Privacy Policy

• Your mobile number, to verify your identity and secure your account.
• Your name, which we ask for when you sign up, to personalise readings.
• We do not ask for your email address. Accounts opened before 3 October 2026 were asked for one; where it was given, it stays with that account, is not used for anything, and is erased if the account is deleted.
• Your palm photograph, at the moment you take it, solely in order to generate a reading.
• The text of the readings we generate for you, and of their translations if you open one in another of the site's languages.
• If you use Family: the name and relationship you give for each person you keep readings for (up to 4 people besides you), and the readings of their palms.
• If you use Couple: the compatibility readings of your hand beside someone else's. The photo of their palm is handled exactly as yours is, below, and never kept.
• Each time you photograph someone else's palm, for Family or Couple, you tick a box to confirm that you have their permission (for your son or daughter, that you are their parent or guardian or have their permission). We keep the time you ticked it with that reading, as the record that you confirmed it.
• If you use Ask: the questions you ask about a reading and their answers, as text, kept with that reading so you can come back to the conversation.
• If you use Ank Shastra: nothing, unless you press Save. Then we keep the name, its spelling in English letters and the date of birth you entered, so the result can be shown again. The numbers are worked out on our server from fixed tables, with no AI.
• If you use Rashi Profile: nothing, unless you press Save. Then we keep the name, if you gave one, and the date, time and city of birth you entered, so the profile can be shown again. The sign is worked out on our server from fixed tables, with no AI.
• If you use Face reading: a photograph of a face, only at the moment you take or upload it, to write that reading. It is handled exactly as your palm photograph is, below, and never kept. We keep the text of the reading, its translations if you open it in another of the site's languages, and the time you ticked that it is your face, or that you have the person's permission and they are 18 or older. It describes facial features only, never age, gender, caste, religion, ethnicity, health or identity. Only you can see it, and removing it, or deleting your account, deletes it.
• If you choose a city for the Panchang: which city of our list, so your home page shows that day's Panchang for it, until you choose another or delete your account. The Panchang itself is worked out from the date and the city alone.
• The translations of your compatibility readings and Ask conversations, if you open them in another of the site's languages. The original is kept as it was written.
• If you take the palmistry course while signed in: which lessons you have finished and when, and for each chapter's quiz your best score and how many times you took it, never your answers. Only you can see it, and it is deleted with your account.
• Payment status from our gateway. We never see or store your card number, UPI PIN or bank credentials.
• Basic technical logs such as IP address and timestamps, used for security and abuse prevention.
• If you arrive through a link or advert while signed out: the campaign tags in that link (its UTM parameters, or just the name of the ad network if it carries Google's or Meta's click tag), the domain of the site that referred you (never the full address), and the page you first landed on. Our own server keeps these in a cookie on your device for up to 30 days. It is set only when there is a campaign or a referring site to record, and never while you are signed in. It is separate from the analytics and advertising cookies below and is set whether or not you turn those off, because its contents stay with us: they are never passed to Google, Meta or anyone else. Signing in removes the cookie from your device and, if you are signing up, stores its contents with your new account, so we can tell which campaigns bring people to us. Signing out removes it too.
• Unless you turn off analytics and advertising cookies: which pages you visit and which steps you complete, via Google Analytics and the Meta (Facebook) Pixel; and, when you check out, your IP address, browser user agent and Meta's cookie identifiers, kept with the checkout for up to 30 days to report it to Meta, as explained below.

Only you can see your readings, the people you keep readings for, your compatibility readings, your Ask conversations and your Ank Shastra and Rashi Profile results. Each can be removed, as explained under How long we keep it, and deleting your account deletes all of it.

This is the part people ask about most, so we are explicit: your palm photograph is sent over an encrypted connection to our AI provider, OpenAI, in the United States, which analyses it to write your reading. We do not keep it: it is not written to our database or object storage, and it is not used to train any model by us.

OpenAI does not use it to train its models either. Like everything sent to its service, it may keep the photograph for up to 30 days to check for abuse, unless the law requires it to keep it longer, and then deletes it.

Only the written reading is retained, attached to your account, so you can read it again later.

