Privacy Policy

We keep the amount of data we hold deliberately small.

• Account information. Your email address, a password (stored only as a secure hash by our authentication provider), a display name, an automatically generated username and, if you add one, a profile picture. If you sign in with Google we receive your email address, name and profile picture from Google.
• Content you share. The photos you post, the groups you create or join, group names and invite codes, and the emoji reactions you give.
• Preferences. Theme and dark mode choice, notification settings and frequently used emoji (stored on your device).
• Subscription information. If you buy Pixchat Plus we store your plan, status, renewal date and the identifiers returned by the payment provider or Google Play. We never see or store your card details.
• Support and feedback. Anything you send through the feedback form, including an optional screenshot, your email address, the page you were on and basic device/browser information.
• Technical and usage data. Aggregated, privacy-friendly analytics such as page views, approximate country, device type and referrer, plus security logs and error reports needed to keep the service running.

Pixchat is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect their information.

• To create and secure your account and sign you in.
• To store and show your photos and reactions to the groups you belong to.
• To send in-app activity notifications you have switched on.
• To provide, bill and restore Pixchat Plus subscriptions and add-ons.
• To answer support requests and act on reports of inappropriate content.
• To detect abuse, prevent fake accounts and keep the service reliable.
• To understand overall usage through aggregated analytics.

Where the GDPR applies, we rely on: performance of a contract (running the service you signed up for), our legitimate interests (security, abuse prevention, understanding overall usage), your consent (optional features such as notifications or attaching a screenshot) and legal obligations (for example tax records for purchases). We do not sell your personal data and we do not use your photos for advertising.

• Photos are uploaded to private storage. They are only readable by members of the group you posted them to, through short-lived signed links; they are never publicly indexed.
• Camera and photo library access is used only when you choose to share a picture. The app does not scan or read your gallery in the background.
• Before a photo is stored it is checked automatically to keep Pixchat about moments rather than written messages, and to screen obviously unsafe content. This check is performed by an AI service on the image itself and the result is not used to profile you.
• Deleting a photo removes it from the group and schedules the stored file for deletion.
• Photos are not used to train third-party models by us.

Pixchat has no text messaging, comments or captions. The only way to respond to a photo is a single emoji reaction, so there are no message contents for us to collect or store.

Communication from us is limited to:

• Account emails such as verification, password reset and important service notices.
• In-app activity notifications (new photos, reactions, group joins) you can turn off in Settings.
• Replies to support requests or feedback you send us.

We do not send marketing email unless you explicitly ask us to.

• Account data is kept while your account is open.
• Photos and reactions are kept until you delete them, the group is deleted, or you delete your account.
• Feedback and support messages are kept for up to 24 months.
• Purchase and billing records are kept as long as tax and accounting law requires.
• Aggregated analytics contain no directly identifying data and may be kept indefinitely.
• When you delete your account, your profile, photos, reactions and notifications are removed, and backups containing them expire within 30 days.

• All traffic is encrypted in transit with HTTPS/TLS; data is encrypted at rest by our hosting provider.
• Passwords are never stored in readable form.
• Row-level database rules mean a request can only reach data belonging to the requesting account and its groups.
• Photo files are private and reachable only through expiring signed links.
• Email verification, rate limiting and lockout after repeated failed sign-ins protect against fake and brute-forced accounts.

No service can promise perfect security. If a breach affects your personal data we will notify you and the relevant authority as required by law.

Depending on where you live (in particular under the GDPR in the EEA/UK), you have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent at any time and complain to your local data protection authority.

• Edit your profile and notification choices in Settings at any time.
• Delete individual photos from any group you posted to.
• Delete your entire account, including your photos, from Settings → Delete account.
• For access, correction, export or any other request, email admin@forgegroup.world. We respond within 30 days.

We share data only with the providers needed to run Pixchat:

• Supabase — database, authentication and photo storage.
• Google Sign-In — optional sign-in, when you choose it.
• Google Play Billing — subscription purchases made in the Android app.
• Stripe — subscription payments made on the web.
• AI image screening provider — automated checks on uploaded photos.
• Hosting, CDN and privacy-friendly analytics providers — delivery, uptime and aggregated usage statistics.

These providers act on our instructions and may process data outside your country, including in the United States, under appropriate safeguards such as the EU Standard Contractual Clauses. We may also disclose data where legally required, or to protect the rights and safety of our users.

Pixchat uses local storage and essential cookies to keep you signed in and remember preferences such as dark mode and frequently used emoji. We do not use advertising or cross-site tracking cookies.

We may update this policy as the app changes. The date at the top always shows the current version, and significant changes will be announced in the app.

Questions, privacy requests or reports about Pixchat: admin@forgegroup.world. You can also use the feedback form.