At a glance
Zero cookies
No tracking, advertising, analytics or third-party cookies, so there is no consent banner.
Strictly necessary
IndexedDB, localStorage and the offline cache only keep your own work and preferences.
Never sent
Unlike cookies, these stores are not attached to requests to any server.
Easy to erase
Clear the site data in your browser; export a .PALA copy first.
1The Application uses no cookies
It does, however, use two browser storage mechanisms - IndexedDB and localStorage -
to save your work on your own device. These are not cookies: they are never sent to a server with your
requests. They exist so your project survives closing the tab, and so the Application can work offline. Under
EU rules this kind of storage is strictly necessary to deliver the service you explicitly asked for, which is
why it does not require prior consent.
2Exactly what is stored
All entries below are created by the Application on your device only. Production Twin, Intelligent Command and the other analysis modules reuse the project, CRDT, journal and backup stores listed here; they add no store of their own, no advertising cookie and no external tracking, and their engines ship inside the offline application cache.
IndexedDB - database pala_scheduler_storage
| Store | Purpose | Lifetime |
|---|---|---|
projects | Your current project: screenplay, schedules, crew, local team accounts and PIN hashes, distribution packages, budget and reports. | Until you delete it |
versions | Rotating recovery points (automatic checkpoints so you can roll back). Limited to the 20 most recent. | Until replaced or deleted |
runtime | Offline-sync and permanent-backup-node settings, queues and conflict state. | Until changed or deleted |
operations | The local append-only operation journal and its SHA-256 hash-chain records. | Until deleted |
transactionReceipts | Signed receipts proving that a local transaction was committed, used to reconcile interrupted work. | Until deleted |
crdtOps | Signed CRDT operations used to merge project changes between authorised replicas. | Until deleted |
distributedTransactions | Signed multi-operation transaction bundles, delivery status and signed acknowledgements used for atomic peer synchronization. | Bounded local history until project data is deleted |
cryptoIdentity | The device's non-exportable ECDSA signing key and ECDH mailbox key, public keys and fingerprints. | Until site data is cleared or the identity is rotated |
backupVault | The non-exportable AES-GCM key that encrypts replicas stored by this backup node. | Until site data is cleared |
backupSnapshots | Encrypted permanent-node replicas, signed manifests and storage metadata. | Until rotated by retention or manually deleted |
meshMailbox | Recipient-only encrypted store-and-forward envelopes hosted by this node, with routing and retention metadata. | Until delivery acknowledgement, retention expiry or manual deletion |
IndexedDB – database palafilm_local_security_vault
A second, separate database holds the device vault. It is what the project mirror in localStorage refers to; without it that mirror cannot be decrypted.
| Store | Purpose | Lifetime |
|---|---|---|
keys | The device's non-exportable AES-GCM vault key, which encrypts the project mirror and other local records. | Until site data is cleared |
records | Values encrypted with that vault key. | Until changed or deleted |
IndexedDB – database palafilm_folder_backup
Created only if you choose a backup folder in Storage. It holds one record, handles / folder: the browser's reference to the folder you chose, not the files in it. Stop backing up deletes the record; clearing site data deletes it too, and then the Application no longer knows the folder.
localStorage keys and legacy migration
The sensitive queue/project keys below are legacy or emergency fallback keys; their normal destination is encrypted IndexedDB. The remaining preferences continue to use localStorage.
