Privacy policy.

Information Panlu collects

When you subscribe to Tool Platform Signals, Panlu may collect your email address, confirmation and unsubscribe tokens, subscription source, UTM fields, referrer, stated use case, care priority, owned platform and selected verdict. These fields help Panlu understand which buying decisions readers care about.

Email and subscription data

Subscriber email addresses are stored in encrypted form when the production encryption key is available. Analytics and operational events use subscriber IDs or hashed values rather than raw email addresses where practical. Confirmation and unsubscribe flows are recorded so Panlu can avoid sending to unconfirmed or unsubscribed users.

My Garage local data

My Garage v2 is stored in your browser using localStorage. It can include platform totals, exact battery and charger models and counts, tool models and categories, purchase years, battery health, warranty dates, planned Next Six purchases, projects, use intensity, budget and decision preferences. Panlu does not upload this Garage profile to its server when you save or edit it.

Clearing site data, using private browsing or changing browsers or devices can remove or separate the profile. Use the Garage JSON export to create a device-migration backup. Imports are limited to 256 KB, require Panlu Garage schema version 2, show a preview and require an explicit Merge or Replace choice. Panlu downloads a pre-import backup before applying either choice in the editor; imported changes are not written to localStorage until you choose Save locally.

Deal actions such as Watch, Already own, Not relevant, Bought and Solved are also stored only in this browser. They do not change Panlu's public BUY, WAIT or SKIP verdict. Choosing Bought does not alter My Garage until you separately confirm an exact-model migration; migrated assets remain editable and removable in My Garage.

Planner and lifecycle local data

Project Planner v2 choices are stored separately in localStorage. They can include the selected resolution for a capability gap, an exact model note, project constraints and a budget cap. Garage lifecycle fields can include asset health, status, purchase or verification dates, warranty dates, linked projects and replacement-watch choices. These local records are not uploaded merely because you edit or save them.

The unified local-data export covers Garage, Planner, private deal actions, decision receipts, saved TCO scenarios, Owner Workspace action states and Owner Evidence drafts. Schema version 4 imports remain backward-compatible with version 1, 2 and 3 exports. A full local reset removes every registered user-asset and workflow category from this browser; display preferences such as theme and compact view are operational preferences rather than user records. Bought-to-Garage migrations require confirmation; when an undo snapshot is offered, it restores the pre-migration Garage state without changing public verdicts.

Optional encrypted sync uses client-side AES-GCM with a passphrase Panlu does not receive. The sync service stores ciphertext, a hashed access token, crypto metadata and timestamps only. Losing both the passphrase and sync credential makes the payload unrecoverable; enabling sync is optional and local-first export remains available.

Operational and analytics events

Panlu records events such as subscriptions, confirmations, Signals sends, source-link clicks, review actions and health checks. Source-link click events record the page context, deal or source entity, target host and target URL so Panlu can understand which reviewed sources readers use; they do not include raw email addresses.

Owner Evidence drafts and submissions

Owner Evidence drafts are stored only in this browser. Saving a draft does not send it to Panlu, create a human-review task or make a public claim. Local drafts are included in the unified export, restore and full-reset contract, and can be edited or deleted from the Community page.

Panlu offers a separate Send for human review step. Before sending, the page shows the transmitted fields, consent version, retention boundary and correction path. A successful submission returns a server receipt and a private status credential, then enters moderation; without that receipt, the record remains a local draft. The server stores only a one-way hash of the status credential. The browser keeps the credential in the local record and export so you can refresh submitted, needs-evidence, verified, rejected or closed status without exposing the observation through a public receipt lookup. Deleting the browser copy removes that local lookup credential but does not delete the server submission.

Evidence and review workflows

Panlu stores source references, price observations, evidence snapshots, intelligence artifacts and review tasks. These records are about products, sources and editorial decisions, not about building personal profiles of readers.

Third-party services

Panlu runs on Cloudflare services including Workers, D1, R2, KV, Queues, Turnstile, Access and Email Sending. Email delivery, security checks and hosting may involve Cloudflare processing operational data required to provide those services.

Your choices

Every Tool Platform Signals email should include an unsubscribe link. You can unsubscribe at any time. If you need subscription data removed or corrected, contact Panlu through the reply address shown in Signals emails.

Data retention

Panlu keeps operational data as long as it is useful for product operation, review trails, security, debugging, legal compliance or product validation. Evidence records may be retained to preserve public claim traceability.

Last updated: July 13, 2026. This page is an operational privacy policy and is not legal advice.