palitoLast updated · 2026-10-31
Palito privacy
Operator and data controller
Palito — Juan Luis Pardal Acosta. NIF: 43837118S. Calle La Ladera 23, 38911 Frontera, Santa Cruz de Tenerife, España. support@palitoapp.com.
Palito and contact
Palito is the brand of this social counting app. Support and privacy contact: support@palitoapp.com. The brand alone does not identify the person or entity responsible for processing personal data.
Data and purposes
We use your email, account identifier and authentication credentials to register and verify your account and restore access. Your username, photo or emoji, preferences, groups, friendships, messages and entries provide the features you request. Dates and quantities are used to calculate streaks, statistics and rankings. These features require the data needed to provide the requested service.
Visibility and security
Group members can see the data you share within that group. Settings let you limit profile visibility, the groups you display and friend requests. Hiding a group on your profile does not hide your membership from its members. Files use access controls and temporary links: an issued link may remain valid for up to one hour. Chat is not end-to-end encrypted; do not use it to share passwords or confidential information.
Photos, alerts and local storage
Uploading a photo is optional. Only the image you select is uploaded. Alerts are optional and require device permission and activation for each group. You can turn them off in Palito or phone settings. Sending them uses a device push identifier; the alert may include the group name, username and activity, visible on the lock screen depending on your settings. We store the session, language, appearance and push token locally as needed for these features.
Providers
Supabase handles authentication, database and files; Hostinger provides email; Expo and Apple process the identifiers and content needed to deliver iPhone alerts. Message recipients also receive the content you share. The specific region, applicable agreements, transfers outside the European Economic Area and safeguards must be verified before public launch; we do not claim all data remains in Spain.
Retention and deletion
Account data is kept while you use the service. Delete your account under Profile → Account and documents. First transfer groups that have other members. Deletion removes your associated entries and messages; transferred groups remain and groups where you are the only member are deleted. Your uploaded images are also deleted; if the process fails afterwards, those images cannot be restored even if the account still exists. The internal alert queue is cleared after seven days. Actual provider backup and log retention periods still require verification; immediate deletion is not promised.
Your rights
Write to support@palitoapp.com to request access, correction, deletion, objection, restriction or portability where applicable. The minimum information needed to verify your identity may be requested. You can withdraw optional permissions without affecting previous processing. You can complain to the Spanish Data Protection Agency: https://www.aepd.es. Requests must be handled within GDPR deadlines.
Purchases and ads
Apple processes purchases and payment data; Palito does not receive card details. On the device we check the purchased product, its status and Apple verification to remove ads or restore the licence. Commercial ads are disabled. AdMob tests are enabled only after consent options are configured. Google may process device, network and interaction information to serve test ads; we do not send your email, messages, photos, group names or counts for targeting. Privacy notices and arrangements must be completed before commercial advertising.
Moderation and scope
Group rules may limit entries or send them for administrator review; statistics do not certify facts or assess your health. Request review of moderation at support@palitoapp.com, identifying the group and incident. Commercial advertising remains disabled during this preparation. Do not use it for medical records or to share other people’s sensitive data. Rules for minors and future advertising processing must be defined before enabling them.