Privacy Policy
Effective 8 October 2026 · Last updated 8 October 2026
PixPicker is a photo-culling app for Android and Windows. It looks at the photos you point it at and tells you which ones are worth keeping.
Your photos never leave your device. Every part of the analysis — sharpness, exposure, duplicate detection, face grouping, scoring — runs locally using models bundled inside the app. There is no upload step, no cloud processing queue, and no server-side copy of your library. This is an architectural fact about how the app works, not just a promise.
This policy is published by Shanu Dengre, Katni, Madhya Pradesh, India ("we", "us"), who is the data controller — the Data Fiduciary, under India's Digital Personal Data Protection Act — for the limited account and billing information described below. Questions: support@pixpicker.com.
Grievance Officer. Shanu Dengre, reachable at support@pixpicker.com. If you are in India and we have not answered a privacy request to your satisfaction, this is the person to escalate to, and after them the Data Protection Board of India.
This service is for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone younger, and we do not offer the verifiable parental consent that would be required to.
What stays on your device
All of the following is created on your device, stored on your device, and never transmitted to us or to anyone else:
- Your photos, and any thumbnails the app generates from them.
- The capture date, read from each photo's EXIF header so the app can group a shoot by when it happened. That single field is the only thing the app reads out of EXIF — it never reads GPS coordinates, camera settings or any other EXIF tag, on your device or anywhere else. Location data in your photos is simply not looked at.
- The numerical fingerprints the app computes to compare images — image embeddings, face embeddings, perceptual hashes, and quality scores. These are stored in a local cache database so a second run is fast.
- Your selections, keeps, drops and exported albums.
Uninstalling the app removes all of it. On Android you can also clear it without uninstalling, from Settings → Apps → PixPicker → Storage → Clear storage. Albums you exported are yours and are written where you chose, so those stay — uninstalling the app does not reach into your own folders.
Used without an account, PixPicker sends us nothing about you or your photos. The analysis is entirely offline. Everything in the next section applies only once you choose to sign in.
Said precisely, because the difference matters: if the app was built with a server address, it asks that server for its own current settings at launch and every six hours — the announcement banner, whether a newer version exists, the price list. That request carries no account, no identifier and no information about you, but like any web request it reaches us from your IP address. It is the only thing a signed-out installation sends.
What we receive when you sign in
Signing in is optional and exists so a purchase follows you between your phone, your desktop and the web app. When you have an account we hold:
| Data | Why | When |
|---|---|---|
| Email address | Identifies your account, and receives the link that confirms your address, password-reset links, and notices about your account's security — a password change, a sign-in from a device we haven't seen, sign-in being locked after repeated failures. Those notices are not optional: they are how you find out if somebody else is using your account. | At sign-up. |
| Recognised devices | So you are asked for an emailed code once per device instead of every time you sign in. We keep a random identifier your browser or app generated — not a fingerprint of your hardware, and nothing we could use to recognise you anywhere else — stored scrambled, with the IP address it was last used from and the date. Clear it yourself any time from Account → Devices on this website — there is no equivalent control inside the app yet — and it also goes when you delete your account. | When you verify a new device. |
| Billing documents | An invoice for each purchase — the date, what you bought, the amount and an invoice number. Tax law requires us to issue and keep these. They are stored with our document provider, not inside the app, and are fetched only when you ask to download one. | When you buy something. |
| Password | Authentication. Stored only as a salted hash — never the password itself. Accounts created on this website or in the app are held by our identity provider, Supabase, which keeps that hash; the few accounts made directly with us are checked against a hash we hold. Either way it cannot be turned back into your password, and nobody here can read it. | At sign-up. |
| Activity records | So we can see aggregate usage and catch abuse of the service. Each record contains: which action ran (for example "select" or "export"), how many images it handled, a status, a short text note, the platform, your account email, your IP address, and the time. It never contains an image, a filename, a thumbnail, or anything derived from the content of a photo. | Each time an analysis or export finishes while you are signed in. |
| Subscription and purchase state | To unlock the tier you paid for on every device you sign in on. | When you buy or restore a purchase. |
| Phone number | An alternative to an email address for accounts created by phone. Such an account has no email at all, and the number then receives the same codes and notices an address otherwise would. Phone sign-up is currently switched off and no account can be created this way today; it is described because the capability exists and could be enabled. | At sign-up, if you sign up by phone. |
| Country | Only the country you pick yourself on the billing page, kept so prices stay in your currency between visits. It is not derived from your address or your device, and it is not used to identify you. | When you choose one while buying. |
Activity reporting is best-effort: if it fails or you are offline it is dropped and never retried, and it never blocks or delays the analysis.
