Pal — Terms of Use

Last updated: 10 September 2026

Applies to the Pal iOS application and its backend services. Pal is in closed beta, distributed through Apple TestFlight to testers in the United States.

1. Who you are agreeing with

Pal is operated jointly by two individuals: Kayacan Kaya and Jordan Wong. There is no company behind Pal — it is not incorporated. When these terms say "we", it means those two people, and both of us are responsible for what is described here.

2106 Lockwood Ave, Fremont, CA, United States

Contact: jwong@thepal.app — this is the address for every question, request and complaint in this document.

These terms are the agreement between you and us about your use of Pal. The Privacy policy is a separate document, about what we collect and why. Where both describe the same thing, the privacy policy is the detailed one and we have not restated it here — a second copy of a document is a copy that will eventually disagree with the first.

If we ever incorporate, we will update this section and tell you in the app before the change takes effect.

2. What Pal is

Pal learns your individual palate from meals you log and rate, and uses it to recommend restaurants and specific dishes.

Pal is free. There is no purchase, no subscription and no fee. Pal shows no advertising and contains no advertising SDK, and we do not sell your personal information.

Pal is beta software built by two people. Section 10 is what that means in practice, and it is worth reading before you rely on anything Pal tells you.

3. Your account

You create an account with Sign in with Apple or an email address and password, and you can link both of those to the same account.

Parts of Pal work before you sign in, against a random identifier your device generates. These terms apply then as well. The one thing we cannot do for a signed-out user is act on a deletion request, because we cannot verify that the identifier is yours — see section 11.

4. What you may not do

If you find a security problem, please write to us rather than exploiting it. We would much rather hear from you first.

5. Objectionable Content and Abusive Behavior

Pal has zero tolerance for objectionable content and abusive users. There are no exceptions to this policy.

You may not post content that is harassing, threatening, hateful, defamatory, sexually explicit, violent, or that depicts or encourages self-harm. You may not post content that is unlawful, that infringes someone else's rights, or that impersonates another person. You may not use Pal to harass, threaten, stalk, or abuse another user.

Every post on Pal can be reported, and every user can be blocked. Blocking a user immediately removes their content from your feed and prevents further contact between you.

We review every report within 24 hours. Content found to violate this policy is removed. Accounts responsible for violating content are terminated, without notice. We may remove content or terminate an account at our sole discretion.

By creating an account, you agree to this policy.

6. What you post, and what happens to it

Read this section before you attach your first photo.

Attaching a photo to a meal creates a feed post. There is no separate share step and no per-post privacy setting. If you tagged a restaurant, that post is visible to every Pal user. If the meal was home-cooked or the venue was unknown, it goes to the Home segment, visible to people who follow you. Once a photo is attached to a post, the stored image can also be fetched by anyone who has its link, without signing in — the link is a long random string we do not publish, but it is not protected by a password. The privacy policy sets this out in full in its section 4.

What you post stays yours. You keep every right you have in your photos, captions and notes. By posting, you give us permission to store your content and show it inside Pal to the people described above, for as long as you leave it there — nothing wider. We do not sell it, we do not licence it to anyone else, we do not use it in advertising, and we do not use your photos to train anyone's AI model.

Photos are sent to an inference provider to work out what the food is, and the model's reply is stored against your account. That is a processing step in running the service, not a licence for anything else; the privacy policy names the provider and says exactly what is sent.

You can delete a post, and deleting it removes the image. Anything you have already sent into a shared group thread is a different matter — see section 11.

7. Your taste profile comes only from your own meals

Your taste profile is computed from the meals you logged and you rated, and from nothing else. Swiping a card, saving a restaurant, liking a post, browsing the map, or chatting with Pal never moves it.

That is a rule enforced by a test that reads our own source code and fails the build if any code that could write your taste profile appears without a written justification. We do not buy restaurant ratings, review scores, transaction data or purchase history to build it, and we do not use any of them.

The profile is data we derive. It means nothing outside Pal, you never give it to us directly, and it is deleted when you delete your account.

8. Where the restaurant and dish information comes from

None of the catalogue is written by us from scratch, and it is not a professional guide. It comes from two kinds of source:

Dishes are drafted from that evidence, never invented. A drafted dish stays marked pending until either a person checks it or a machine matches it to a line printed on the venue's own menu, and the two are recorded as different claims — a machine may never record itself as a human having confirmed something.

All of it can be wrong or out of date. A restaurant can change its menu, its hours or its prices without telling anybody, character recognition misreads text, and a menu page can be months old. Check with the restaurant before you go somewhere on the strength of what Pal says.

9. Dietary needs and allergies — please read this one

If you tell Pal what you never want served, we use it to filter and re-rank what we recommend, and we treat every exclusion as absolute — there is no severity setting anywhere in Pal.

