Privacy Policy

Effective October 9, 2026

This policy explains what personal information APPSTUDIO26 LLC (“we”, “us”) collects through the Palomino app for macOS, your Palomino account, and the websites at trypalomino.com and account.trypalomino.com, and how we use it. We are the controller of that information.

The short version

• Your code, files, prompts, and chats stay on your Mac. We never receive them.
• The app has no analytics or usage tracking, and its crash reports stay on your Mac.
• For your account, we keep your email address, your subscription status, and a record of the Mac your license is active on.
• We don’t sell your information or use it for advertising.

What we collect

Your account

To create an account and sign you in, we collect your email address. We email you one-time sign-in codes, which expire after 5 minutes. When you sign in, we keep a sign-in session, which may include your IP address and your browser’s user agent, along with tokens that keep the app signed in. We store those tokens only in hashed form. We also record which version of the Terms of Service you agreed to, and when.

Your subscription

Stripe processes payments. When you subscribe, Stripe collects your payment details, billing address, and email address under its own privacy policy. We never see or store your full card number. Stripe sends us your customer ID and your subscription’s status, billing periods, and cancellation date.

Your license

When you activate Palomino on a Mac, the app creates a security key inside your Mac’s Secure Enclave. The private half of that key never leaves the chip. To check your license, the app sends our server:

• the public half of that key, which we store as a fingerprint;
• the app’s version number;
• whether you asked to move your license to this Mac.

We record when the license was activated and last checked, and how many times it has been moved. The app does this when it starts and every few hours while it runs. We don’t collect your Mac’s name, serial number, or hardware identifiers.

The same check tells the app about updates. Downloading an update uses a link tied to your account, which lets us confirm that only subscribers download Palomino.

Visits to trypalomino.com

To understand how people find Palomino, the website records your visits:

• the campaign link that brought you there, if any;
• when you visited;
• your approximate country and region, which our hosting provider works out from your IP address.

To count returning visitors, it sets a cookie (__Host-palomino-visitor) that contains a random code and expires after one year. We don’t store your IP address or link visits to your account or email address. If your browser sends a Do Not Track or Global Privacy Control signal, the site records nothing and sets no cookie.

Emails you send us

If you contact us, we keep your message and our reply so we can help you.

What stays on your Mac

Palomino keeps the following in your home folder and in your Mac’s Keychain, and doesn’t send any of it to us:

• your settings, workspaces, and tabs;
• chat drafts, queued messages, and attachments;
• crash reports and logs;
• your sign-in tokens and license.

To show your usage meters, the app reads the session logs that Claude Code, Codex, and Pi already save on your Mac. It keeps only token counts, model names, and dates, not the content of your conversations.

Services the app connects you to

Some of what you do in Palomino goes directly from your Mac to other companies, not through us. Their own privacy policies apply.

• AI agents. Claude Code, Codex, and Pi send your prompts, code, and files to their providers, such as Anthropic or OpenAI, using your own accounts. The app also asks these providers for your usage limits.
• The npm registry. The app downloads and updates the open-source adapters that connect these agents to Palomino from the npm registry.
• The web. Pages you open in Palomino’s browser load from the sites themselves. Text you type in its address bar that isn’t a web address is sent to Google Search. The browser keeps cookies and site data on your Mac, as Safari does.

How we use information

We use the information above to:

• create your account and sign you in;
• process your subscription and check your license;
• deliver updates;
• prevent abuse, for example by rate-limiting requests by IP address;
• answer you when you contact us;
• understand how people find Palomino;
• meet our legal obligations.

We send you emails only for sign-in codes and important notices about your account or these policies. We don’t send marketing email.

If you are in the European Economic Area or the UK, we rely on these legal bases:

• performing our contract with you, for your account, subscription, license, and updates;
• our legitimate interests, for security and for understanding visits to the website;
• our legal obligations, for tax and accounting records.

Who we share it with

We share personal information only with providers that run Palomino for us, and only as much as they need:

• Cloudflare hosts our websites, servers, and databases, and delivers our emails.
• Stripe processes payments.
• Google Fonts serves the typefaces on our websites, so your browser contacts Google when you load our pages.
• Tailwind CSS’s CDN serves styling code for our home page, so your browser contacts it when you load that page.

We may also disclose information when the law requires it, to protect our rights or others’ safety, or as part of a merger or sale of our business, in which case this policy continues to apply to it. We don’t sell or share personal information for advertising.

How long we keep it

• Sign-in codes are deleted within about an hour of expiring.
• Sign-in sessions and app tokens are deleted within about an hour of expiring or being revoked. Sessions last at most 180 days.
• Your account, subscription status, and license records are kept while your account exists.
• Billing records are kept as long as tax and accounting law requires, including by Stripe.
• Website visit records are kept for as long as they help us understand how people find Palomino. They contain no name, email, or IP address.

Your choices and rights

You can ask us to access, correct, export, or delete your personal information by emailing [email protected] from your account’s email address. Deleting your account removes your account, sessions, and license records. Billing records we’re required to keep are retained.

Depending on where you live, you may have more rights. In the EEA and the UK, you can object to or restrict our processing, and complain to your data protection authority. In California and other U.S. states with privacy laws, you have the right to know, delete, and correct your information. We don’t sell or share it, so there’s nothing to opt out of. We won’t treat you differently for using any of these rights.

To stop website visit tracking, turn on Do Not Track or Global Privacy Control in your browser, or block cookies for trypalomino.com.

Security

We use encrypted connections throughout, sign-in without passwords, hashed tokens, and a license key that never leaves your Mac’s Secure Enclave. On your Mac, sign-in tokens and your license are stored in the Keychain. No system is perfectly secure, but we work to protect your information and keep only what Palomino needs.

Where your information is processed

We are based in the United States, and our providers process information in the United States and elsewhere. When we transfer personal information from the EEA or the UK, we rely on our providers’ safeguards, such as the European Commission’s Standard Contractual Clauses.

Children

Palomino isn’t meant for children under 13, and we don’t knowingly collect their personal information. Teenagers from 13 to 17 may use Palomino only with a parent’s or guardian’s agreement. If you believe a child under 13 has given us personal information, contact us and we’ll delete it.

Changes to this policy

We may update this policy. If a change is significant, we’ll tell you by email or in Palomino before it takes effect. The date at the top shows when it last changed.

Contact

APPSTUDIO26 LLC, Illinois, USA
[email protected]