What we never collect
- We do not collect your photos, or anything computed from their content.
- There is no advertising SDK, no advertising identifier, and no cross-app or cross-site tracking. We do not sell or share personal information for advertising, and we never have.
- The only third-party SDK bundled in the app is RevenueCat's, which validates Android in-app purchases and is present only in builds configured for it. Everything else the app talks to, including sign-in, it talks to over plain HTTPS with no vendor SDK in between. There is no analytics SDK and no advertising SDK.
- We do not collect your device's location, contacts, calendar, microphone or camera. The app requests photo-library access, and on Android 13 and newer you can grant access to selected photos only.
- We do not knowingly collect anything from anyone under 18. India's DPDP Act treats everyone below that age as a child and requires verifiable parental consent before their data may be processed; rather than build that, we do not offer the service to them. If you believe a child has created an account, contact us and we will remove it.
Who else processes your data
These providers act on our behalf, only for the purposes below:
| Provider | Receives | For |
|---|---|---|
| Supabase | Your email address or phone number, your password, session tokens | Authentication and one-time codes, for accounts it holds. Your password goes to them directly from your device and is never seen by us. Accounts held by us are authenticated without Supabase, and their codes and reset links are issued by this service |
| Google, Microsoft | The fact that you signed in, if you use their button | Optional sign-in. Choosing "Continue with Google" or "Continue with Microsoft" tells that provider you are using PixPicker, and returns your email address to us through Supabase. Not used if you sign in with a password |
| RevenueCat | Your store purchase token and your PixPicker account id | Validating in-app purchases on Android. The account id is the real one, not an anonymous substitute — it is what lets a purchase made in the app unlock the same account on your desktop |
| Stripe | Your email address, your PixPicker account id, what you are buying, any promo code and your country — plus the card and billing address you give Stripe directly | Web and desktop purchases. We never receive your card number, and we store neither the card nor the billing address; of what Stripe collects, only the country comes back to us |
| Google Drive | Your invoices — your email address or phone number, what you bought, the amount | Storing billing documents in a folder we own. Not your Drive, and your photos are never sent there |
| Zoho Mail | Your email address and the content of the message | Delivering password-reset links and codes, security notices (a password changed, a sign-in from a new device, sign-in locked after repeated failures), order confirmations and support replies |
| Cloudflare | Every request to this website and from the app, including your IP address | Defending the service and routing traffic. The IP addresses recorded elsewhere in this policy are the ones Cloudflare passes to us, so it necessarily sees them first. It also tells us which country a request came from, so prices are shown in the right currency |
| Vercel | Every request to the website and to the account service the app uses, including the contents of sign-in and contact forms | Running the website and the service behind it. It processes those requests but does not keep your account data; that is held in the database below |
| Supabase (database and sign-in) | Everything above, at rest | Running the service |
| Supabase (managed database backups) | A continuously updated copy of the account database — which is to say everything in the tables above: accounts, activity records and the IP addresses on them, recognised devices, contact messages, invoice details | Backups, so an outage doesn't lose your account. Never contains photos, because we never had any |
We will also disclose data if legally compelled to, and will tell you unless we are prohibited from doing so.
How long we keep it
- Account records — for as long as your account exists.
- Activity records, and the IP addresses on them — for as long as your account exists, and deleted with it. This sentence is generated from the setting the service actually enforces, so it cannot drift away from what happens.
- Recognised devices — until you clear them from Account → Devices, or until the account is deleted.
- Messages you send us through the contact form — see the section below. They are not attached to an account, so deleting an account does not reach them.
- Unused sign-in codes and reset links — minutes. They expire by the clock, are single-use, and the spent rows are cleared out automatically.
- Payment records and invoices — as long as tax and accounting law in India requires, typically 8 years, even after the account is closed. This is the one category we cannot delete on request: an invoice sequence has to stay complete, and removing one would break it.