| Key | Purpose |
|---|---|
pala_scheduler_v08 | Mirror copy of the current project, encrypted with the device vault key; it can recover a project-store failure only while the separate vault database and its key remain accessible. |
pala_scheduler_v08_backup | Previous project state, kept as a safety net for recovery. |
pala_scheduler_v07, _v06, _v05_backup, _v04, _v03, _v02 and related | Projects saved by earlier versions of the Application, read once so an existing project is not lost after an update. |
pala_scheduler_last_export_at | Timestamp of your last .PALA export, used to remind you to keep an external backup. |
pala_scheduler_nav_collapsed | Which sidebar categories you collapsed, so the menu looks the same next time. |
palafilm_ux_preferences_v1 | Local text scale, contrast, motion and touch-target preferences, whether the left menu and the top menu are hidden, and whether the scene list and the detail panel of the Script screen are shown. The two Script choices are stored only after you make them. Whether the single-key keyboard shortcuts are on, and whether the page scales up on large screens, are stored with them. |
palafilm_usability_sessions_v1 | User-testing session codes, device/role, measured outcomes, timings, error counts and optional notes entered by the tester. No recording or telemetry is performed. |
pala_scheduler_ai_connector | AI provider, endpoint, mode and feature preferences. API keys are deliberately excluded and remain only in memory. |
palafilm_ai_ledger_v1 | Record of AI requests, by project: feature, provider, model, time taken, success or error, the token counts the provider reports, how plans ended, and the prices you enter. No request text, answer or key. Not sent anywhere; clear it in System → AI Connector. |
pala_scheduler_sync_settings, _sync_queue, _sync_conflicts | Optional endpoint configuration, pending offline work and conflicts awaiting a decision. |
pala_scheduler_device_identity_v1 | Public local device identifier and display name. The private cryptographic key is stored separately in IndexedDB. |
pala_scheduler_operation_journal_v1 | Small fallback mirror of the local operation journal. |
pala_scheduler_crdt_operations_v1, _crdt_conflicts_v1, _crdt_clock_v1 | CRDT fallback mirror, resolved-collision audit and local Lamport clock. |
palafilm_distributed_transactions_v1 | Fallback mirror for signed distributed transaction delivery and acknowledgement records. |
pala_scheduler_trusted_peers_v1, _security_events_v1 | Trusted public-key fingerprints and local security events. |
pala_scheduler_backup_node_settings_v1, _backup_node_events_v1 | Replica-node role, retention, automatic replication preferences and backup/recovery audit events. |
palafilm_mesh_outbox_v1, palafilm_mesh_events_v1, palafilm_mesh_local_certificates_v1 | Pending encrypted mailbox deliveries, local Production Mesh audit events and device membership certificates. |
pala_pin_attempts:<project>:<member> | Failed sign-in counter and lockout expiry for one team member of one project. Held in localStorage so that the lockout survives a reload, a new tab and a closed window; earlier releases kept it in sessionStorage, and any leftover entry there is still honoured and then removed. It records no PIN and no PIN hash. |
palafilm_transaction_receipts_v1, palafilm_transaction_recovery_v1 | Fallback mirror of commit receipts and of an interrupted transaction awaiting recovery. |
pala_estimate_model_notice:<project>, pala_cost_model_notice:<project> | Remember, per project, that you have seen the notice explaining that day-length estimates or the cost model changed, so it is not repeated. They contain only the flag 1. |
pala_script_focus_v1 | Whether the Script editor is in focus mode (side panels hidden, other paragraphs dimmed). A display preference only. |
pala_scheduler_interface_density_v1, palafilm_focus_navigation_v2 | Interface density, and whether the navigation is in focus mode. Display preferences only. |
pala_language | The interface language you chose with the flags (en, ro or de). Stored only after you choose; until then the Application follows your browser's language when it offers it, otherwise English. |
pala_last_view:<project> | The screen each project was last on, so Continue where you left off returns to it. |
pala_reminders | Whether reminders on this device are switched on. |
pala_reminders_seen | Which reminders were already shown today, so each appears once a day. Identifiers and dates only, at most 200. |
pala_activity | Your record of use: active days and when the main steps first happened, counts and dates only, for at most 180 days. Never sent. |
pala_print_paper | The paper you chose in the print preview, A4 or US Letter. |
pala_nav_system_seeded | Records that the System menu group was set up once, so your later choice to collapse it is kept. |
pala_scheduler_sync_queue, pala_scheduler_sync_conflicts | Changes waiting to be sent to a sync endpoint you configured, and conflicts waiting for your decision. Empty unless you use sync. |
__pala_storage_probe__ | A momentary write/erase test to check whether storage is available. Removed immediately. |
sessionStorage
| Key | Purpose |
|---|---|
pala_backup_reminder_shown | Ensures the "export a backup" reminder appears at most once per browser session. Cleared when you close the tab. |
pala_ai_oauth | Exists only while you sign in with OpenRouter: a random one-time verifier and the time the sign-in started, so the code returned by OpenRouter can be exchanged for a key in this tab only. Deleted as soon as you return; a sign-in older than 15 minutes is refused. It never holds the key, which stays in page memory. |
Cache Storage - service worker
| Cache | Purpose |
|---|---|
palafilm-core-v171 / palafilm-lazy-v171 | You can delete this copy at any time with Clear app cache and reload in Storage & Recovery; projects and preferences are not affected. A copy of the Application's own files (HTML, stylesheet, script, icons, the legal pages and the function guide) so it keeps working without an internet connection - for example on location. It holds program files only, never your project data. The previous core release is retained during activation; older release caches are rotated. Story notes, the outline and the profiles are saved inside the project itself, not in a store of their own. The install icons are part of this copy; the install screenshots are fetched from the site only when your browser shows its install dialog and are not stored by the Application. |
Installed app and files opened from your system
Installing PalaFilm from your browser (an Install app button appears in the sidebar where the browser allows it) creates no additional data store: the installed app uses the same IndexedDB, localStorage and caches as the website. Whether uninstalling it also removes that data depends on the browser; use the steps in section 4 to be sure. When you open a project or screenplay file (.pala, .palax, .fountain, .fdx, .msd) with the installed app, the browser gives the Application read access to that one file for that launch. The Application reads it locally through the same import checks as the Import button, does not upload it and does not keep a permanent handle to it. The shortcuts in the app menu open a screen through a ?view= address that is removed from the address bar immediately and holds no personal data.
