Privacy Policy

1. Who we are

Pixlory is operated by its founder, an individual based in the European Union. For this website and its services, Pixlory is the data controller under the EU General Data Protection Regulation (GDPR). You can contact us about anything in this policy at [email protected].

2. The short version

• We don't store your photos. Images you upload to the pin generator are sent to our AI provider only to write your pin text, and are not saved by us.
• Most tools run entirely in your browser. The WebP Converter, Favicon Maker and pin templates never upload your files.
• We collect only what we need to run your account, take payments, enforce free limits and keep the site secure.
• Analytics only with your consent. Google Analytics loads only if you accept analytics cookies.
• We don't sell your data or use it for advertising.

3. What we collect and why

Account information

When you create an account we store your email address and, if you sign in with Google, the basic profile details Google shares (such as your name and email). Passwords are handled by our authentication provider and are stored in hashed form — we never see them.
Why: to provide your account (performance of a contract, GDPR Art. 6(1)(b)).

Plan, usage and generated pins

For signed-in users we store your plan, remaining credits, how many pins you've generated in each period, and the text the AI generated for you (title, description and alt text). We do not store the images you upload.
Why: to provide the service and apply your plan's limits (Art. 6(1)(b)).

Images you send to the pin generator

When you click Generate, the cropped image is sent from our server to our AI provider, Anthropic, to write the pin text, and the result is returned to you. We don't keep a copy of the image. Under Anthropic's commercial terms, API inputs are not used to train its models. Please don't upload images that contain sensitive personal information.
Why: to provide the feature you requested (Art. 6(1)(b)).

IP address for visitors who aren't signed in

If you use the pin generator without an account, we record your IP address and how many pins you generated that day, so we can apply the free daily limit. Our servers and hosting provider also process IP addresses briefly to deliver the website and protect it from abuse (for example, rate-limiting tool requests).
Why: our legitimate interests in enforcing fair limits and keeping the service secure (Art. 6(1)(f)).

Payments

Payments are processed by Stripe. We never see or store your full card details. We receive and store your Stripe customer and subscription IDs, your plan, and a record of each transaction (amount, date and status).
Why: to process payments (Art. 6(1)(b)) and meet tax and accounting obligations (Art. 6(1)(c)).

IndexNow Submitter

When you use the IndexNow Submitter, our server passes your domain, key and URLs to the IndexNow API, and may fetch your key file and sitemap from your site to check them. We don't store your submissions. Your domain, key and a list of recent submissions are remembered only in your own browser.
Why: to provide the feature you requested (Art. 6(1)(b)).

Analytics (only with consent)

If you accept analytics cookies, we use Google Analytics to understand how the site is used — for example which pages are visited and which features are popular. You can withdraw consent at any time in cookie settings.
Why: your consent (Art. 6(1)(a)).

Emails you send us

If you contact us, we use your email and message to reply (Art. 6(1)(f)).

4. Data that stays on your device

The WebP Converter, Favicon Maker, image cropping and pin templates run entirely in your browser — your files are not uploaded to us. The YouTube Thumbnail Downloader loads thumbnail images directly from YouTube's image servers, so YouTube receives that request from your browser. Pin templates load fonts from Google Fonts, which means your browser connects to Google's servers.

5. Cookies and local storage

• Strictly necessary: sign-in cookies and storage set by our authentication provider to keep you signed in, and your cookie choice itself. These don't need consent.
• Functional (local storage): small settings saved in your browser, such as your IndexNow domain and key, and a note that a checkout is in progress. They never leave your device.
• Analytics (optional): Google Analytics cookies, set only after you accept them.

You can change your choice at any time in cookie settings (also linked in the footer), or delete cookies in your browser.

6. Service providers we use

We share data only with providers that help us run Pixlory, and only what they need:

• Netlify — website hosting and server functions.
• Supabase — database and account authentication.
• Stripe — payment processing.
• Anthropic — AI generation of pin text from your image.
• Google — Google sign-in (if you choose it), Google Fonts, and Google Analytics (only with consent).
• IndexNow (operated by participating search engines such as Microsoft Bing) — receives the URLs you submit with the IndexNow Submitter.

We may also disclose information if required by law or to protect our rights and users.

7. International transfers

Some providers process data outside the European Economic Area, including in the United States. Where this happens, transfers rely on safeguards recognised under the GDPR, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. How long we keep data

• Account data and generated pin text: for as long as your account exists. Ask us to delete your account and we'll remove it.
• Uploaded images: not stored by us.
• IP-based usage records for visitors without an account: only as long as needed to apply daily limits and prevent abuse.
• Payment and transaction records: as long as required by tax and accounting law.
• Analytics data: according to the retention period set in Google Analytics.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• have your data deleted;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing.

To use any of these rights — including deleting your account — email [email protected] from the address linked to your account. We'll respond within one month. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We use encrypted connections (HTTPS), rely on established providers for authentication and payments, and limit access to data to what's needed to run the service. No system is completely secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires it.

11. Children

Pixlory is not intended for children under 16, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we'll delete it.

12. Changes to this policy

We may update this policy as Pixlory changes. We'll update the date at the top, and for significant changes we'll let signed-in users know by email or on the site.