Every premium and members-only resource for $9.99/month, as a no-commitment subscription. See the plans

PalateKit

Sign in
Menu

Request a resource

Describe the resource you are missing in one sentence. We will email you when it is published.

0 / 280

A page, a video or an image online.

Unlock PalateKit

Unlock everything

Plan

Paying means accepting our terms of sale.

Secure payment by Stripe. Receipts and invoices sent by email.

Welcome back

Sign in to install, download or save this resource. A free account is enough for free resources.

Privacy policy

Last updated: November 4, 2026.

Who processes your data

PalateKit, 61 rue de Lyon, 75012 Paris (see the legal notice). Contact: contact@palatekit.com.

What we collect and why

  • Your email address, language and the date of your consent, when you subscribe to the newsletter (from the footer, or from your settings if you have an account: the subscription is then linked to your account). Purpose: sending you the newsletter (new resources and PalateKit news). Legal basis: your consent.
  • Your IP address (and, for some actions of your account, its identifier), to limit abuse (too many attempts) and check that you are not a bot. Legal basis: our legitimate interest in protecting the service. An automated task deletes it about 24 hours after your last attempt.
  • Server technical logs (IP address, requested page, date), for security and troubleshooting. They are kept for one year at most. Legal basis: our legitimate interest in securing the service.
  • Cookieless audience measurement (Umami, running on our own server): page views and a few events carrying no data about you (signup sent, checkout started and the chosen offer, purchase confirmed and the offer, download or copy with the resource type, CLI install with the resource type). No cookie or identifier is stored in your browser, your IP address is not kept, URL parameters are not sent, and your browser's "Do Not Track" setting is honoured. No third party has access. Purpose: knowing which pages and resources are useful. Legal basis: our legitimate interest; audience measurement exempt from consent (cookieless, CNIL guidelines).
  • Audience measurement with cookies (Google Analytics), only if you accept it: pages viewed, duration and source of visits, interactions (scrolling, clicks to other sites, searches on the site, downloads, video plays, forms started or submitted, without their content), device and browser type, approximate country or city, linked to a random identifier kept in cookies (_ga, _ga_…, 13 months, not extended by your visits). Google uses your IP address to derive the country or city, without storing it; Google signals (cross-device matching) and ad personalization are turned off. Purpose: better understanding the site's audience and where it comes from (search engines, links). Legal basis: your consent, which you can withdraw at any time from the cookies page ("Manage my choices"); refusing changes nothing in how you use the site.
  • Server error reports (Sentry): the error type, the pattern of the page concerned (not its actual address or parameters) and the technical environment. Never your cookies, request headers, form contents, IP address or email: they are removed or masked before sending. Nothing is sent from your browser. Purpose: fixing outages. Legal basis: our legitimate interest in running the service.

The site sets no advertising cookies. The technical cookies are: your language (NEXT_LOCALE, 1 year), your sign-in session if you have an account (__Secure-better-auth.session_token, 7 days, extended while you use the site) and, where applicable, security cookies set by Cloudflare to protect the site from bots. Some third-party cookies are set only with your consent: Google Analytics' (_ga, _ga_…, 13 months), for audience measurement; PromoteKit's (promotekit_referral, 60 days), if you arrive through an affiliate link and accept it, to credit your purchase to the affiliate who recommended the site; and X's, if you click "Load the video from X". Details are on the cookies page.

Your theme choice (light or dark) is kept in your browser's local storage (key theme), as is the closing of the offer banner (pk-offer-dismissed) and, if you have a paid plan, a simple flag (pk-pro, cleared when you sign out) that hides this banner as soon as the page shows, as are your last 8 searches (pk-recent-searches, which you can clear from search). None of this is sent to our server; these keys are only used to display the site.

Your account

  • Your name, email address and password, when you create an account. The password is stored hashed: nobody, including us, can read it. The creation date and the confirmation of your address are also kept. Purpose: letting you sign in and get back to your resources. Legal basis: performance of the contract between us (creating and using your account).
  • Your sign-in sessions (IP address and browser used), to secure your account. A session lasts 7 days at most without use; it is deleted when you sign out or change your password. Expired sessions and outdated links are deleted automatically every hour.
  • Sign in with Google, if you choose it: Google sends us your name, email address and profile picture, and we keep the technical tokens of this sign-in. We never receive your Google password.
  • Your profile picture, if you upload one from your settings: we shrink it (256 pixels, without the metadata of the original file, such as location) and keep it on our servers. It shows in your account menu and may be seen by other visitors where your account appears. You can remove it at any time; it is deleted with your account (a copy may remain for one hour at most in network caches).
  • Your preferences: role, output types and agents chosen when you start using your account (onboarding), and your preferred language. Purpose: suggesting resources that suit you (the “For you” rail) and writing to you in your language. You can change them from your settings.
  • Password security: when your password changes (or when a first password is added to an account created with Google), an email lets you know, with a link to choose another one if it wasn't you.
  • Your likes, saves and downloads: to show them in My resources and to measure how popular resources are (only the totals are public). Deleted with your account; a download stays counted, with no link to you.
  • Your devices connected to the CLI: when you connect the palatekit command-line tool (by approving its code on the /device page), we keep the name reported by the device (usually the machine name, as the CLI sends it), the dates of connection, last use, expiry and, if applicable, revocation, and a fingerprint of the sign-in token (never the token itself: only the CLI keeps it, on your machine, and presents it to us with each request). Purpose: signing you in from the CLI and showing these devices in your settings, where you can disconnect them. Legal basis: performance of the contract between us. A token is valid for 7 days; it is deleted 30 days after it expires or is revoked. The sign-in code shown by the CLI expires after 10 minutes and is deleted within the following hour.
  • Your installs through the CLI: the resource, its version, the target agent (Claude Code, Codex…) and the date, to count the installs of each resource over 30 days (only the totals are public). Legal basis: our legitimate interest in measuring how resources are used. They are detached from your account after one year, or when the account is deleted.
  • Your reviews: rating, comment, reasons and date, published on the resource page with your name and picture, or as “Anonymous” if you choose. You can edit or delete them; if you delete your account, they stay, signed “Deleted user”.
  • Your resource requests: the sentence and any link you send, read by our team (who may open the link) to choose the next resources and to email you when one is published. They are deleted 12 months after sending, or with your account. If you send a request before signing in, it is kept in your browser (24 hours at most) while you sign in, without being sent to us.
  • Leaked password check: when you choose a password, we check that it does not appear in known data breaches with the Pwned Passwords service of Have I Been Pwned. Only the first 5 characters of the password's SHA-1 hash are sent: never the password, your address or any data that identifies you.

