Privacy Policy

Earth Palace is a globe-native personal operating environment. For personal data described in this policy, the controller is the operator of the Earth Palace service. You can reach us at team@earthpalace.com.

We do not sell personal information. We do not run a third-party advertising network today. We do not train public foundation models on your content. If those practices change, we will update this policy before they apply to you.

Account data. Email address, authentication identifiers, sign-in method (email/password or Google via Firebase Authentication), and date of birth (used only to confirm you are 21 or older). Date of birth is stored on your private user record, never on your public profile.

Profile data. Display name, handle, avatar, bio, hometown or place associations you choose, theme and accessibility preferences, HUD layout, and other settings you save.

User Content. Globe Feed posts, comments, reactions, My Feed items, Drop captures, Palace Project files and chats, Daily Notes, memories you store, Jam Surfer library and playlists, uploads, and similar material you create. Public posts are visible to other users.

AI inputs and outputs. Prompts, attachments, and replies when you use Snuffy, Hermes, Living Agents, Drop suggestions, or similar features. If you use a local model on your machine, that traffic may never reach our servers.

Connector credentials. API keys, OAuth tokens, and endpoint URLs you provide, stored encrypted (AES-256-GCM) and used only server-side to perform actions you request.

Messages metadata. For Palace DMs we store ciphertext and routing metadata needed to deliver messages. We do not hold plaintext of E2EE palace DMs. Agent rooms are this-session and are not stored as E2EE DMs.

Operational telemetry. Sampled, non-content performance measurements (page path, Web Vital name/value, navigation type). Default sample rate is a fraction of page loads. This is not a marketing pixel and is not sold.

Technical data. IP address, user agent, approximate location derived from IP for security and abuse prevention, security logs, and cookies or local storage needed to keep you signed in and remember theme.

Communications with us. Emails you send to team@earthpalace.com, including privacy, deletion, and copyright notices.

We do not collect government ID, payment card numbers, or precise GPS for Earth pins (On Earth uses country-centroid clusters, not your GPS, unless a future feature you enable says otherwise).

We use personal data to:

• Create and authenticate your account and enforce the 21+ eligibility rule.
• Provide the Services you request: feeds, Earth, Snuffy, Projects, music, Drop, connectors.
• Display public profile fields and Globe Feed posts to other users when you publish them.
• Send your prompts to the AI provider you configured, or the platform default when offered, to generate a response.
• Secure the Services, prevent abuse, debug outages, and measure performance.
• Comply with law, including copyright notices, and respond to your requests.
• Personalize the palace experience if you enable palace personalization in Settings — remembering how you like to work, not training public models.

Where GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the account and features you request); legitimate interests (security, product reliability, limited telemetry, improving the Services in a way that does not override your rights); consent (optional connectors, optional identity-pack sharing, optional personalization, optional AI features); and legal obligation (tax, lawful requests, copyright).

We share personal data only as needed to operate the Services:

• Other users — content and profile fields you make public (Globe Feed, public profile).
• Processors who host or run infrastructure under contract: Google Firebase (authentication and current application data), Vercel (hosting and serverless compute), Supabase (target database platform being introduced through verified migration phases), and Cloudflare (when native video upload is enabled).
• AI and music providers you invoke — OpenRouter, OpenAI, Anthropic, Google, a self-hosted Hermes Agent, song-identification vendors, Radio Browser, and similar. They receive the minimum content needed to fulfill your request and process it under their own policies.
• Embedded platforms — official YouTube or TikTok players load those companies’ code when you play an embed.
• Legal — if required by law, valid legal process, or to protect people from serious harm.
• Business transfers — if we merge, raise a financing, or sell assets, personal data may transfer under this policy’s protections.

We do not sell personal information as that term is used in the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising. We do not allow third-party advertising SDKs to track you across the Earth Palace consumer product.

Public or shared: Globe Feed posts you publish; your display name, handle, and avatar; project showcases you explicitly publish; Open Palace or other discovery surfaces you choose to appear on.

Private to your account: date of birth, My Feed (unless you publish an item), Drop items you do not share, media vault, memories, connector credentials, identity pack files unless you enable sharing, Daily Notes, owner-only Palace Projects, and settings.

Demo Explorer profiles are labeled synthetic. They are not real people and are not your personal data.

Earth Palace does not train public foundation models on your prompts, files, or chats. We do not use your content to build a generally available Earth Palace language model.

When you use AI features, the provider that generates the reply may process your input under that provider’s terms. For example, consumer OpenAI or Anthropic accounts may have their own training and retention settings. If you bring your own key, you are the customer of that provider. If we send a request through a platform default, we still do not grant that provider a right — on our behalf — to train public models on Earth Palace user content beyond what their product terms already say for API or consumer use. Project-scoped chat is kept in-palace unless you explicitly consent to share private context with a remote agent.

Local Ollama models run on your machine. We do not proxy that traffic through our cloud.

Memory features (Brain Hub, Drop save-to-memory) are user-controlled. Snuffy retrieval is off until you allow agent memory. “Ask before saving” and related Drop toggles are honored in the product.

