel or email hq@joinpalette.app. Palette does not currently provide an automated self-service export tool, but you may request a copy of your data through these channels.
We may need to verify your identity before completing a request. Rights are subject to applicable legal conditions and exceptions.
13. EEA PRIVACY RIGHTS
If the EU GDPR applies to you, you may have the following rights, subject to applicable conditions and exceptions:
- Access: obtain confirmation of whether we process your personal data and receive a copy.
- Rectification: correct inaccurate or incomplete personal data.
- Erasure: ask us to delete personal data where the law gives you that right.
- Restriction: ask us to restrict processing in certain circumstances.
- Data portability: receive certain personal data you provided to us in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
- Object: object to processing based on legitimate interests in certain circumstances.
- Withdraw consent: withdraw consent at any time where we rely on consent.
- Complaint: lodge a complaint with a supervisory authority in the EEA country where you live or work, or where you believe an infringement occurred.
We will respond to valid EEA rights requests without undue delay and generally within one month, subject to any lawful extension.
Palette does not use solely automated decision-making that produces legal or similarly significant effects on you, and we do not use AI to personalize recommendations or infer sensitive characteristics.
14. UK PRIVACY RIGHTS AND COMPLAINTS
If UK data-protection law applies to you, you may have rights to access, correct, erase, restrict, or obtain certain personal data, object to certain processing, withdraw consent, and complain to the Information Commissioner’s Office (“ICO”), subject to applicable conditions and exceptions. You may exercise these rights through the in-app support channel or at hq@joinpalette.app.
You may also raise a data-protection complaint directly with Palette through the in-app support channel or by emailing hq@joinpalette.app. We will acknowledge a UK data-protection complaint within 30 days, investigate it without undue delay, keep you appropriately informed, and provide the outcome without undue delay.
Palette does not use solely automated decision-making that produces legal or similarly significant effects on you, and we do not use AI to personalize recommendations or infer sensitive characteristics.
15. UNITED STATES PRIVACY RIGHTS
Depending on your state of residence and whether the relevant state privacy law applies to Palette, you may have rights concerning your personal information. These rights may include:
- Know whether Palette processes personal information about you and obtain access to that information.
- Correct inaccurate personal information.
- Request deletion of personal information, subject to legal exceptions.
- Obtain a copy of certain personal information in a portable format.
- Opt out of the sale of personal information, targeted advertising, or certain profiling where those activities occur. Palette does not sell personal information, does not use personal information for targeted advertising, and does not engage in profiling for decisions that produce legal or similarly significant effects.
- Limit certain uses or disclosures of sensitive personal information where applicable. Palette does not intentionally use sensitive personal information for purposes that would require such a limitation right.
- Appeal a decision regarding a privacy request where applicable.
- Exercise privacy rights without unlawful discrimination.
How to exercise U.S. rights
Submit a request through the in-app support channel or email hq@joinpalette.app. We may need to verify your identity using information reasonably related to your account or request. If applicable law allows an authorized agent to submit a request for you, we may require proof of the agent’s authority and may separately verify your identity. Where state law provides an appeal right, you may appeal a denial by emailing hq@joinpalette.app and identifying the request you want us to reconsider.
California notice
The following table describes categories of personal information Palette may collect from California consumers, examples relevant to Palette, the principal purposes, and whether Palette sells or shares the category for cross-context behavioral advertising. “Collected” includes information processed during signup or app use even if it is not retained long-term.
| Category | Palette examples | Purpose | Sold / shared |
|---|---|---|---|
| Identifiers | Phone number, username, device/app or installation identifiers, IP address, account identifiers, contact identifiers used for matching | Account operation, authentication, contact matching, notifications, security | No |
| California customer-record information | Phone number and other contact information provided by a user or available through optional contact matching | Account operation, contact matching, support | No |
| Protected classification characteristics | Age or date of birth used transiently to verify the 13+ requirement; not retained after the eligibility check except where needed for safeguards or law | Age eligibility and age-appropriate protections | No |
| Commercial information | Palette does not currently collect purchase, payment, or transaction information because the Service is free and has no in-app purchases | Not applicable | No |
| Biometric information | Palette does not collect biometric identifiers for identification | Not applicable | No |
| Internet or network activity | App events, interactions, session/engagement information, analytics events, technical request information | Analytics, product improvement, security, troubleshooting | No |
| Geolocation data | Palette does not request precise device location; approximate location may be inferred from IP address by service providers | Security, infrastructure, analytics where applicable | No |
| Audio/electronic/sensory information | Optional profile photo or other images a user chooses to provide; no call recordings or voiceprints | Profile display and requested user features | No |
| Professional or employment information | Not intentionally collected through the consumer Services | Not applicable | No |
| Education information | Not intentionally collected through the consumer Services | Not applicable | No |
| Inferences | Palette does not intentionally create profiles or inferences for targeted advertising or significant decisions | Not applicable | No |
| Sensitive personal information | Palette does not intentionally solicit or use sensitive personal information for advertising or profiling. Users should avoid placing sensitive information in user-generated content. | Not used for restricted purposes | No |
Retention for these categories follows Section 11. Account information and user content are generally retained while the account is active; deleted data may remain in backups for up to approximately 30 days; analytics, technical, privacy-request, and legal records are retained according to the criteria described in Section 11.
California “Shine the Light”
Palette does not disclose personal information to third parties for their own direct-marketing purposes as contemplated by California’s “Shine the Light” law. California residents may contact us at hq@joinpalette.app with questions about this practice.
Do-Not-Track and opt-out preference signals
Palette does not sell personal information or share it for cross-context behavioral advertising. Because Palette does not currently engage in those activities, there is no sale or targeted-advertising opt-out to apply to browser or device signals. If our practices change, we will update this Policy and provide and honor any controls or legally recognized preference signals required by applicable law.
16. SECURITY
We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, security monitoring, transport encryption, vendor safeguards, and procedures for responding to security incidents. No security measure is perfect, and we cannot guarantee absolute security.
17. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, where required or appropriate, provide additional notice of material changes through the app or another reasonable method. We encourage you to review this Policy periodically.
18. CONTACT US
Questions, privacy-rights requests, and data-protection complaints may be sent to:
Palette LLC
49 W 70th St, Apt 2
New York, NY 10023, United States
Email: hq@joinpalette.app
19. EU AND UK REPRESENTATIVES
| European Union Representative | United Kingdom Representative |
|---|---|
|
Raif Harris EEA data subjects and supervisory authorities may contact the representative regarding Palette’s processing of personal data and obligations under the EU GDPR. |
Adrian deCola UK data subjects and the Information Commissioner’s Office may contact the representative regarding Palette’s processing of personal data and obligations under UK data-protection law. |