Your account data is kept until the account is deleted, which you can do yourself at any time from your settings (or ask for by writing to contact@palatekit.com). Deletion erases your profile, picture, preferences, sessions, the Google connection, your devices connected to the CLI, your likes, saves and requests (your downloads stay counted, with no link to you; your installs are detached from your account; your reviews stay, signed “Deleted user”); your newsletter subscription stops and the address remains only in the suppression list described below. An account whose address is never confirmed is deleted after 30 days.

Your purchases

  • Payment is collected by Link, a Stripe service that sells on our behalf as merchant of record: Link collects the price, computes and remits taxes, and sends you receipts and invoices. For this, we send Stripe your email address, your name, your account identifier and the plan chosen. Your card details are entered directly at Stripe: we never see them. Stripe processes payment data under its own responsibility, according to its privacy policy.
  • What you bought and your entitlements: plan, amount and currency paid, dates (purchase, paid period), status (active, cancelled, refunded…) and the payment reference at Stripe. Purpose: giving you access to the resources, reminding you before the yearly subscription renews and keeping our accounts. Legal basis: performance of the contract and our legal obligations.
  • Proof of your consent: the exact text of the box ticked before payment, its date, your language and the IP address of the request. Purpose: proving your consent, in particular your waiver of the right of withdrawal for a single purchase. Legal basis: our legal obligations (French Consumer Code).
  • Your declarations of cancellation or withdrawal made online: name, email address for the acknowledgement, date and time, amount refunded. Legal basis: our legal obligations.

This information is kept for 10 years after the purchase (retention of contracts of €120 or more, article L213-1 of the French Consumer Code; accounting records, article L123-22 of the French Commercial Code). If you delete your account, your running subscriptions are first cancelled immediately, with no refund; this information is then detached from your account and anonymised (IP address, name and email erased), and deleted at the end of the 10 years. Stripe keeps on its side what the law requires of it as the seller.

How long

  • Unconfirmed newsletter signup: deleted after 30 days.
  • Confirmed newsletter signup: kept until you unsubscribe. After unsubscribing, the address is kept for 3 years at most in a suppression list, only so we never write to you again, then deleted.
  • Takedown requests (page address, reason, description, evidence, name and email): 3 years, to handle the request and keep a record of it.
  • History of your downloads and copies: 1 year, then detached from your account (it only counts towards the popularity of resources).
  • History of your installs through the CLI: 1 year, then detached from your account (anonymised).
  • Devices connected to the CLI (name reported by the device, dates, token fingerprint): tokens valid for 7 days, deleted 30 days after they expire or are revoked; CLI sign-in code: 10 minutes.
  • Proof of purchase, entitlements and declarations: 10 years after the purchase, anonymised if you delete your account.
  • Events received from Stripe (so that one payment is never processed twice): 1 year.
  • Audience measurement (Umami): 13 months.
  • Audience measurement with cookies (Google Analytics): cookies of 13 months at most, not extended by your visits; detailed data (per visitor and per event) kept 14 months at most by Google, which then keeps only aggregate statistics.
  • Error reports (Sentry): 30 days.

Who has access

  • Vercel (Vercel Inc., United States: hosting of the site) and Railway (Railway Corporation, United States: hosting of the database, and of the Umami audience measurement, which has no other recipient); transfers covered by the European Commission's standard contractual clauses.
  • Sentry (Functional Software, Inc., United States: server error reports), data stored in the European Union (Germany); any access from the United States covered by the European Commission's standard contractual clauses.
  • Cloudflare (site delivery, bot protection with Turnstile), United States, transfers covered by the Data Privacy Framework.
  • Resend (email delivery), United States, transfers covered by the Data Privacy Framework.
  • Stripe and Link (payment, taxes, receipts and invoices), Ireland and United States, transfers covered by the Data Privacy Framework and the European Commission's standard contractual clauses.
  • Google (sign in with Google, only if you choose it), United States, transfers covered by the Data Privacy Framework.
  • Google (Google Ireland Limited and Google LLC: Google Analytics audience measurement, only if you accepted it), Ireland and United States, transfers covered by the Data Privacy Framework.
  • PromoteKit (affiliate program, only if you accepted its cookie): the referral identifier and the purchase information needed to compute the affiliate's commission, United States.
  • X (playing a video posted on X, only after your click), United States.

We never sell or rent your data.

Your rights

You can access, correct or delete your data, restrict its processing, object to its processing, request its portability and withdraw your consent at any time by writing to contact@palatekit.com. Every newsletter email will also include an unsubscribe link. You can also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority. You can also set instructions on what happens to your data after your death (article 85 of the French Data Protection Act).