隐私说明

Privacy notice for the current test service

Updated 13 October 2026. Operator: 杭州市西湖区冬阳软件开发工作室. Contact: privacy@palmrd.com. This notice covers PalmRD's current account test service and these pages. Mac test builds are available for download; paid plans are not offered. We will update the notice for changed processing and seek consent where applicable.

Third-party sign-in testing: Apple/Google sign-in is not enabled in the production service. The third-party sign-in provisions below apply only to tests where this feature is actually authorized and enabled. Provider configuration or installing an update does not make sign-in available. Participation is optional; existing email sign-in rules remain unchanged.

Information and purposes

We process email addresses, verification requests, account identifiers and authentication information to register, sign in, reset passwords and verify deletion. Passwords are processed during authentication; the database stores salted hashes and verification parameters, not plaintext passwords. Alibaba Cloud sends verification messages. Token digests, expiry/revocation times, device names, platforms, random identifiers, public-key bindings, invitations and authorizations support discovery and access control. Identifiers may link to an account. Quota, usage and connection records support operation, not an available paid plan. Necessary operational logs may include network addresses, times and status. Support correspondence and attachments are used to handle requests; do not send passwords, codes or remote-access secrets.

Authorized third-party sign-in tests: Google requests only openid and email; Apple requests only email. We do not request mail contents, contacts, Drive files, name or photo permissions. We process the provider identity identifier, verified email (which may be absent or an Apple relay address), authorization codes and identity/access/refresh tokens for registration, sign-in, linking sign-in methods, reauthentication and revocation. Provider passwords are handled by Apple/Google web or system authorization interfaces, not PalmRD. Accounts are identified by provider and identity identifier, not automatically merged by matching email. A new account may have no password or contact email; a contact email can be bound through the in-app verification flow.

Remote content and local storage

Remote control processes selected screens, audio, input, window information and files. Only control authorized computers and obtain affected people's consent. OS-managed screen recording, accessibility and camera permissions affect their respective features. Routes vary by version and configuration. The account gateway can process forwarded content; this route is not end-to-end encryption that hides content from the server. The reviewed gateway does not intentionally store forwarded bodies or plaintext credentials in its database/request logs; that is not a claim that no endpoint or network provider retains anything. Devices may retain preferences, connection settings, text history and login material; uninstalling iOS may leave Keychain entries. Cloud deletion does not erase received files or text in other applications.

Diagnostics and website

Basic background fault reports contain fixed fault categories and versions, not raw logs, stacks, account/device identifiers, screens or input. Some clients queue at most 10 unsent items and discard items older than 24 hours when the queue is next processed; delivery is not guaranteed while the app is closed. Optional performance diagnostics are off by default and aggregate limited metrics by day. Review manually exported diagnostics before sharing them. These pages set no analytics/advertising cookies and load no third-party tracking scripts, fonts or analytics. Infrastructure still processes network information required to serve requests. External websites and email providers have their own practices.

Providers and locations

The current account server and private backups are in Tencent Cloud Nanjing. Transactional mail uses Alibaba Cloud East China 1 (Hangzhou); support mail uses Alibaba Mail's China site. Mail providers process recipient addresses and message contents; recipients also retain messages. Full locations and retention for support mail and provider internal logs are not all confirmed, so we cannot promise every copy stays in one region.

When you choose an authorized third-party sign-in test, the app accesses Apple/Google through a browser, a system authentication browser or the provider’s native authorization interface, depending on the platform. The provider processes authentication requests and necessary network information. On Android, Google sign-in uses Credential Manager and Google Play services AuthorizationClient. The app reads the selected Google account identifier (email) and identity token, uses that identifier to select the same account for authorization, and obtains a code for server-side exchange; it does not read name or photo fields. This native sign-in option is unavailable without the required Google Play services. PalmRD exchanges authorization codes, verifies identity and requests revocation when needed. Provider processing follows its privacy policy (Apple: https://www.apple.com/legal/privacy/; Google: https://policies.google.com/privacy); it cannot be described as taking place only in Tencent Cloud Nanjing. The support address shown on the Google authorization screen, palmrd-support@googlegroups.com, uses Google Groups. Google processes the sender address, message and attachments sent there for authorization-related support. Website product support remains support@palmrd.com; privacy and deletion requests remain privacy@palmrd.com. Complete provider and Google Groups storage locations and retention have not been individually verified in this test.