Connector secrets are encrypted at rest with AES-256-GCM and are not returned to the browser after storage. They are used only to perform the actions you request. Disconnecting a connector deletes the stored secret when an unlink path exists. OAuth access is limited to the scopes shown during setup. Messenger health on a self-hosted Hermes Agent is not treated as an Earth Palace direct connection to that messenger.

Palace DMs are end-to-end encrypted on this device. We store ciphertext, not readable message bodies. We cannot produce plaintext of those messages in response to a user or legal request, except metadata (participants, timestamps) and any content you also stored elsewhere. Clearing site data or losing the device can make history unrecoverable. Agent chats are not E2EE palace DMs.

We use:

• Strictly necessary cookies and storage for authentication (Firebase session), CSRF/security, and keeping you signed in.
• Preferences in local storage or similar, such as theme (dark/light) and HUD layout. Some Jam Surfer library keys are scoped to your user id on this device.
• Performance — sampled Web Vitals beacons to our own endpoint. No third-party analytics SDK is required to use Earth Palace.

We do not use advertising cookies. If we ever introduce optional analytics or Promote measurement cookies, we will update this section and provide a choice where required. Browser controls can block cookies; blocking strictly necessary cookies may prevent sign-in.

We keep personal data while your account is active and as needed to provide the Services. After a verified deletion request we aim to delete or de-identify account data within 30 days, then purge backups within up to 90 additional days, except where we must retain information longer to resolve disputes, prevent abuse, or comply with law (for example a copyright notice file). Encrypted message ciphertext is deleted with the account; we cannot recover E2EE plaintext.

If you delete your account in the app (Hampro or Settings → Privacy), live account data is removed promptly. Telemetry is sampled and retained only as long as needed for reliability (typically days to a few months). Public Globe Feed posts remain until you delete them, delete your account, or we remove them under the Terms.

We use industry-standard controls appropriate to a consumer web application: TLS in transit, per-user security rules and row-level security on private data, server-only Admin paths, encrypted connector vaults, and least-privilege processing. No method of transmission or storage is 100% secure. You are responsible for your device, your password, and for not sharing E2EE keys stored in the browser.

Report security issues to team@earthpalace.com with the subject “Security.” Do not include unnecessary personal data in the report.

We and our processors operate primarily in the United States. If you access the Services from the EEA, UK, Switzerland, or another region, your data may be transferred to the United States. Where required, we rely on adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms used by our processors (Firebase, Vercel, and others). Contact us if you need more information about transfers.

You can access and edit much of your information in Profile and Settings. Signed-in users can download a portable JSON copy (Export Data) and delete the account (Delete Account) from the Hampro menu or Settings → Privacy. You may also email team@earthpalace.com to request:

• Access to personal data we hold about you.
• Correction of inaccurate data.
• Deletion of your account and personal data (see retention above).
• A portable copy of data you provided, where technically feasible.
• Restriction or objection to certain processing, where applicable.
• Withdrawal of consent for optional processing (connectors, identity-pack sharing, personalization).

EEA, UK, and Switzerland. You may lodge a complaint with your local supervisory authority. We would appreciate the chance to resolve your concern first.

California (CCPA/CPRA) and similar U.S. state laws. California residents have the right to know, delete, correct, and to opt out of sale or sharing of personal information, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising. We will honor a Global Privacy Control (GPC) signal as a request to opt out of sale/share if we ever engage in those activities. Authorized agents may submit requests with proof of authority. We may need to verify the account email.

Categories of personal information we collect (in CCPA terms) include identifiers (email, user id, handle), customer records (profile), protected classification characteristics (age band inferred from date of birth for eligibility only), internet or electronic activity (pages you load, sampled vitals), geolocation (approximate, and places you choose on Earth), sensory data you upload (photos, audio, video), and inferences limited to in-product personalization you enable. We do not collect precise geolocation for advertising, biometric identifiers for identification, or payment card data.

We aim to respond to privacy requests within 45 days (often sooner; account deletion within 30 days as stated above).

Earth Palace is for people 21 years of age and older. We do not knowingly collect personal data from anyone under 21. The Services are not directed to children under 13 and are not intended for minors. If you believe an under-21 account exists, contact team@earthpalace.com and we will delete it.

We do not use solely automated decision-making that produces legal or similarly significant effects about you (for example credit, employment, or housing). Ranking of Globe Feed, radio Popular lists, or search results is ordinary product logic, not a credit-style automated decision. AI output is generated at your request and is not a binding decision about you.

We will post updates on this page with a new date. For material changes we will provide additional notice in the app or by email where required and practical. Continued use after the effective date means you acknowledge the updated policy. If you do not agree, you may request deletion and stop using the Services.

Privacy and data-rights requests: team@earthpalace.com
Account deletion: team@earthpalace.com (or use Delete Account in Hampro / Settings → Privacy)
Copyright: team@earthpalace.com
Contact page · Terms of Service