Privacy / local-first
Your save bytes stay in your browser.
Pal Save Editor is a static site. It has no save-upload API, account system, server-side parser, database, background job, or cloud backup service in the current release.
Local file processing
Selected files and ZIP entries are read in browser memory and inspected in a Web Worker. Hashing, signature recognition, fixture edits, validation, receipts, PNG cards, and ZIP exports happen on this device. Raw save bytes are not sent to Pal Save Editor servers.
Save Chronicle storage
Save Chronicle stores up to 12 receipt metadata entries in this browser's localStorage. Entries include a receipt ID, date, display label, task, evidence score, capability, shortened hash, file and issue counts, validation status, change count, and an optional game-load result. It never stores raw saves. You can clear the ledger from the workbench or Chronicle page.
Analytics boundary
Public pages load a Plausible-compatible analytics script from click.pageview.click. Product events accept only approved task, source, capability, result, comparison mode, and bounded count fields. Filenames, paths, hashes, GUIDs, receipt IDs, and share tokens are discarded. The private /s/ route does not load the analytics script.
Advertising
Public, indexable pages may load Google AdSense in production. The local workspace, app routes, and private receipt route do not load the advertising script. Google may use cookies or similar technologies to personalize and measure ads; review Google's advertising policies for details and controls.
Private share links
New share links place a versioned, redacted receipt payload after the URL #, so that fragment is not sent in the page request. Anyone who receives the full link can read and alter its fields. A share token is not a signature, identity proof, or access-control mechanism.