Skip to content
Palm Reading Scan

Policy

Privacy policy

What Palm Reading Scan collects, what happens to your photo and your scan, which services are involved, and how to ask us to delete what we hold.

Updated 4 November 2026

The short version

  • Your photo and camera frames are read inside your browser. Our code doesn't send them to us or to anyone else. Neither does it send the points, lines and measurements made from them. We tested this by recording every network request during a scan: see below.
  • We hold your email address only if you give it to us: to join the waitlist, or to save a Complete Palm Reading to your account. A saved reading holds your hand's measurements and traced lines, never a photo.
  • Analytics: on the live site, Google Analytics and PostHog count page views, clicks and a few steps of the scan. They get codes such as which tool you used, and nothing about your hand.
  • There is no account, no login and no payment anywhere on this site.

Who is responsible

The site is run by David Novotny, Bahnhofstrasse 1, 8001 Zurich, Switzerland, who is responsible for your data. For anything on this page, write to the people behind Palm Reading Scan at hello@palmreadingscan.com.

What happens during a scan

  1. Before the camera. Nothing opens until you choose. When you first show interest in a scan, your browser downloads the hand model and its WebAssembly from this site. Those are program files and contain nothing about you.
  2. The camera. Your browser asks for permission. The video is shown only on your screen. It isn't recorded or streamed. The camera is released when the scan finishes, when you leave and when you close the scan.
  3. A photo, if you upload one. Your browser opens the file on your device. It isn't uploaded.
  4. The hand points. Google's MediaPipe Hand Landmarker, an open-source model, runs inside your browser and returns 21 points on your hand. Google isn't involved in this step: the model comes from our site, and nothing goes back.
  5. The lines and the reading. The palm is flattened, the creases are mapped and the lines are traced on your device, in a background part of your browser. The free reading is put together there too, from a fixed library of sentences written in advance. No AI model on a server is called.
  6. The 3D hand, the poster and the film. These are made in your browser too, from the same points and lines. If you choose to move the 3D hand with your own, the camera works just as it does for the scan. Your palm photo stays out of the poster unless you turn on the option to put it in.
  7. Afterwards. The finished result stays in that browser tab, so going back, reloading or switching language doesn't lose it any more: a compact analysis and a small photo of the flattened palm, kept on your device (see "What is stored on your device" below). Your original photo and the camera frames live only in the tab's memory. All of it is gone when you close the tab. We never receive any of it, so we couldn't show it to you later.
  8. If you share or save something. A poster or a film goes wherever you send it, through your own device's share sheet or as a download. It doesn't pass through us. "Copy the link" copies only the address of the page, with nothing about you in it.

How we tested that

On 4 November 2026 we ran a production build in a headless browser and scanned a test photo and a fake camera feed. We dragged a line, opened the result, let the 3D hand load, saved the poster, made the film and joined the waitlist, recording every network request. All the requests went to this site, and all but one were downloads of pages, code, drawings and the model. The one exception was the waitlist signup: 67 bytes, holding the test email address, the tool and the language. The two-hand tool had its own run, with no upload at all. Analytics were off in those tests, because they run only on the live site, so they are described below from the code.

You can check this yourself. Open your browser's developer tools, go to the Network tab and run a scan. Our pages also carry a Content Security Policy, which tells your browser to block the page from connecting anywhere except this site, Google Analytics and PostHog.

The Complete Palm Reading is put together in your browser the same way: no photo is uploaded to write it. To show each chapter on your own hand, it keeps your photo, cropped round the hand, in your browser's storage on that device only (see below). Its last chapter has a button that forgets it.

What is stored on your device

Six items of ours. All six stay in your browser, and none is sent to us.

  • palm-first-hand-type, in session storage: the hand type from your first scan, the next type along, and how close you were. It keeps your label steady if you scan again, and your browser deletes it when you close the tab.
  • palm-result-v1, in session storage: the finished result in this tab, a compact analysis and a small photo of the flattened palm, so it survives going back, reloading or switching language. It is kept on your device, and your browser deletes it when you close the tab.
  • prs-guide-checklist, in local storage: which boxes you ticked on the palm reading guide. It stays until you clear it, and it never leaves the browser.
  • palm-paid-hand, in session storage: your hand's measurements on their way from your free result to the Complete Palm Reading. Your browser deletes it when you close the tab.
  • palm-reading, an IndexedDB database: your photo, cropped round your hand, so the Complete Palm Reading can light each part on it on this device. It stays until you press "Forget my photo on this device" in the reading or clear your browser's site data.
  • palm-intro-seen: and a code, in local storage: that you have watched a reading's opening film, so it doesn't play again on its own.

