Privacy Policy

This policy explains what personal data we process when you use PalTweak (“PalTweak”, “the service”) at paltweak.com, why we process it, and the rights you have. We take a data-minimal approach: the service is built so that your Palworld save file never leaves your control any longer than the moment it takes to edit it.

1. Controller

The controller responsible for data processing on this website is:

2. Your save files — processed in memory, never stored

When you upload a Level.sav file, it is held only in a temporary, in-memory editing session on our server for the sole purpose of letting you view, edit and download it. Your save file:

• is never written to permanent storage or a database;
• is never shared with other users or third parties;
• is automatically discarded when your session expires or when you start over, and can only ever be downloaded back by you;
• is never transmitted to any analytics or error-monitoring provider — the file’s contents stay inside the editing session.

Legal basis: performance of the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in operating it securely (Art. 6(1)(f) GDPR). Because save files are not retained, there is no separate save-file deletion request to make — closing the session removes them.

3. Hosting

The service is hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the European Union. Hetzner processes data on our behalf as a processor under Art. 28 GDPR.

4. Content delivery network

We use Cloudflare(Cloudflare, Inc., USA) as a content delivery network and for security (e.g. protection against attacks). When you access the site, requests are routed through Cloudflare’s network, which processes connection data such as your IP address to deliver content and keep the service available. Legal basis is our legitimate interest in a fast and secure service (Art. 6(1)(f) GDPR). Where data is transferred outside the EU, it is safeguarded by the EU Standard Contractual Clauses.

5. Server log files

Our infrastructure automatically collects and stores information in server log files that your browser transmits. These are: browser type and version, operating system, referrer URL, host name of the accessing device, time of the server request, and IP address. This data is not merged with other data sources and is processed on the basis of our legitimate interest in the secure and stable operation of the service (Art. 6(1)(f) GDPR).

6. Cookies and local storage

We use only the storage necessary to run the service:

• Authentication — cookies set by our login provider (see below) to keep you signed in;
• Functional settings — small values stored in your browser (local storage), for example your interface preferences. These stay on your device.

We do not use advertising cookies or cross-site tracking. Processing is based on Art. 6(1)(f) GDPR (legitimate interest) or, where required, your consent (Art. 6(1)(a) GDPR).

7. User accounts and authentication

Uploading and editing requires a user account. Registration and login are handled by Clerk(Clerk, Inc., USA). To create and manage your account, Clerk processes data such as your email address, name (if provided) and a user identifier. This is necessary to provide the service (Art. 6(1)(b) GDPR). Clerk acts as our processor; where data is transferred to the USA, it is safeguarded by the EU Standard Contractual Clauses. You can find details in Clerk’s own privacy policy.

8. Payments

PalTweak offers an optional one-time “Pro” upgrade. When paid checkout is available, payments are processed by Stripe (Stripe Payments Europe, Ltd. for customers in the EU). If you make a purchase, Stripe processes the payment data required to complete the transaction (for example payment method details and billing information). We do not receive or store your full payment card details. Legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR).

9. Analytics

We use PostHog to understand how the editor is used, hosted in the European Union (PostHog EU). Requests are routed through a subdomain of paltweak.com that forwards to PostHog. We deliberately keep this minimal:

• autocapture and session replay are switched off;
• we record only a few meaningful actions (such as uploading, editing and downloading a save) plus basic page views;
• event data contains game-mechanical values only — never your save file’s contents and never text you type such as Pal or player names.

Legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR) or, where required, your consent (Art. 6(1)(a) GDPR).

10. Error monitoring

We use Sentryto detect and diagnose technical errors so we can keep the service reliable. When an error occurs, Sentry may receive diagnostic data including the error details, log and trace information, your IP address and request headers. Your uploaded save file’s contents are never sent to Sentry. Legal basis is our legitimate interest in a stable, secure service (Art. 6(1)(f) GDPR).

11. SSL/TLS encryption

For security, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the “https://” in your browser’s address bar. While encryption is active, the data you transmit cannot be read by third parties.

12. Data retention

We keep personal data only as long as necessary for the purposes described above or as required by law. Uploaded save files are not retained beyond the temporary editing session. Account data is kept for as long as your account exists; if you delete your account, the associated data is deleted, subject to any statutory retention periods.

13. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your data (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, with effect for the future, where processing is based on it.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.

14. Changes to this policy

We may update this privacy policy to reflect changes to the service or legal requirements. The current version always applies and is dated at the top of this page.