Retention and deletion

While your account exists, we retain information needed for account and authorization functions. Online deletion removes the account, sessions, control devices, invitations, authorizations, quotas and usage held in the online account database, and releases host ownership. Hourly cleanup handles expired refresh sessions, login failures outside a 15-minute window, email challenges at least 24 hours old, and diagnostic buckets outside the current and previous six UTC days. Expiry does not mean immediate deletion everywhere.

Managed snapshots use a seven-day rolling window; cloud backups use lifecycle expiration. Deployment rollback copies require both age and a valid replacement backup before cleanup. Successful jobs are required, so not every copy is physically erased on day seven. The developer-operated relay ledger retains account-linked identifiers, mixed cumulative network usage, qualification state and necessary integrity and recovery records to prevent rollback. Ordinary online account deletion does not automatically remove these records, and automatic age-based deletion for them is not yet implemented. Mixed network usage includes protocol and operations traffic; it does not represent click counts or exact user actions. Minimal deletion/revocation records, host identities and revocation receipts remain to prevent unsafe restoration. They exclude email addresses, passwords and tokens but can link to historical identifiers. Complete expiry is not yet implemented during testing, and no uniform final deletion date is promised. Dedicated service logs have seven-day or size limits; historical shared logs, correspondence, recipients' copies and provider logs are not all covered or immediately removed on deletion. Where law or technical limitations prevent deletion, retained processing is limited to necessary storage and security. Contact us for specific records or deletion requests. Recovery safeguards exist, but we do not claim restoration risk is fully eliminated.

Additional third-party sign-in retention: While linked, we retain provider identifiers and necessary account associations. To support revocation, we encrypt each distinct provider refresh token, or the access token when no refresh token is supplied, and keep a deduplication digest. Failed or unfinished exchanges may retain an encrypted full provider response containing tokens, identity and operation context. After successful adoption, that journal copy is reduced to an internal grant receipt without tokens.

Unlinking or account deletion removes the sign-in association and queues revocation. Until the provider confirms success, necessary provider identifiers, account associations and encrypted credentials remain in the task. Failure or uncertainty is not treated as successful revocation; immediate retry or completion is not guaranteed. Identity digests, revocation revisions and some exchange/revocation records do not yet have complete automatic expiry, so no uniform deletion date is promised. This is not permission for indefinite retention: retained processing is limited to necessary security reconciliation, revocation and recovery protection. Contact the privacy mailbox about deletion of specific records. Providers retain their own copies under their policies.

Unlinking a sign-in method, revoking computer access and deleting a PalmRD account are different operations. Unlinking requires another usable sign-in method and invalidates that account’s PalmRD sessions; it does not delete your Apple/Google account. Passwordless accounts can reauthenticate with an already linked provider and confirm deletion in authorized tests. You can also revoke access in the provider account, but PalmRD cannot yet guarantee immediate receipt of an external revocation notification or immediate sign-out.

Your choices

Manage device permissions, disable optional performance reports, revoke access or delete your account. Contact privacy@palmrd.com for access, correction, copies, consent withdrawal or other privacy requests. We verify necessary identity without asking you to share passwords or codes with support. Withdrawing necessary permissions/data may affect the related feature without invalidating earlier lawful processing. This test service is for adults aged 18 or older. Contact us about minors' or unauthorized information. Important changes will be highlighted in the pages or service, with separate consent when required.

When Help improve PalmRD is enabled, the controller retains de-identified technical events and numeric performance samples locally for up to 7 days (up to 1,000 batches and approximately 2 MiB of content, dropping older records at the limit), and uploads them automatically to the account service. An authorized computer may also request recent diagnostic snapshots. Records include disconnect reasons, connection states, version, timestamps and video transport metrics. Server records are associated with the authenticated account and are not fully anonymous. Server retention is at most 7 days with a 2 MiB content limit per account, dropping older records at the limit; expiration is processed by scheduled cleanup and incoming requests. Passwords, tokens, screen content, typed text and file contents are excluded. Recent records can survive an app restart. Expired records are removed when the app next processes the queue; immediate cleanup is not guaranteed while the app is not running. Turning this option off stops optional recording and transfer and clears locally queued diagnostics; copies already returned are not automatically recalled.