Privacy policy

Who we are

Palmbook is an app and website run by Arun Verma, an individual in India. He decides why and how your personal data is used, so he is the Data Fiduciary for Palmbook under the Digital Personal Data Protection Act, 2023 (the DPDP Act). In this policy, “we”, “us” and “our” mean Arun Verma, and “you” means the person using Palmbook.

This policy explains what personal data we collect through the Palmbook app for iPhone and Android and through palmbook.in, why we use it, who receives it, how long we keep it and the rights you have. For anything in it, write to support@palmbook.in.

In short

• Your palm photo is used to create your reading and is deleted right after the analysis (at most 24 hours later), unless you choose to save it.
• Before any photo is analysed, the app names the AI provider it is sent to and asks for your permission.
• Your account, readings and photos are stored in India, on servers in Mumbai.
• We do not sell your data, show advertising based on it, or track you across other apps.
• We do not ask for your birth date.
• You can download your data or delete your account at any time.

What we collect and why

We collect only what Palmbook needs to work. The table lists each kind of personal data, what we use it for, where it is kept, for how long, and who else receives it.

We use your personal data only with your consent, which you give on the consent screen and in the app's settings, or where the DPDP Act allows it without consent, for example to comply with a law, a court order or a request from an authority (section 7 of the Act). You can withdraw your consent at any time (see Your rights). Withdrawing it does not affect what was done before, but we can then no longer provide the part of Palmbook that needs it.

Palm photos

• A clear palm photo can show palmprint patterns, so we treat it as sensitive.
• Before the photo is analysed, everything except your hand is cut out of it.
• It is deleted after analysis unless you turn on saving.
• It is never used to identify you, never shared beyond the AI provider named on the consent screen, and never used to train our models unless you separately agree in Profile → Notifications and privacy.
• It is kept in private, encrypted storage. Nobody working on Palmbook can see photos, except a photo you saved when you ask for help in a support request; every such view is logged.

The DPDP Act does not set up a separate class of sensitive data, but we give palm photos extra protection: we ask for your explicit consent before the first scan, keep them only as long as described above, and never use them for identification, profiling or advertising.

AI providers

To write your reading and answer your questions, Palmbook sends the straightened image of your hand, the measurements of your lines and your questions to an AI provider. The provider uses them only to return the reading or the answer to us.

Our AI provider is Anthropic, PBC, in the United States, through its Claude models. Under Anthropic's commercial terms, it does not use the data Palmbook sends to train its models, keeps it only for a limited period, and processes it only to provide its service to us.

The consent screen names the AI provider before your first scan, and a backup provider if one is used when the first is unavailable. If we change the provider or add a backup, the app asks for your consent again before any photo is sent.

Data processed outside India

Accounts, reports and photos are stored in Mumbai. The AI provider may process data in other countries. Crash reports are processed by Sentry in the US or EU and carry a device model, system version and an internal user ID, never your phone number or email.

Some of the services listed below also process data outside India: Anthropic, Resend, Sentry, Google and Apple. Section 16 of the DPDP Act allows personal data to be transferred to any country except those the Government of India restricts by notification. We do not transfer personal data to a restricted country, and each of these services is bound by its terms to protect it.

Your rights

Under the DPDP Act you have these rights over your personal data:

We answer requests to use your rights within 30 days, and sooner when we can; the DPDP Rules allow at most 90 days. Before acting, we may ask you to confirm the request with a code sent to the phone number or email on the account.

The Act also asks you to give true information, not to impersonate anyone, and not to file false or frivolous complaints.

Deleting your account

When you delete your account it is disabled at once. Your account, readings, photos and chat are erased within 7 days, and backups expire within 14 days after that.

Some records are kept longer, only for these reasons: purchase records for 8 years, as Indian tax law requires; consent records without your contact details, as proof of consent; security logs for 180 days, as India's CERT-In rules require; and the mark that the phone has had its free scan, for 24 months, which is linked to nobody.

Deleting your account does not cancel a Premium subscription with Apple or Google.

You can also delete a single reading in the app, which erases its photo, measurements, text and chat. We also erase personal data once it is no longer needed for the purpose you gave it for.

Adults only

Palmbook is for people aged 18 or older. Accounts found to belong to anyone younger are deleted.

Under the DPDP Act, anyone under 18 is a child, and a child's data may be processed only with verifiable consent from a parent or lawful guardian. Palmbook is not made for children and does not collect that consent, so we do not knowingly process children's personal data. If you think a child is using Palmbook, write to support@palmbook.in and we will delete the account and its data.

How we protect your data

Data is encrypted in transit and at rest, and phone numbers and email addresses are encrypted again in the database. Only people who need access have it, and their actions are logged.

• Everything is sent over HTTPS. Palm photos are kept in private storage that can only be reached through short-lived links.
• Sign-in uses one-time codes or Google and Apple sign-in; we never ask for or store a password.
• Access to our systems needs two-step sign-in and is limited to what each task needs.
• Security logs help us detect and investigate misuse.

If a personal data breach happens, we will tell the people affected without delay, explaining what happened, what it may mean for them and what they can do, and we will report it to the Data Protection Board of India and to CERT-In within the times the law sets.

Services we use

Each of them processes personal data only to provide its service to us, under its data processing terms. We do not sell personal data or share it with advertisers or data brokers. We disclose personal data to others only when the law requires it, for example to answer a valid order from a court or a government authority.

This website

This website sets no cookies and uses no advertising, analytics or tracking tools. Your browser remembers whether you chose the light or dark theme; that choice stays on your device and is never sent to us. The support and account deletion forms send what you type to our servers in Mumbai, only to handle your request, and our servers log basic request details, such as the IP address and time, for security.

Changes to this policy

We may update this policy when Palmbook changes or the law requires it. The date at the top shows the current version. If a change affects how we use your personal data, we will tell you in the app before it takes effect and, where the change needs your consent, ask for it again.

Contact and grievances

Arun Verma, who runs Palmbook, answers questions about your data, requests to use your rights and complaints (grievances). Write to him at support@palmbook.in.

We reply within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India through its online platform, after first using this grievance process.