Privacy / local-first
Your save bytes stay in your browser.
Pal Save Editor is a static site. It has no save-upload API, account system, server-side parser, database, background job, or cloud backup service in the current release.
Local file processing
Selected files and ZIP entries are read in browser memory and inspected in a Web Worker. Hashing, signature recognition, fixture edits, validation, receipts, PNG cards, and ZIP exports happen on this device. Raw save bytes are not sent to Pal Save Editor servers.
Save Chronicle storage
Save Chronicle stores up to 12 receipt metadata entries in this browser's localStorage. Entries include a receipt ID, date, display label, task, evidence score, capability, shortened hash, file and issue counts, validation status, change count, and an optional game-load result. It never stores raw saves. You can clear the ledger from the workbench or Chronicle page.
Analytics boundary
Public pages load a Plausible-compatible analytics script from click.pageview.click. Product events accept only approved task, source, capability, result, comparison mode, and bounded count fields. Filenames, paths, hashes, GUIDs, receipt IDs, and share tokens are discarded. The private /s/ route does not load the analytics script.
Advertising and cookies
Some public pages may display Google AdSense in production. Google and other third-party advertising providers may read or write cookies on your browser and may use web beacons, IP addresses, and similar identifiers to serve, personalize, measure, and protect advertising from fraud. Google may process this information under its own policies; see Google's advertising policies and Google Ad Settings for details and controls.
Pal Save Editor does not send raw save files, file paths, GUIDs, full hashes, private share payloads, or other save contents to advertising or analytics services. The About, Privacy, Contact, and Terms pages do not load the AdSense script.
Private share links
New share links place a versioned, redacted receipt payload after the URL #, so that fragment is not sent in the page request. Anyone who receives the full link can read and alter its fields. A share token is not a signature, identity proof, or access-control mechanism.