PRODUCT PRIVACY
Palmino
Privacy policy
Conversations and local storage
Palmino stores conversations, activity history, settings, and attachments on your device. Provider and MCP credentials are held in Apple Keychain. Starting with version 1.0.26 build 38, Palmino disables automatic conversation and attachment sync to iCloud and excludes its app-managed files from automatic device backup to protect health information. Earlier builds may include app data in backups or cloud sync according to your settings. Updating does not delete previously stored cloud data or backups. You control any explicit exports and their destination.
Model providers
When you use remote AI, data goes directly from your device to the provider endpoint you configure, such as DeepSeek, OpenAI, or an OpenAI-compatible service. Chat requests can include your messages and conversation history, task instructions, saved personalization, attached images, extracted document text, and tool results. Depending on the tools you choose, results may include contacts, calendar events, reminders, location, or health information. These data are used to generate your requested response. Image Studio sends your prompt and, for edits, the selected original image to its configured image provider; it is not always OpenAI. Palmino does not operate a model relay. Remote providers require your own account and API key and may charge for use.
Consent before AI data sharing
Starting with version 1.0.26 build 39, Palmino names the actual recipient and endpoint, describes the data sent and its purpose, and requests your permission before that AI feature sends data. Consent is separate for chat, images, transcript organization, and live voice, and applies to future requests for that recipient and feature, including scheduled tasks. Each fallback service requires its own approval. Changing a provider name or endpoint asks again. Declining sends no request to that service. Reset future sharing permissions in Settings → AI Data Sharing. This does not recall data already sent. HealthKit actions also retain their separate per-action sharing confirmation and system authorization.
Third-party protection and provider choice
We do not permit third parties engaged by Palmino to sell shared personal data, use health data for advertising, or use shared data for unrelated purposes, and require protection at least equivalent to this policy. Palmino has no developer-operated AI service or model relay. Independently configured providers are chosen and contracted by you; we cannot verify or guarantee the practices of an arbitrary custom endpoint. Only configure a service whose privacy, security, retention and deletion protections meet these standards. OpenAI and DeepSeek process requests under their respective privacy policies and your account terms; review those policies and retention controls before granting sharing permission. Do not send sensitive information to a provider whose protections you have not verified.
Tools and permissions
Apple capability tools may access files, photos, location, contacts, calendars, reminders, or other device data when the relevant feature is used and the applicable system permissions and in-app tool controls allow it. Returned tool data can become part of a model request. Review the destination and action confirmations before using sensitive data.
Apple Health
Optional health tools help you review activity, heart rate, sleep, and workouts, or separately record user-confirmed nutrition, hydration, and body mass. In version 1.0.26 build 38 and later, each HealthKit action requires an additional confirmation naming the configured model services that may receive the requested health values and results; declining stops that action. HealthKit system authorization is separate. If automatic backup protection cannot be verified, Palmino disables health access and shows a warning. Palmino does not use health information for advertising or tracking. Apple Health’s own data storage and iCloud settings are managed separately by Apple and iOS.
Voice and local transcription
After separate voice-sharing consent, Voice Conversation sends live microphone audio, voice transcripts, recent chat context, and delegated task instructions, status and results to OpenAI to provide spoken responses. Recording organization can send transcript excerpts, intermediate summaries and your instructions to your selected AI provider after separate consent; original recording audio is not sent by that feature. On-device Whisper transcription uses a model you explicitly download. Apple speech recognition uses Apple’s system permission and service behavior. On-device document generation stays on the device; the separately selected Private Cloud Compute option sends transcript text and instructions to Apple after confirmation. Content you later attach to a chat is covered by that chat’s sharing consent.
Optional MCP and Linux
A remote MCP server receives tool requests and data you send through that connection. Local guest tools run on your device; network commands and connected services can send data off-device when you approve their use. These external services have their own privacy practices.
Retention and deletion
Saved conversations remain in local app storage until you delete them. Delete a conversation from the conversation list. Documents, recordings, workspace files, and any exports you keep separately may need to be managed in their respective locations or retention settings. Removing local content does not recall data already sent to model providers or MCP servers, delete earlier cloud copies or backups, or delete records in Apple Health. Manage those copies with the relevant service or in Apple Health. Palmino has no account to delete, and we cannot remotely access or erase your on-device conversations.
Withdrawing permission and removing keys
To stop future access, disable the relevant capability in More → Settings → Tool Permissions and revoke system access in iOS Settings or Apple Health. You can decline an individual action confirmation. Remove a provider or clear its key in Settings and save; manage MCP connections separately. Voice Conversation has its own OpenAI key setting. Removing a saved key does not revoke it at the provider: revoke it in the provider’s account controls if needed. These actions do not undo earlier disclosures or Health records.
Sharing and contact
You control exports and shared files. Choose a destination suitable for any sensitive health information they contain. Palmino has no advertising or tracking SDK. If you email support, we receive your message and any material you send so we can respond; contact us to request deletion of support correspondence. Do not send API keys or personal health records. For privacy questions or requests, contact atomsprout@gmail.com. Updated October 23, 2026. Effective for the build 39 consent flow when that update is installed.