But you must understand how the filtering actually works, because it is not what people assume. Pal matches words against a dish's name and cuisine. It does not know what is in the dish. There is no ingredient database behind it and no recipe. A dish whose name does not contain the word we are looking for passes the filter regardless of what is actually in it, and the underlying menu text can itself be wrong for the reasons in section 8.

Pal is not a food-safety tool and must not be used as one. If you have an allergy, ask the restaurant. Do not rely on Pal — or on any recommendation it makes — to keep an ingredient off your plate.

We ask for this information because a recommendation engine that ignores it is useless to you, and we would rather say plainly what it can and cannot do than let the feature imply a guarantee it cannot make.

10. Pal is beta software, and it will be wrong sometimes

Said plainly, because you should be able to weigh it:

We will fix what we can, and we would rather hear about a problem than not: jwong@thepal.app.

11. Ending your use of Pal, and what deletion does

You can delete your account and its data from inside the app: Me → Settings → Danger zone → Delete account. You type DELETE to confirm. There is no form to fill in and no email to send, and you do not need our permission. Deletion is immediate and permanent — signing in again starts a brand-new empty account.

The privacy policy's section 10 lists item by item what is removed. What follows is the part that is easy to miss: deleting every row that belongs to you is not the same as erasing you, and there are exactly four ways something of yours can outlive the deletion — kept, kept-but-cut-loose, and the two residues below. All four are decisions, none is an oversight, and all four are named here rather than left for you to find. The last of them, a photo that storage refused to delete, is also reported in the app at the moment it happens.

Removed. Rows keyed on your account across 43 tables, each named and counted individually so nothing disappears inside a database cascade that nobody counted.

Kept, on purpose, in 5 tables. Three hold a curator's audit trail — records that a venue or dish was checked on a given date. Those are claims about the catalogue rather than about you, and an ordinary account has none of them; if you were a curator, yours are the one place your activity survives in full. The other two belong to an external ingredient study whose participants are not Pal accounts at all and never can be — they are counted here so that "no rows of yours are in them" is a measurement rather than an assumption.

Kept but cut loose from you, in 2 tables. The first is your dish ratings. When you rate a dish's flavour, that measurement is folded into a running average that becomes the dish's published taste for every user, and an average cannot be un-computed. So the ratings stay and the link goes: your identifier on those rows is replaced with a one-off code, minted for your deletion alone, that names nobody, is not derived from anything about you, and no account can ever be issued. Your ratings still count as one person's rather than being merged into somebody else's, and nothing in Pal can tell you they were yours.

The second is the record that a group thread locked in a place to eat. That is a decision the group made, and deleting it would take the choice out of every other member's history — the same reason a thread you created survives with your name replaced rather than being destroyed. The row stays; the identifier saying you were the one who locked it in is overwritten with a flat marker meaning "a deleted account", which is the same marker used on every such row and tells nobody which account it was. If the thread was yours alone, there is no group to preserve a decision for and the row goes with the thread, in the count above.

Two further residues, named rather than hidden:

  1. Other people's messages in a group conversation you were part of. Those belong to them, so the thread survives; your membership and every message you sent are removed, and your identifier as its creator is overwritten. One piece does remain: a keyword note attached to a surviving thread records who added it inside a JSON value, and rewriting a column does not reach inside one. We know about it, it is written down, and it is not closed yet.
  2. An uploaded photo can outlive the database rows. Photos are deleted after the database, deliberately — the other order would destroy your photos and then leave your account intact if the database step failed, pointing at bytes that no longer exist. The consequence is that storage can refuse after your rows are already gone. When it does, the app tells you so — your account and all of its data were deleted, some photos could not be removed from storage — instead of reporting a clean success. Which files those were is recorded on our side. Write to us and we will remove them by hand.

Copies may persist for a short time in our database provider's automatic backups, which expire on their own schedule.

If you used Pal without signing in, your data sits against a random identifier your device generated, and we cannot delete it on request because we cannot verify that it is yours. Deleting the app removes your device's copy.

12. If we end your access

We may suspend or remove an account that breaks section 4, and we may take down content that does. Beyond that, this is a closed beta and we may end it — for one tester or for everybody. If we close your account for any reason other than a breach of section 4 or section 5, we will tell you at the address on the account before it happens, where we can.

Ending your access does not change section 11: your data is removed on the same terms, and you can ask us at jwong@thepal.app to confirm that it was.

13. Changes to these terms

We will post changes here and update the date at the top. If a change materially affects your rights or what you may do, we will tell you in the app before it takes effect, and continuing to use Pal after that is how you accept it. If you do not want to, delete your account — section 11 is how.

14. What this agreement does not contain

Stated so nobody has to guess at a clause that is not here:

We would rather leave a term absent and say so than adopt one nobody has actually decided. If any of this changes, it changes here first, under section 13.

15. Contact

jwong@thepal.app

Kayacan Kaya and Jordan Wong 2106 Lockwood Ave, Fremont, CA, United States