The same goes for a photo of someone else's palm, taken for Family or for a Couple compatibility reading: it is read in the same way and never stored, and only the written reading is kept.

If you start from one of our adverts, you take the photo before paying. It then stays in your browser, on your device only, until you have paid and verified your number: nothing of it is sent to us before then. It is then sent once, as above, for your reading, and removed from your browser; a photo you don't go on with is removed from it after a day. So that you can pay before verifying, we keep the number you enter with the payment as an unverified account, which gives no access to anything until you verify it with the code we send.

We process your data on the basis of the consent you give when you sign up and upload a photograph, and to perform the contract between us. You may withdraw that consent at any time. When you photograph someone else's palm, or enter someone else's name or birth details, you confirm that you have their permission to do so. Analytics and advertising cookies are on by default, for the purposes explained below, and you can turn them off at any time with Cookie settings.

• Our SMS provider, to deliver your one-time verification code.
• Our payment gateway, Cashfree, to set up and collect your subscription. It receives your mobile number and your name, so it can set up the mandate and send you its notices by SMS. Its system also requires an email address, so it is given a reference address on our own domain, never yours.
• OpenAI, our AI provider, in the United States, which receives the palm photograph (yours, or for Family and Couple the other person's) in order to produce the reading and may keep it for up to 30 days, as explained above. On the same terms it also receives the text of a reading you ask about, with your question and the conversation so far, to answer it; and the text of a reading, compatibility reading or Ask conversation you open in another of the site's languages, to translate it. The names you give the people on Family are never sent to it. The same goes for the photograph of a face for Face reading, and for that reading's text when you open it in another language. Nothing you enter for Ank Shastra, Rashi Profile or the Panchang is sent to it: those are worked out on our own server from fixed tables.
• Cloudflare, which carries all traffic between your browser and our servers and protects the site from attacks. Everything you send us passes through its network on the way, the palm photograph included.
• Our hosting provider, Hetzner, whose servers run the site and hold its database.
• Google (Google Analytics) and Meta (the Meta Pixel), unless you turn them off in Cookie settings: a pseudonymous identifier, your approximate location and the pages and steps you visit, and to Meta, from our server, your sign-up and purchase events with your IP address, browser user agent and Meta's cookie identifiers, as explained under Analytics and advertising cookies below.
• Law enforcement or regulators, where we are legally compelled.

We do not sell your personal data, and we never send your phone number, your name, the people you keep readings for, the details you enter for Ank Shastra or Rashi Profile or the text of your readings to an advertising network.

We use Google Analytics 4 (analytics) and the Meta (Facebook) Pixel (ad measurement) to measure how people find the site and which steps they complete. Both run by default, for every visitor who has not turned them off. They set cookies in your browser and share a pseudonymous identifier, your approximate location, the pages you viewed and the steps you completed with Google and Meta, who may use it to measure and target advertising.

Unless you have turned them off, our server also sends Meta its own copy of four of those steps, so that Meta counts each once even where its Pixel is blocked: a request for a sign-in code (Lead), a new account (CompleteRegistration), and a paid checkout (Purchase and Subscribe). With each it sends your IP address, your browser’s user agent and Meta’s cookie identifiers (_fbp and _fbc), and nothing else about you. For a checkout these are kept with it for up to 30 days, to be sent once when it is paid, and then deleted. If tracking is off when you check out, none are kept or sent.

• Turning them off costs you nothing — the site works identically either way.
• We never pass your phone number, name, or any part of a reading to either provider.
• Purchase events carry the amount charged and an order reference, never your name, phone number or email.

To turn them off, open Cookie settings, at the bottom of every page, and choose Off. We then delete the cookies these tools have set on this site and stop them, so nothing more is sent to Google or Meta. If you are signed in when you do, our server also deletes what it kept for Meta with any checkout of yours not yet reported, so a checkout you started while they were on is not reported to Meta either; signed out, we cannot tell which checkouts are yours, so turn them off while signed in for that. The choice is kept in your browser: if you clear its site data, if the browser clears it by itself (Safari, for one, can do so after about a week without a visit to this site), or if you visit from another browser or device, they are on there until you turn them off again. A browser that blocks this site from saving data cannot keep the choice at all, so there they stay off only until you leave or reload the page. You can turn them back on the same way.

