Privacy Policy · Palma Store

1. Information we collect

We collect information in three ways: what you give us, what we generate as you use the service, and what our sign-in providers pass us.

Account information

Email address (used for sign-in and account recovery)
Username, first and last name, avatar image (set by you, or filled in from Google/Telegram on sign-up)
Your chosen country (Uzbekistan / Russia / Other) — determines the currency you're charged in
Telegram user ID and Telegram username, if you sign in with or link Telegram

Order information

Every order collects the information needed to actually deliver UC to your account:

Your PUBG Mobile Player ID and, if you provide it, your in-game nickname — the UC you buy is credited to this ID
One contact channel of your choosing (Telegram, VK, email, or phone) so we can reach you about your order
The pack purchased, amount charged, currency, and any PalmaCoins spent or earned
Your payment receipt — a photo or PDF of the transfer confirmation you upload after paying, which we use to verify and confirm your payment

Technical information

We use your IP address to guess your country when you first set up your account (via a CDN header, or, if that isn't available, a one-off lookup against country.is) — you always confirm or change the result yourself. We also log errors that occur while the site is running (see “Cookies & local storage” below for what that can include).

2. How we use your information

To create and secure your account, and to sign you in
To process, deliver, and let you track your orders
To verify payment receipts and confirm orders
To calculate and credit PalmaCoins rewards and redemptions
To show your order in the currency and using the payment methods available in your country
To respond when you contact support
To detect fraud, abuse, and diagnose errors

We do not use your data for advertising, and we do not sell it to anyone.

3. Who we share information with

We share data only with the services that make Palma work, and only what each one needs:

Supabase — our database, authentication, and file storage provider. Nearly everything described in this policy is stored with Supabase.
Vercel — hosts the site and processes each request, including your IP address and country header.
Google — if you choose “Continue with Google”, Google shares your name, profile picture, and email with us to create or sign in to your account.
Telegram — if you use “Continue with Telegram”, Telegram's own login widget shares your Telegram ID, name, username, and profile photo with us. See the next section for the separate way Telegram is used for order processing.
The Central Bank of Uzbekistan's public exchange-rate feed is queried to display currency conversions — we send it no personal data at all.

4. Order notifications sent to our Telegram chat

Palma is fulfilled manually. When you submit a payment receipt, an automated message is sent to our order-management Telegram chat so our team can review and confirm it. That message includes your name (or username), email, chosen contact handle, Player ID and nickname, the amount and currency charged, any PalmaCoins used, a link to review the order in our admin panel, and the receipt image or file you uploaded, accessible via a link that expires after 7 days. This is how every order on Palma gets confirmed — there is no way to submit a receipt without it.

5. Reviews

The reviews shown on our homepage are pulled from a public Telegram group, not from a form on the site. If you post in that group, your message and the display name attached to it may be shown publicly on palma-uc.store. We store your Telegram user, chat, and message IDs internally to prevent spam and duplicate imports — these IDs are never published. We can hide or remove a published review on request.

6. Cookies & local storage

Palma does not run analytics, advertising, or tracking scripts, and does not use cookies for marketing — which is why you won't see a cookie-consent banner here. The only cookies we set are strictly necessary to keep you signed in (managed by Supabase Auth). We also use your browser's local storage, only to make the app work smoothly:

A cached copy of your profile, so pages load instantly (never your password or sign-in token)
Your in-progress checkout details, so a half-finished order survives a page refresh
Your chosen country/currency and, for admins, a display-currency preference
A small flag noting whether you're signed in, used only to render the right navigation on first load

You can clear this at any time by clearing your browser's site data; it will simply be rebuilt the next time you use the site.

7. How long we keep your data

We keep your account and order history for as long as your account exists, since orders are financial records. Payment receipts are kept as permanent, unmodifiable proof of payment and are not deleted, even if an order is later cancelled or refunded. If you close your account, we retain the minimum order records required for our own accounting and dispute resolution.

8. Your choices

You can edit your username and profile details at any time from your account page.
Your country is set once during onboarding; after that, changing it goes through support, since it affects orders already placed.
You can link or unlink Google, Telegram, and email/password sign-in from your account, as long as one method always remains.
You can ask us to access, correct, or delete the personal data we hold about you (with the exception of records we're required to keep, like completed order and payment receipt history) by contacting us — see “Contact us” below.

9. Children's privacy

Palma is intended for users aged 16 and over. If you are under 16, you may only use Palma with the consent and involvement of a parent or legal guardian, who is responsible for any purchases made. We do not knowingly collect personal data from children outside this arrangement; if you believe a child has provided us data without appropriate consent, contact us and we will remove it.

10. Security

Your session is protected by a secure, HTTP-only cookie rather than being stored in your browser's local storage. Access to your data in our database is restricted by row-level security policies, so you can only see your own orders and information (an administrator can see what's needed to run the store). Payment receipts are stored in a private file store that only you and administrators can access. Palma never sees or stores your card number or bank credentials — payment is a transfer you make yourself from your own bank or card app, and you only ever send us a receipt confirming it happened.

11. International data transfers

Because we rely on Supabase, Vercel, Google, and Telegram, your data may be processed on servers located outside Uzbekistan. Each of these providers maintains its own safeguards for handling data internationally.

12. Changes to this policy

We may update this policy as Palma changes. We'll update the “Last updated” date above when we do, and if a change is significant we'll let you know through the site.

13. Contact us

For any question about this policy or your data, including access, correction, or deletion requests, reach us at mutalovalish@gmail.com or via our support Telegram.