Privacy policy

PalCommand is a Windows desktop application for managing Palworld dedicated servers on your own computer. This policy is derived from the source-level data-flow inventory, which must be updated first whenever a data flow changes. Contact: [email protected], PalCommand, Queensland, Australia.

What stays local

Server installs, world saves, configuration, backups, game-server logs, metrics, ban records, and the Palworld control connection remain on your computer or LAN. We do not upload saves or backups. Your configured Discord-style webhook is stored locally and receives only the notifications you enable. Uninstalling preserves server and backup folders by design.

Account/device tokens and the local MCP pairing key are stored only in Windows Credential Manager. Signed entitlement envelopes contain claims and a public key id, not a payment-card number or provider secret. If secure storage is unavailable, account login and MCP pairing fail closed; there is no plaintext file fallback.

Account and identity

When you sign in, WorkOS AuthKit processes the identity method you choose. PalCommand receives a WorkOS user identifier, email address, optional display name, and OAuth tokens. The server encrypts the refresh token and stores only hashes of presented state, session, CSRF, network-prefix, and device secrets. The browser receives an opaque secure cookie. Login flows expire after 10 minutes; browser sessions after 30 minutes idle or 30 days absolute.

The desktop uses the system browser and a one-use loopback callback. A device record contains a random internal/client id, your device label, platform, activation/last-seen/revocation times, and hashed device-token records. We do not collect a hardware fingerprint. Device tokens are valid for 30 days and may rotate after 7 days. Up to three devices may be active.

Purpose: authentication, account/device management, abuse prevention, and delivery of the service. WorkOS is an identity processor.

Billing, card-required trial, and email reminder

Polar (Polar Software, Inc.) is the merchant of record and independently processes card, billing address, tax, invoice, refund, and payment data. PalCommand never receives the card number. We send the selected monthly/annual plan and an internal account reference; a correctly signed webhook is the only ownership authority. We store provider subscription/customer/order identifiers, plan/status, trial, renewal/end/payment times, and billing-event digests. The complete signed webhook body may contain email and billing metadata and is automatically nulled after 90 days; summary records remain for accounting/dispute obligations.

One card-required trial may last exactly seven days when the provider reports authoritative trial dates. We keep keyed pseudonymous trial-consumption subjects for up to 10 years to prevent repeated trials, after which the hourly job deletes them. The keyed value is not the raw WorkOS/customer identifier and cannot be reversed without the separate domain key.

We encrypt and queue the minimum recipient/content for one reminder 48 hours before trial end, then send it through the configured SMTP processor. An undelivered payload is crypto-shredded seven days after its delivery time; terminal rows delete after 90 days.

Account export and deletion

An authenticated export contains account, subscription, device, and allowlisted security-event records but excludes tokens, secret hashes, ciphertext, raw webhook bodies, and MCP arguments. Only one export may be active per account. Each category is capped at 10,000 records, encoded JSON is capped at 4 MiB, and requests are limited to two per minute per network address. Download authorization expires after 24 hours. The server deletes expired export artifacts and rows with path confinement; failed filesystem cleanup remains retryable instead of losing its descriptor, and monitoring for purge lag/failure remains a production gate.

If a trial or subscription is still current (including cancellation before its paid end date), or a checkout remains live/reconcilable, re-authenticated deletion records a pending request but preserves account, reconciliation, session, device, and fresh portal access so renewal can be cancelled. Before PalCommand can dispatch a provider request, it commits a seven-day post-URL-expiry deadline and keeps the internal correlation even if a crash or ambiguous response prevents the opaque checkout id from being saved. This permits a delayed signed subscription webhook without trusting an email or browser return; the correlation contains no email, raw WorkOS identity, or raw trial-abuse subject. After a signed provider event makes billing terminal and no checkout remains live/reconcilable—or at that exact deadline if no subscription arrived—a repeated re-authenticated deletion revokes sessions/devices and deletes profile, device, and outbox data. Export descriptors are disabled and removed only after confined artifact cleanup succeeds, including by retrying purge. Local servers, saves, and backups are untouched. Pseudonymous trial tombstones and billing, tax, dispute, fraud, or security records may remain only for an approved, documented legal period and must be detached from the profile where lawful.

Security events and product MCP

Allowlisted security events may contain time, event kind, outcome, internal account reference, and keyed network/session prefixes. They never contain raw IP address, user agent, email, cookie, provider response, request body, or token. The exact security retention window and deletion job use 365 days.

The optional local palcommand-mcp bridge communicates by stdio and a same-Windows-user named pipe. It sends no account/OAuth/device credential through MCP. Audit contains only time, tool name, selected scope, and outcome—never arguments, outputs, player names, or chat.

Other desktop and website traffic

• Updates: scheduled checks (disableable) and manual checks send ordinary request metadata/IP to updates.palcommand.com; installation is always explicit and signature-verified.
• Steam/Valve: SteamCMD uses anonymous login to install/check/update the Palworld server; Valve sees normal request/device metadata.
• GitHub: user-triggered PalDefender release checks/downloads expose ordinary request metadata.
• User-configured webhooks: optional messages may include server name, backup filename/failure, or player display name when that notification is enabled; the operator chooses the recipient.
• Crash reports: off by default and consent-based. Redacted reports go to PalCommand, retain no application-layer IP, are deleted after 90 days, and are capped at 20,000 rows. Pending local reports rotate at three files.
• Analytics: the toggle is off by default and currently inert. This policy must be updated first before any analytics sending code is enabled.
• Website/download API: static site, no advertising tracker; aggregate download counts only. Cloudflare sees traffic in transit as the reverse proxy.
• Support: email contains whatever you send. Do not send credentials, checkout/portal URLs, account exports, world saves, or unredacted logs unless support provides a secure approved path.

Retention and safeguards

The hourly server job deletes crash reports and raw webhook bodies after 90 days and enforces the crash-row cap. It deletes expired auth flows, sessions, device tokens, and trial tombstones; retains revoked session/device records 30 days for replay/incident correlation; removes abandoned checkout attempts 90 days after the seven-day reconciliation deadline; crypto-shreds stale reminder payloads after seven days and deletes terminal rows after 90 days; deletes security events after 365 days; and deletes completed 24-hour or one-day-incomplete export artifacts/rows with path confinement.

Production backups must be application-consistent and encrypted before leaving the host, with keys held separately, restricted access, tested restoration, and deletion aligned with the approved retention schedule. Secrets are versioned, domain-separated, and never logged.

Your choices and rights

You can disable scheduled update checks, crash reporting, analytics, notifications, and MCP; revoke devices; cancel renewal; export account data; and request deletion. Some network access is required for identity, billing, entitlement refresh, and Steam downloads. Contact [email protected] for access, correction, deletion, objection, restriction, portability, or complaint requests. Identity verification is required. Applicable non-excludable rights remain unaffected.

Recipients and changes

Recipients are WorkOS (identity), Polar/Polar Software, Inc. (billing/merchant of record), the selected SMTP provider, Cloudflare and the selected infrastructure host, Valve/Steam, GitHub, your configured webhook provider, and support email hosting. While PalCommand is in closed beta this site processes no purchases and collects no account personal data. Before purchases open, this section will name each production service provider, its country, its controller or processor role, and the safeguards applied to any international transfer.

We will version material changes and provide any notice/consent required by law. A change to code, provider, field, purpose, recipient, or retention rule must update DATA-FLOWS.md before this page.