Privacy Policy
What we collect, why, and the choices you have.Last updated 6 November 2026
Draft — this policy is pending legal review and may change before launch.
What we collect
Account details: your name, email address and profile photo from Google or Apple, or the name and email you give when signing up with email and password. Apple private-relay emails are supported. Passwords are handled by our sign-in provider (Firebase Authentication) and never stored by us in readable form.
Content you provide: product photos, brand kits, prompts and generated images, and any feedback you send us.
Usage and billing records: credit history, subscription status and payment references (never card numbers).
Limited technical data such as IP address for security and fraud prevention.
If you turn on notifications on a device: a notification address for that browser (no device contents). Turning them off or signing out removes it.
When you sign up we record which version of our Terms you accepted and when.
How we use it
To provide the service, process payments, prevent abuse, support you, and improve reliability.
We do not use your private uploads or creations to train or fine-tune AI models unless you separately opt in, and we never use them in public examples without your permission.
Analytics events don't include your prompts, images or private text.
Who we share it with
Infrastructure and AI processing providers (for example Google Cloud/Firebase and Replicate) only as needed to run the service; payment processors for billing. They process data under their own terms and security practices, which we don't control.
Notifications you turn on are delivered through Google's Firebase Cloud Messaging and contain only a short notice (never your prompts or images).
Inputs sent to AI providers are processed under their data-retention terms (for example, Replicate removes prediction files after a short retention period).
We may disclose information if required by law, to protect our rights, users or the public, or as part of a reorganisation, merger or sale of the business.
Where it's stored
Data is stored primarily in Google Cloud's Mumbai region (asia-south1). Some providers may process data in other countries.
Security
We use reasonable technical and organisational safeguards, including encryption in transit, access controls and private storage. No system is completely secure, so we can't guarantee the security of information sent over the internet. Keep your sign-in details safe and keep your own copies of important files.
Your choices
Delete individual images, download a copy of everything we hold about you, or delete your account from Settings.
Share links are opt-in; you can see every active link and turn it off in Settings at any time. If you choose to add your invite link, the shared page shows only your referral code, not your name or email.
Device notifications are off until you turn them on, per device, in Settings.
Location metadata is stripped from uploaded photos.
Retention
Your products, brand kits, images and campaigns: until you delete them or your account.
Feedback you send from Help & feedback: until you delete your account. A copy, with your name, email, plan and credit balance, is emailed to our support inbox so we can reply; support emails are kept as long as needed to handle your request.
In-app notifications: 90 days.
Usage events (which features are used — never prompts, images or personal text, and linked to a pseudonymous ID): about 13 months, and removed when you delete your account.
Share links: removed after they expire or are turned off.
Photos you upload but never use in a product or brand kit may be removed after about a day.
Short-lived counters used to prevent abuse: up to two days.
Records of actions our team takes on an account (for example a refund or a suspension for abuse), with the reason: kept for accountability and fraud prevention, as the law allows.
Billing records, consent records and the credit ledger: as long as the law requires, without your creative content.
When you delete your account: a short record of the deleted account — your email address, sign-in methods, account dates, plan, credit totals and how many images, products and brand kits you had — for 8 years, for accounting and audit and to prevent misuse of free credits. It never includes your name, images, prompts, products or brand kits.
Children
PixelArtist is not meant for anyone under 18, and we don't knowingly collect their data. Contact us if you think a child has used it.
Changes
We may update this policy and will notify you of material changes.
Contact
Privacy questions: support@pixelartist.ai.