Pallas
Data read and purpose
With the access you authorize, Pallas can read account identifiers and metadata, available advertising metrics such as spend, impressions and clicks, date ranges, campaign/ad-group information, and permitted goal, event, creative or landing-page context. Fields differ by provider and permissions. It also processes files or host-captured evidence you choose to supply.
The data supports account discovery, reviewing account history within a set range, local calculations, evidence review and HTML reports. Missing fields and source errors may be recorded alongside results. Pallas does not use this read path to modify advertisements and does not call a language model itself.
For Google Ads, Pallas requests https://www.googleapis.com/auth/adwords to discover accessible advertising accounts and read account settings, campaign information and available performance metrics for the analysis and dashboards you request. Google Ads API uses this scope for reporting as well as account management and does not provide a separate read-only reporting scope. Pallas uses it to read advertising data; it does not create, edit or delete your Google Ads campaigns, ads, bids or budgets. This authorization does not request access to Gmail messages, Google Drive files or Google Calendar events.
Data storage and protection
The selected workspace, commonly under .pallas, contains profiles, connection metadata, local databases, raw evidence, logs and reports. Host-captured evidence and exported HTML reports may create additional files. Copies, downloads and backups can exist outside the workspace.
Pallas protects Google authorization credentials and advertising data through the following mechanisms:
Remote Google authorization, token exchange and advertising API requests use HTTPS with certificate validation. The local runtime restricts API requests to approved provider endpoints and rejects redirects.
Google browser authorization uses PKCE (S256) and a random state value checked on return. A temporary callback receiver listens only on your computer's loopback interface. The local HTTP callback carries the authorization response; token exchange happens separately over HTTPS.
Pallas-managed access and refresh tokens are stored in the operating system credential store, such as macOS Keychain or Linux Secret Service, under its access controls. Pallas does not silently fall back to a plaintext token file when that store is unavailable. Explicit external environment references remain user-managed; authorizations owned by an agent host remain under that host's controls.
Pallas filters recognized credential fields and known secrets from retained source evidence and uses sanitized errors. This filtering is not anonymization: account identifiers, campaign names and metrics can remain in reports and tool outputs.
Local databases, evidence files and exported reports are not encrypted by Pallas itself. Their protection depends on your device's user accounts, file permissions, disk encryption and any backup or sync services you enable. Limit access to your workspace, enable device encryption where appropriate, and review files before sharing them. Credential storage, workspace files and host-held copies require separate cleanup.
Data sharing, transfers and disclosures
Google user data, including results derived from it, can be disclosed to the following recipients for the purposes described here:
Google receives the authorization, token and API requests needed to connect your account and return the data you request. Other connected media platforms receive their own authorization and data requests; Pallas does not upload Google Ads reports to Meta or TikTok as part of these connections.
The agent host you choose receives Pallas tool outputs. When you use Codex with an OpenAI-hosted model, OpenAI may process outputs containing account identifiers, metrics, summaries or report contents to answer your request. When you use Claude Code with an Anthropic-hosted model, Anthropic may process those outputs. If you configure another model endpoint or hosting provider, that selected provider may receive them instead. Pallas itself does not operate a model service or make those model requests. Conversation history, retention and training settings depend on the host, provider, account and configuration you use; review them before using Google data with that service.
People and services you choose can receive reports or evidence when you export, upload, email or share them. Device backup or file-sync services you enable may also receive local copies. Pallas does not automatically publish your reports.
If you voluntarily send information to support, the operator, Jieyi Deng, and the services delivering the support email receive your message and attachments to handle the request. Normal local use does not send the operator your Google Ads data or tokens. The operator accesses support material you choose to provide, and may disclose operator-held information when required by law or necessary to investigate a security incident.
Pallas uses Google user data to provide the account analysis and reporting features you request. Pallas does not sell Google user data or use it for advertising targeting, data brokerage, credit decisions or training generalized AI models. These restrictions also apply to aggregated and derived Google data. Local storage does not prevent your chosen host or model service from receiving tool outputs; Pallas does not control that service's settings. See the Google API Services User Data Policy for Google's requirements, including Limited Use.
Website and support email
The public website is hosted on Cloudflare Pages. Cloudflare processes request information needed to deliver and protect the site, which can include IP addresses and request metadata. See Cloudflare's privacy policy. Pallas adds no analytics tracking script by default.
For Pallas-managed Meta browser login, Meta redirects a short-lived authorization code and random state through the Pallas HTTPS callback on this website. These URL parameters pass through Cloudflare before the browser forwards them to a temporary receiver on your computer. The callback page adds no analytics, cookies, local storage or token exchange and clears its URL query before leaving. Hosting request processing is governed by Cloudflare; browser no-store instructions do not erase hosting logs. The private PKCE verifier stays on your computer, where the code is exchanged for tokens and stored in the operating system credential store. Advertising reports and account data are not sent to this callback. Google's browser callback stays local.
If you email support, the operator and email service process your sender address, message and any attachments to handle the request. Support email is voluntary; ordinary local operation does not automatically send the operator your reports or feedback archives. Do not email secrets or unredacted account data.
Retention, revocation and deletion
There is no single automatic retention period for all local data. Some raw evidence has retention metadata and explicit pruning behavior; that does not erase every database, report or copy on a timer. Files and host-held data can remain until separately removed.
You can revoke platform authorization, disconnect Pallas-managed connections, clear host-managed access and delete local files. Follow Data deletion for the separate steps. Contact support about operator-held correspondence. The operator cannot remotely erase your device or data held by another provider.