Where each kind of data lives
Large project mirrors, CRDT and Sync queues, transaction recovery and receipts are encrypted in the IndexedDB runtime store. Existing localStorage copies are removed only after a verified migration. Small preferences remain in localStorage. When IndexedDB is unavailable, the encrypted localStorage fallback is bounded to 512 KiB across managed app keys and may be unavailable if other data fills the quota. Device vault keys remain necessary to decrypt local records; password-protected PALAX exports provide portable recovery. Production Cockpit day packets and decisions, and Story outline cards, notes and character and location profiles, are saved with the project. Exported HTML packets are fixed copies and do not update automatically.
3Persistent storage permission
When you open a project, the Application asks the browser to mark its storage as "persistent". This reduces the chance that the browser silently discards your work when disk space runs low. Some browsers grant this automatically, others ask you, and some refuse. You can also trigger the request yourself from the Storage screen or when enabling Backup Nodes. Granting it stores nothing extra - it only changes how eagerly the browser may evict data. While a project is open and the browser has not granted it, the sidebar shows a notice with a Protect storage button that repeats the request.
3bBackup files in a folder you choose
If you turn on Automatic backup to a folder, the Application writes ordinary .pala project files into that folder through the browser, after your saves (at most every 30 seconds) and keeps the last ten versions in a history subfolder. These files are stored by your operating system, outside the browser, and they are not encrypted: whoever can open the folder can read the project. Clearing site data does not delete them; remove them in your file manager. After the browser is closed it asks again for permission to write to the folder.
4How to inspect or delete everything
Inside the Application: open the Storage screen to see how much space is used, how many recovery points exist, when you last exported a backup, and to create checkpoints or export a copy. Open Backup Nodes to inspect, verify or delete encrypted replicas held by this computer.
In your browser, to erase all of it:
- Chrome / Edge: Settings → Privacy and security → Third-party cookies → See all site data
and permissions → find this site → Delete. Or open the page, press
F12→ Application → Storage → Clear site data. - Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data → select this site → Remove Selected.
- Safari: Settings → Privacy → Manage Website Data → select this site → Remove.
5Third-party storage
The Application loads no external scripts, fonts, images or trackers, so no other party can set browser storage through the static application shell. PDF and QR libraries are served locally. Collaboration gateway rooms and presence are volatile server memory, not browser cookies. Optional STUN, collaboration relay, sync endpoints and AI providers are contacted only when you enable the corresponding feature; their own websites or services may apply separate storage and privacy practices outside PalaFilm.
Requests from the Application to an AI provider are sent without cookies or other browser credentials, so the provider cannot recognise the browser through them. Get an API key, the key pages listed in the AI Connector, and Sign in with OpenRouter open the provider's own website; that website may set its own cookies under its own address and policy, which this Application does not control and cannot read.
Integration access tokens are kept only in page memory. Platform webhook URLs and signing secrets remain in the gateway process environment and are not written to browser storage.
6Contact
Questions about storage or privacy: contact@palafilm.com. See also the Privacy Policy.
What changed in version 4.1
- Added the entries for Continue where you left off, reminders, the record of use, the print paper, the System menu group and the sync queue;
pala_languagenow says that a first visit follows the browser's language.
What changed in version 4.0
- New local entry
palafilm_ai_ledger_v1: the AI usage record shown in System → AI Connector, numbers only.
What changed in version 3.9
- Published in Romanian and German as well as English. The three versions have the same content; if they differ, the Romanian version prevails.
What changed in version 3.8
- Added
pala_language, the interface language, andpala_ai_oauth, the temporary entry used while signing in with OpenRouter. - Section 5 explains that AI requests carry no cookies and that the provider websites you open set their own.