Effective 24 September 2026 · updated 30 October 2026 · applies to PriorStates Studio, formerly Palmtop: the app for Android and iOS, and Studio on the web at priorstates.com/palmtop
PriorStates Studio lets you build small apps with an AI and share them with people you know. It is designed so that we hold as little of your information as possible.
We operate one service, the relay at priorstates.com/relay. It exists so your phone can reach your own computer, and so people can pass apps to each other. Everything sent through it is encrypted on your device with keys the relay never has. The relay stores only the encrypted bytes, their size and time, and the random identifiers needed to route them. Shared apps and circle posts are deleted after 30 and 90 days respectively; the relay keeps standard server logs (IP address, time, request path) for up to 14 days for abuse prevention.
Links that collect answers. When you send a link to collect answers (a poll, an invitation, an order form, a sign-up sheet, a staff schedule, prices your family sends to your Price Book, a shopping list your family adds to in Grocery Run, a member's dues statement in Dues Tracker, where the member can say they paid), the relay keeps what you made and the answers encrypted with a key that is only in the link, so it cannot read them; orders are sealed to a key that only your phone holds. For each answer the relay keeps its size, its time and a random identifier of the browser it came from (for a personal link, a hash of that link's invitation instead). What you made is kept for a year after its last change, or 30 days after you close it, and you can delete it, or any single answer, at any time. If you ask the people answering to confirm their email, the relay receives the address they type only to send them a six-digit code: it keeps the code for 15 minutes and, with the answer, a hash of the address combined with your link's identifier, never the address itself. The address is inside the encrypted answer, where only you can read it. The code is sent by email through our mail provider. A page you publish from Business Page is a link of this kind too, and anyone who has its link can read the page’s content.
“Viewed” on quotes and invoices. When a customer opens a quote or an invoice you sent from Quotes & Invoices, their page tells the relay it was opened, and the relay keeps the time of that first opening with the link, so your app can show “Viewed” and when. It keeps nothing about who opened it, on what device or from where (beyond the standard server logs described above), and does not record later openings. Sending a revised document clears it, so you can see whether the new one was opened.
Questions from your customers. On the customer pages of Shop, Order Form, Bookings, Quotes & Invoices, Group Order, Waitlist and Business Page, and on a supplier's page in Supplier Quotes, a customer or supplier can ask you a question and read your replies. Each message is encrypted on the device that writes it twice: once to a key that only your devices hold, and once to a key that the customer’s browser made for this conversation and keeps, so only you and that customer can read it; other people with the same link cannot, and neither can we. For each conversation the relay keeps the encrypted messages with their size and time, the random identifier of the customer’s browser, whether each message came from you or the customer, and a hash of a random code the customer’s browser made, so only that browser can add to it or read it back. It keeps the last 50 messages and at most 64 KB per conversation, and deletes them with the link: a year after its last change, 30 days after it is closed, or when you delete it or end the conversation. Told about a reply. On their page a customer who asked a question can tap “Tell me when they reply”. It is off until they turn it on. Only then does the relay keep the push subscription their browser issued (an opaque address at Google, Apple or Mozilla, with two keys of their device), filed under a hash of that conversation’s code, with no name, phone number or message. When you reply, the relay sends a knock through it that carries no content; the customer’s browser checks with the relay whether a reply came, without reading it, and shows “New reply to your question” with your business name. The subscription is deleted when the customer taps “Turn off”, when you end the conversation or delete the link, and in any case 7 days after the customer last opened the page. A message never changes an order, booking or invoice. A new question wakes your devices like a new order, if you turned notifications on (below). The Inbox app shows the questions from all these apps in one place, on your device, after you allow it to read each app. “Continue in” WhatsApp, text, email or a call opens that app on your phone with your message filled in; what you send there goes through that service, not through us.
TV links and Studio Screen. A TV link from Menu Board or Notice Board is a link of the same kind: the relay keeps the board encrypted with a key that is only in the link, and a TV showing it asks the relay for changes and is told within about a second. PriorStates Studio Screen, our app for Google TV, keeps only the link it was given, on the TV, and loads nothing outside priorstates.com. To pair it, your phone sends the link to the TV through the relay, sealed to a key that only that TV holds; the TV deletes the sealed message as soon as it has read it. The app has no ads, no analytics and no account.
“TV last seen.” A TV showing your board also reports to you, at most about every five minutes and when you ask from the app: the time, which page of the board it is showing, the version of the board it has, and how its screen is set (landscape or portrait, its size, whether the board is on screen). The report is sealed to a key that only your phone holds, so the relay cannot read it, and it wakes nobody. The relay keeps only the latest report from each TV, each new one replacing the last, and deletes them with the board. Your app shows “TV last seen 2 min ago” and draws the page the TV says it is showing from your own copy of the board.
Studio can keep a copy of your apps’ data in your own Google Drive, so it is safe if you lose your phone and the same on your other devices. It is off until you turn it on in Settings → Your data → “Keep a copy in my Google Drive”.
