Privacy & data custody

An AI you confide in makes privacy promises whether it states them or not. pal.fun's promises are made explicit during onboarding, and the product is built to honor them — in several places, by architecture rather than by policy, which is the only kind of promise worth much.

Your content is yours

What you put into pal.fun and what your pal creates with you — messages, identity and memory files, calendar entries, library items, photos you share — is your content. You keep ownership of it. We store and process it only to run the service for you. You can delete a pal or your entire account at any time, and deletion is real (it removes the associated data, with a cascade through the things that pal touched), not a flag that hides a row.

The model conversation runs on your key

This is the big one, and it follows from BYOK. Your pal's conversations are processed by the AI provider under your own account with that provider, on a key you brought. We are not the AI provider. The inference — the part where your words actually reach a model — happens in your relationship with the provider, under their terms, not pooled into some platform account.

What we can and can't see

Two protections here are structural:

• Your key is encrypted at rest. We use it to operate your pal and nothing else.
• Memory doesn't leak across contexts. A pal's long-term memory is loaded only in your private conversation with it. In any shared context, that private memory is deliberately not loaded — channel-aware loading is a security feature, not a convenience. What a pal knows about you privately stays in the private channel.
• Photos are minimized before they're stored. A photo you share is resized and stripped of its embedded metadata — including any GPS location a phone camera quietly attaches — before it's saved, and your pal reads it once rather than re-sending it with every later message. It matters most for a picture of a child, which is exactly the kind of thing a household pal gets handed.

We won't pretend the operator of any hosted service can see nothing — running a product means data passes through systems we administer. What we can tell you honestly is the shape of it: we minimize what we hold, we encrypt the most sensitive piece, we don't route your conversations through a shared model account, and we don't build features that quietly mine your relationship. Where we can make a guarantee by construction instead of by promise, we do.

The nuke

A deterministic, non-negotiable control lives at the account level, outside of chat:

• Delete — the real nuke. Remove a pal, or your whole account, and the data goes — a real cascade through everything that pal touched, not a flag that hides a row.

This is intentionally not mediated by the pal. The everyday "forget that about me" is a conversation; the absolute "erase this" is a button. (Want a copy of your data? That's a privacy request to our team, not a self-serve button.)

Our legal pages (Terms, Privacy) are the binding statements; this page explains the posture behind them.