Privacy Policy
The short version
- Pal listens only after you tap its head, and only for as long as you're talking.
- Your voice is sent to Google's Gemini AI so Pal can answer. We don't keep recordings of it.
- We keep your email, a hashed password, and your Pal's settings. That's about it.
- We don't sell your data and we don't run ads or tracking.
- You can delete your account and everything on it from the app (Account › Delete account).
1. Who we are
Desk Pal ("we", "us") makes the Desk Pal desk robot (the "Pal"), the Desk Pal iPhone app, the servers they talk to, and this website. The company behind them is [COMPANY LEGAL NAME], [MAILING ADDRESS]. We decide how the data in this policy is used, so we're the "controller" under privacy laws like the GDPR.
Questions or requests: [PRIVACY CONTACT EMAIL].
2. What we collect
When you make an account
- Your email address.
- Your password. We never store it; we store only a one-way hash of it.
- Sign-in sessions (a token for each phone you're signed in on, stored hashed, with the time it was last used).
About your Pal
- A random device ID and a private device token (stored hashed) that let your Pal prove it's yours.
- The settings you choose: its name, voice, personality, eye color, volume, and the "About you" text you write for it.
- Your phone's time zone (sent when you add a Pal, so it knows what time it is), whether your Pal is online, and which firmware version it runs.
When you talk to Pal or type to it
- Voice. When you tap Pal's head, its microphone starts listening and streams your voice to our server, which passes it to Google's Gemini AI. Pal stops when you pause. The microphone isn't streaming at other times, and Pal has no camera.
- Transcripts. Pal turns speech into text so the conversation makes sense. While your Pal is online, our server holds the most recent lines (about 20) in memory so it can follow the conversation. They aren't saved to a database and are gone when the Pal goes offline or the server restarts. Our operator dashboard can display those recent lines, which we use only to fix problems.
- Messages you type in the app for Pal to say out loud.
When you set up your Pal
The app finds your Pal over Bluetooth. Your Wi-Fi name and password go from your phone straight to the Pal over an encrypted Bluetooth connection and are stored on the Pal. They are never sent to our servers. The app asks for Bluetooth permission only for this.
Technical data
When the app or your Pal connects, our servers (and our hosting and network provider, [e.g. Cloudflare]) see its IP address and basic request details. We use these to deliver the service and to block abuse, for example by limiting repeated sign-in attempts.
On this website
The site has no accounts, no cookies, no analytics, and no ads. It loads its fonts from Google Fonts, so your browser sends your IP address to Google when you visit. [Delete this paragraph's last sentence if you self-host the fonts.]
What we don't collect
We don't collect your location (Pal has no GPS; we know only your time zone), contacts, photos, or advertising identifiers. We don't create voiceprints or try to identify who is speaking.
3. Why we use it
| What we do | Why (legal basis in the EU and UK) |
|---|---|
| Run your account, connect your Pal, answer your voice and messages, apply your settings | To provide the service you asked for (contract) |
| Send firmware updates, keep the service secure, stop abuse, fix bugs | Our legitimate interest in a safe, working product |
| Capture your voice after you tap Pal's head | Your action in tapping it (consent). You can stop any time by not tapping, or by unplugging Pal |
| Meet legal obligations and respond to lawful requests | Legal obligation |
We don't use your conversations for advertising, and we don't use them to train our own AI models.
4. Who we share it with
We don't sell your personal information, and we don't share it for cross-context advertising. We share it only with the companies that help us run Desk Pal:
- Google (Gemini API). Pal's voice conversations are processed by Google's Gemini AI, so your audio and the conversation text go to Google. Google handles that data under its own terms for the Gemini API [CONFIRM: you're on a paid API tier, where Google says it doesn't use your data to train its models. If you're on the free tier, change this section, because the free tier allows training use.] See Google's Gemini API terms.
- Hosting and network providers that run our servers: [NAME THEM].
- Apple, which distributes the app (App Store and TestFlight) and handles its own data about your download.
- Authorities or others, when the law requires it, to protect someone's safety, or to enforce our terms, and a successor if we're sold or merge (we'll tell you first).
5. How long we keep it
- Account and Pal settings: until you delete your account or remove the Pal.
- Sessions and setup codes: sessions until you sign out or delete the account; setup codes expire after 15 minutes.
- Conversation text: in memory only, as described above.
- Voice audio: we don't store it. Google keeps its own copies for the period in its terms.
- Backups: deleted data can stay in encrypted backups for up to [30] days.
6. Your choices and rights
- Delete your account: in the app, go to Account › Delete account. It removes your account, your Pals, and their settings.
- Reset a Pal: hold its head for 8 seconds to set it up again (new Wi-Fi or a new owner).
- See, correct, or export your data: most of it is in the app. For the rest, email us.
- Everyone, wherever you live: you can ask what we hold about you, ask us to fix or delete it, and ask us to stop using it. We'll reply within 30 days.
If you live in the EU, UK, or Switzerland
You also have the rights to access, rectification, erasure, restriction, portability, and to object to processing based on our legitimate interests. You can withdraw consent at any time. You can complain to your local data protection authority.
If you live in California or another US state with a privacy law
You can ask to know, correct, and delete the personal information we hold, and to opt out of its sale or sharing. We don't sell or share personal information, so there is nothing to opt out of. We won't treat you differently for using these rights. You can ask through the email above, or have an authorized agent do it. If we turn you down you can appeal by replying to our answer. In the last 12 months we haven't sold or shared personal information.
We don't respond to "Do Not Track" signals because we don't track you across sites.
7. Children
Desk Pal accounts are for people 18 and over. Desk Pal isn't designed for children, and we don't knowingly collect information from children under 13. If you think a child has given us information, email us and we'll delete it.
If other people use your Pal, such as housemates, guests, or family, please tell them it listens after a tap and sends what it hears to an AI service. That's your call and your responsibility, and some places have rules about recording other people.
8. Security
Passwords and tokens are stored only as hashes. Connections to our hosted service use HTTPS/TLS. Each Pal has its own token, and firmware updates are cryptographically signed so a Pal accepts updates only from us. No system is perfectly secure, so we can't promise absolute security. If a breach affects you, we'll tell you as the law requires.
9. Where your data goes
Our servers are in [COUNTRY], and Google processes Gemini requests in its own data centers, which may be in other countries. If you're in the EU, UK, or Switzerland, we transfer data outside your region using [Standard Contractual Clauses / the EU–US Data Privacy Framework, as applicable].
10. Changes to this policy
If we change this policy in a way that matters, such as using your data for something new, we'll tell you in the app or by email before it takes effect. The date at the top shows the latest version.
11. Contact
[COMPANY LEGAL NAME]
[MAILING ADDRESS]
[PRIVACY CONTACT EMAIL]
[If you sell to the EU or UK without an office there, add your EU/UK representative's details here (GDPR Art. 27).]