What Studio can reach. When you turn it on, Studio asks Google for one permission: to use a hidden folder in your Google Drive that only Studio can see (Google calls it the app data folder). Studio cannot see, open or change any other file in your Drive.
What goes there. The data your apps keep, the apps you made yourself, and your settings. The keys of your inboxes and links go there too, locked with a recovery phrase that only you have. The copy goes straight from your device to your Google Drive and from there to your other devices. PriorStates never receives it, and never receives the access Google gives Studio: the sign-in stays on your devices.
How it is used. Only to keep that copy and bring it back to your devices. It is not used for advertising, not sold, not shared, and nobody at PriorStates reads it.
Turning it off. In the same place, turn it off; “Remove the copy” deletes the folder from your Drive. You can also remove Studio’s access in your Google Account at myaccount.google.com/permissions. Your Google Drive itself is covered by Google’s terms and privacy policy.
PriorStates Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To know how many people use Studio, the app sends one anonymous count to the relay at most once a day: "opened today", the kind of device (Android, iPhone, installed web app or browser), the app version, and whether this is the first count of the week, of the month, or ever. With it goes the list of apps from our Gallery that were opened the day before: their names only, with no times and no number of opens. Apps you made yourself are never listed: the phone checks each name against the published Gallery before anything is sent. The count carries no identifier of any kind, so it cannot be linked to you, your device, or any earlier count. The relay only adds counts up per day, per device kind and per Gallery app, and does not log the address a count came from. We may publish the totals. You can turn this off in Settings → Usage counts.
An app from our Gallery has a 💬 button. If you use it, Studio sends what the screen lists: the app's name and version, your 👍 or 👎, the words you typed, your phone's language and kind of device. In Find an App, when nothing fits, you can choose to send the words you searched with, so we know what to make next. Nothing is sent unless you press Send or Suggest. It carries no identifier and none of what is in your apps. The relay keeps the day it arrived (not the time, and not the address it came from) for 180 days, and we use it only to improve Studio and its Gallery. Please don't include personal details in what you write.
The relay also counts, from what it already holds to route traffic, how many computers run Studio for your computer and how many shared apps and circles are active. These are totals only.
Ask about Studio (the helper on our website). Some pages of priorstates.com have a box marked “Ask about Studio” that answers questions from our own pages. When you send a question, its text (with your last few questions and answers in that box, so it can follow the conversation) goes to our server, which passes it to an AI service provider we choose, under that provider’s terms, to write the answer. We do not store or log your questions or the answers, and we keep no chat history: the conversation stays in your browser tab and is gone when you close it. We keep only anonymous counts per day: how many questions were asked, in which language, whether our pages had the answer, which suggested link was followed, and how many people tapped 👍 or 👎. To limit use, our server counts questions per IP address for the hour and the day, in memory only, without writing the address down. Please don’t type personal details into the box. Answers are written by AI and can be wrong; the pages they link to are what counts.
When you share an app, a circle post, or a reply, the people you share with receive what you chose to send, including any data you chose to include and the name you typed for yourself. Please share only what you are comfortable with. Anyone who holds a share link or a circle invite can open it.
If you publish a public page, for example with My Page or Business Page, what you put on it is stored on our server readable by us and shown to anyone who opens its address. This is unlike private links, which are encrypted on your device. Publish only what you want the public to see. Publishing also means you accept our Terms of Service and Acceptable Use Policy.
Studio is not directed at children under 13 and we do not knowingly collect information from them.
Alerts and being woken. If you let servers of your own send you alerts, the relay holds an identifier for that board and, for each machine you enrol, a hashed credential and the name that machine chose. The alerts themselves are sealed on the sending machine to a key that only your phone holds, so the relay stores bytes it cannot read. If you also turn on ringing, the relay stores the push subscription your browser issued — an opaque address at Google, Apple or Mozilla, with two keys of your device's own. Push subscriptions are the only things we hold that point at a particular device; this one is used for nothing but waking Studio, and the message we send through it carries no content at all: your phone fetches and decrypts the alert itself. Turning ringing off deletes the subscription; turning alerts off deletes the board and every enrolled machine with it.
Notifications from your business apps. In Shop, Order Form, Bookings, Quotes & Invoices, Group Order, Sign-up Sheet, Waitlist, Shift Board, Supplier Quotes, Class Yearbook and Business Page you can turn on notifications of new orders, requests, replies, parties in line, staff requests, quotes, classmates' cards and messages from your page while the app is closed. They are off until you turn them on in that app. Then, for each link of that app, the relay stores the push subscription your browser issued, the same kind as above (an opaque address at Google, Apple or Mozilla, with two keys of your device's own), for at most eight of your devices per link. When someone answers, the relay sends a knock through it that carries no content and does not say which link; your device fetches the answers, decrypts them, and shows a notification such as “Shop: New order”, “Says paid” or “New question”. The notification is made on your device; neither we nor the push service see what it says. Turning notifications off in the app, or deleting the link, deletes the subscription, and the push service tells us to forget a subscription that is no longer valid.