We set one cookie of our own, prs_session, and only if you log in to your saved readings: it keeps you logged in for up to 30 days and is removed when you log out. The analytics services set their own, as described next.

Analytics

On the live site, when they are switched on, two services measure use of the site. Neither runs on any other copy of the site.

Google Analytics 4 counts page views and the events below. Advertising storage, ad personalisation and Google signals are turned off, and the site runs no ads. It sets cookies such as _ga to recognise a returning browser. Google's policy is at policies.google.com/privacy.

PostHog, on its EU cloud, counts page views, clicks and the same events, and can record how a page is used as a replay. The camera stage and all results are marked so that replay shows a placeholder and clicks inside them aren't captured, and text you type into form fields is masked. It keeps an identifier in your browser's storage to recognise a returning browser. We don't link it to your name or your email address. Its policy is at posthog.com/privacy.

As with any web request, both services receive your IP address and browser details when your browser connects to them. These companies may process data outside your country.

Besides page views and clicks, our code sends seven named events: tool_started, input_ready, free_result_shown, offer_seen, offer_clicked, waitlist_joined and result_shared. Each carries the site, the language and the tool, and may carry where on the page it happened, the question you picked (love, money or path), which offer it was, and how you gave your input or shared a result (camera, upload, form, two hands, web share, download or copied link). Anything else passed to that function is dropped before it reaches either service, so an address, a measurement or a photo can't ride along. A browser extension or your browser's tracking settings will block both, and the site works the same without them.

Saved readings

Payments for the Complete Palm Reading aren't open on this site yet. When they are, a reading you save holds your hand's measurements and traced lines (and those of any second hand you add), never a photo, in a database on Cloudflare. It is kept under the email address you give, which becomes your account: we store the address so you can log in and see your readings, and we send the reading's link and any login codes to it through our email provider, Resend. A login code is stored only as a scrambled hash, works once and expires after 10 minutes; for the rate limit, your IP address is stored the same way, never in plain form. Anyone with a reading's private link can open it. You can delete a reading from your account page, and to delete your account, write to us from that address.

The waitlist

The Complete Palm Reading and its add-ons aren't available yet. If you press a buy button, a screen says so and offers to take your email. If you give it, we store your email address, the tool you were using, the language of the page, this site's name and the time, in a database on Cloudflare. We use it only to tell you if the paid version becomes available. The site itself sends no email, so nothing goes out automatically. Nothing deletes the list automatically either: your address stays there until you ask us to remove it or we delete the list.

To remove your address, write to hello@palmreadingscan.com from it, and we'll delete it.

To stop a burst of signups, the server counts attempts from your IP address, in memory for a few minutes. That count is never written to the database.

Hosting

The site runs on Cloudflare, which receives your IP address and request details in order to serve each page, and keeps operational logs. Our own logging records that a signup happened, never the address. Fonts, code, drawings and the hand model all come from this site, so opening a page doesn't contact a font or code service.

Who we share with

Nobody besides the services named here. We don't sell anything about you, and there is no advertising on this site. If the law requires us to disclose something we hold, the only thing we could disclose is a waitlist entry.

Age

This site is for adults. If you're under 18, please don't join the waitlist. If someone under 18 has given us their address, write to us and we'll delete it.

Your rights

Depending on where you live, you may have the right to ask what we hold about you, to have it corrected or deleted, to object to its use, and to complain to your data protection authority. The only personal data we hold ourselves is a waitlist address, so a message to hello@palmreadingscan.com covers most of this. For what Google and PostHog hold, their own pages above explain your options.

Changes

We'll update this page when any of this changes, and change the date at the top. For how the scan measures your hand, see the methodology page. The terms cover how the site may be used, and the contact page has more ways in.