Readings, compatibility readings, the people you keep readings for, Ask conversations, Ank Shastra and Rashi Profile details and results, and any translations of them, are kept until you remove them or delete your account. You can delete your account yourself at any time from your account page, which removes all of it.

• Removing a person on Family removes their name and relationship, the readings of their palm, the questions asked about those readings and the translations of all of these. Only the times those questions were asked are kept, without their text, so that they still count against the month's limit; they go with your account.
• Removing a compatibility reading on Couple removes it and its translations.
• Anything you cannot remove yourself, such as a single reading of your own palm, we remove when you ask us at support@palmzer.com.

Your mobile number is kept while your account is open. Verification codes expire within minutes. Technical logs are kept for a limited time: the logs of our scheduled jobs for up to 90 days, and the server’s own logs until they reach a fixed size, after which the oldest entries are deleted as new ones arrive. Payment records are kept for as long as Indian tax law requires us to keep accounting records, including after your account is deleted. If you used the introductory offer, a keyed fingerprint of your mobile number is also kept after deletion. Both are explained below.

You can delete your account from your account page. Because it cannot be undone, deleting needs a recent sign-in: if you signed in a while ago, we ask you to sign in again with a fresh code first, so that someone else using your signed-in phone cannot do it for you. Deletion takes effect immediately. Copies in our nightly backups, which we keep only to recover from a failure, are deleted within 15 days, and kept longer only while newer backups are failing; if we ever have to restore one, every deletion we still have a record of is repeated before the service comes back.

• Any active or paused plan is cancelled first: we cancel its payment mandate with our gateway before anything is deleted. If we cannot cancel it ourselves, or the gateway does not confirm the cancellation, nothing is deleted and we ask you to contact us so we can resolve it.
• Then we erase every reading and its translations, the people you keep readings for and the readings of their palms, your compatibility readings, your Ask conversations, your face readings and their translations, your Ank Shastra and Rashi Profile details and results, your Panchang city, the records of the permission you confirmed, your name, your mobile number, any email address an older account gave us, and any record of the link or campaign you arrived from.
• We keep records of the payments you made — amounts, dates and the gateway's payment references — because Indian tax law requires us to keep accounting records. Our own database no longer holds your name or mobile number alongside them, but they are not anonymous: the payment gateway's own records of those payments, which we can still look up by those references, hold the mobile number and name it was given.
• If you used the introductory offer, we keep a keyed fingerprint of your mobile number after deletion, so the offer cannot be claimed a second time. It is computed with a secret held only on our server, so it means nothing to anyone else, and we use it only to check whether a number signing up has had the introductory offer before. It is stored without your account's ID or any of your details, and dated only to the month.
• You are signed out on every device. Signing up again later with the same mobile number starts a new, empty account, without the introductory offer if you have already used it.

Our payment gateway keeps its own record of the payments it processed, including the mobile number and name it received, under its own privacy policy and legal obligations. If you might need a refund later, keep your payment receipts: once your account is deleted we can find a payment only by its UPI or gateway reference, as our Refund Policy explains.

You may request access to, correction of, or deletion of your personal data, and you may nominate someone to exercise these rights on your behalf. You can delete your account yourself from your account page, as described above. If you would rather we did it for you, for example because you can no longer receive codes on your number, we delete it in the same way once we have verified that the request comes from the account holder. To ask for that, or for anything else, write to support@palmzer.com and we will respond within 30 days.

Traffic is encrypted in transit. Sessions use signed, HTTP-only cookies. Verification codes are stored only as salted hashes and are single-use. No system is perfectly secure, so please use a device only you can access.

PalmZer is not intended for anyone under 18 and we do not knowingly collect their data. A parent or guardian may keep readings of their child's palm on Family, which only the parent can see and which go when the parent removes that person or deletes their account.

As required by Indian law you may contact our grievance officer at support@palmzer.com. We acknowledge every complaint within 48 hours and resolve it within one month of receiving it, as the Consumer Protection (E-Commerce) Rules, 2020 require.

If a complaint about how we handle your personal data is not resolved to your satisfaction, you may take it to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.