The same notifications in the Studio app from Google Play and the App Store. From version 1.0.23, the Android and iPhone apps can show them too. When you turn them on in a business app, the relay stores, for each link of that app, the device token that Android or iOS gave Studio for this phone (Firebase Cloud Messaging from Google on Android; Apple Push Notification service directly on iPhone and iPad) and which of the two it is, for at most eight of your devices per link. The app asks for a token only when you turn notifications on, and gives it up when the last one is off. When someone answers, the relay sends the same knock through Google or Apple: a fixed message with no content that does not say which link. The app then fetches the answers, decrypts them on your phone with keys that stay on the phone (on iPhone in its own keychain, shared only with Studio’s notification extension), and shows “Shop: New order” with the app’s name and label only, never who ordered or what. If it cannot reach the answers in time, it shows “New activity in Studio” instead. Neither we, Google nor Apple see what the notification says. Turning notifications off in the app, or deleting the link, deletes the token from the relay, and the relay forgets a token that Google or Apple says is no longer valid (for example after the app was uninstalled).
A waitlist that can notify the guest. In Waitlist, a guest who joins the line can tap “Notify me” on their page to get “Your table is ready” on their phone with the page closed. Only then does the relay store the push subscription that guest’s browser issued (an opaque address at Google, Apple or Mozilla, with two keys of the guest’s device), filed under a random code that the guest’s page made and sealed inside its answer, so only the business can name it; the relay keeps a hash of that code, not the code. It keeps no name, phone number or note with it. When the business calls that party, the relay sends a knock through it that carries no content; the guest’s browser looks at the line itself and shows the notification. The subscription is deleted when the party is seated, marked as a no-show, removed or leaves the line, when the line is cleared or the link deleted, when the guest turns it off, and in any case a day after it was given. On iPhone and iPad, browsers allow this only for web apps added to the Home Screen, so in a Safari tab the guest keeps the page open instead, and the business may text them from its own phone. A screen showing the line in the shop shows only party numbers, first names or initials and party sizes, never phone numbers or notes.
A delivery photo for the customer. Delivery Route keeps a proof-of-delivery photo on your phone only. For a delivery from Order Form you can tick “Show this photo on the customer’s order page” for that one delivery; it is off each time until you tick it. Then the photo, already made small on your phone (at most 200 KB), is encrypted there by Order Form to a key that the customer’s browser made and put inside its sealed order, and the relay keeps the encrypted photo with its size and the time, under a random name that only that customer’s status mentions. Only that customer’s browser can open it; other people with the same link cannot, and neither can we. The relay deletes it 30 days after it was put there, when you undo the delivery or change the order from Done, or with the link. A customer whose order page is older than this feature has no such key, so their photo is not shown and stays on your phone.
A group FAQ made from a chat. In Group FAQ you can paste a group chat, open a chat export or add screenshots of a chat, so they contain other people's messages. Before anything is sent to the AI, your phone replaces the senders' names with labels such as P1 and blanks phone numbers, email addresses and class codes; the AI is asked to keep facts and leave out private people's names, and you check every entry before it is saved. Screenshots are read once and not kept, and the app keeps only a fingerprint of each message it has read, never the text. If you publish the FAQ as a link, anyone who has the link can read it, so share it only with your group; it works like the other links that collect answers, and questions or corrections that readers send are sealed to your phone. If you translate your FAQ or use Ask the FAQ, the FAQ's own entries (its questions and answers, never readers' messages or names) go to the AI you chose in Studio; translations are kept with the FAQ and shown on its link.
Health records in Family Health. Family Health keeps your family's insurance cards, plans, visits, claims, shots and screenings on your device, in the app's own storage. Like any app's data, they are part of your Studio backup and of the copy in your own Google Drive if you turned that on; we cannot read either. A card, a bill or a plan summary goes to the AI you chose in Studio only when you tap Read or Fill, and the app says so on that screen. Its export for another family member's phone is a file locked with a passphrase you choose; we never see it.
Group boards (Class Board). When you start a board everyone can post to, the relay keeps each post, reaction and photo encrypted with the key in the board's link, so it cannot read them; anyone with the link can. With each post it keeps its size, its time and a public key the posting browser made for that board, so that only that browser can change or delete it; it does not keep names, phone numbers or email addresses. Photos are kept 30 days, posts as long as the board: a year after the last post, or 30 days after the organizer closes it. The organizer can delete any post, hold posts for approval and block a browser's key, and deleting the board deletes everything in it. A report about a post is sealed to the organizer's key, so only the organizer reads it. The organizer's phone keeps its own copy of the board.
Deleting an app, a circle or your data in Studio removes it from your device; clearing the app's storage or uninstalling removes everything. Anything you posted to a circle can be removed from the relay by any member of that circle, and expires on its own.
We will post changes to this page. Questions: service@priorstates.com.
PriorStates Studio is made by PriorStates, United States.