If you write to us
The contact form is the one place you can give us personal data without having an account, so it is worth describing on its own.
When you send it, we keep the name, company, email address, the message you wrote and the IP address you sent it from. We also:
- email the whole enquiry to our support mailbox, so a person can read and answer it;
- email a copy back to you, so you have a record of what you sent.
Our basis for this is the legitimate interest of answering people who ask us things, and in most cases taking steps you asked for before entering a contract.
Because it is not attached to an account, deleting an account does not delete it. If you want a message erased — whether or not you are a customer — email support@pixpicker.com and say so; we delete the message, the address and the IP outright rather than marking it handled. Messages are also swept automatically once they pass the retention period we have configured.
Your rights, and deleting your account
Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it, and we will not charge you or treat you differently for asking.
If you are in India, the Digital Personal Data Protection Act gives you the right to access a summary of your data and what we do with it, to have it corrected or completed, to have it erased, to nominate someone to exercise these rights if you die or become incapable, and to a grievance procedure — which is the Grievance Officer named at the top of this page, and after them the Data Protection Board of India.
If you are in the EEA or the UK, the GDPR gives you the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time where we rely on it, and the right to complain to your national supervisory authority.
Our lawful bases, purpose by purpose:
| What | Why | Basis |
|---|---|---|
| Your account and sign-in | So the tier you paid for follows you between devices | Performance of our contract with you |
| Invoices and payment records | Tax law requires us to issue and keep them | Legal obligation |
| Activity records, recognised devices, the IP addresses on both | Noticing a stolen account, stopping credential stuffing, keeping the service usable | Our legitimate interests in security. We weighed this: the records hold no photo, nothing derived from one, and no filename, and they are what tells you somebody else signed in as you. We think you would expect it; if you disagree you may object |
| Security emails | Telling you about a password change or a sign-in from a new device | Legitimate interests, and in part legal obligation — you cannot opt out of being told your account may be compromised |
| Messages you send the contact form | Answering you | Legitimate interests, or steps before a contract |
No automated decision-making. Nothing here profiles you or makes a decision about you by machine. The app's scoring looks at photographs and runs on your own device; it never looks at you.
You can delete your account yourself, immediately, at /delete-account or in the app under Account → Delete account. There is no waiting period and no undo. It removes:
- Your email address.
- Your sign-in credentials, including the copy held by our identity provider — and the response tells you whether that upstream deletion actually succeeded, rather than assuming it.
- Every activity record, and the IP addresses on them.
- Every recognised device, and any sign-in code or reset link still outstanding.
- Your plan and any entitlement attached to it.
Invoices and payment records are the exception, as described above: we are required to issue and keep them, and an invoice sequence has to stay complete.
Said exactly, because it is the one place where deleting your account does not make you unfindable: the database row keeping the payment is detached from your identity, but the invoice document itself still carries the email address or phone number it was issued to, because that is what makes it a valid invoice. We cannot alter it after the fact for the same reason we cannot delete it. What we can tell you is that it contains nothing else about you — no name you did not give us, no address, no card details.
If you can't sign in, email support@pixpicker.com from your account's address, or use the contact form, and we will do it for you within 30 days.
Uninstalling the app removes all locally cached analysis data immediately, whether or not you ask us to delete your account.
Where your data goes
We are based in India. The service runs on Vercel and its database is held by Supabase, and they, like Stripe, RevenueCat, Google, Zoho and Cloudflare, operate internationally, so account and billing data may be processed on servers outside India and, for people in the EEA, outside the Union.
Where that happens for EEA data we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one covers the country concerned. You can ask us which applies to a particular provider.
None of this applies to your photographs, which do not travel at all.
Security
Traffic between the app and our service is encrypted in transit. In the app, your sign-in token is held in the operating system's own protected credential storage rather than in plain text; on this website it is held in your browser's local storage for the site, which is ordinary for a website but is worth knowing is a weaker place. Passwords are stored only as salted hashes, by us or by our identity provider, and nobody here can read one.
No system is perfectly secure, but the amount of your data we hold is deliberately small: the design goal is that a breach of our servers would expose no photographs, because we never had any.
Changes to this policy
If we change this policy we will update the date at the top, and for any change that materially affects your rights we will tell account holders by email before it takes effect.