Privacy Policy

Last Updated: July 17, 2026  |  Effective Date: July 17, 2026

This Privacy Policy describes how PixPlace Space(“PixPlace,” “we,” “us,” or “our”) collects, uses, discloses, and protects your personal data when you access or use pixplace.space, our Android mobile application, our Creative Studio at app.pixplace.space, and any related services (collectively, the “Platform”).

Please read this Policy carefully. By using the Platform, you acknowledge that you have read and understood this Policy and agree to the collection and use of information as described herein. If you do not agree, please discontinue use of the Platform.

Table of Contents

1. 1. Who We Are
2. 2. Scope of This Policy
3. 3. Information We Collect
4. 4. How We Use Your Information
5. 5. Legal Bases for Processing (GDPR)
6. 6. Sharing and Disclosure of Information
7. 7. International Data Transfers
8. 8. Data Retention
9. 9. Security
10. 10. Cookies and Tracking Technologies
11. 11. Children's Privacy
12. 12. Your Rights
13. 13. Jurisdiction-Specific Provisions
14. 14. AI-Generated Content and Third-Party AI Providers
15. 15. Push Notifications
16. 16. Real-Time Communications
17. 17. Affiliate and Partner Program
18. 18. Analytics and Behavioral Profiling
19. 19. Changes to This Policy
20. 20. Contact Us

1. Who We Are

PixPlace Space (“PixPlace”) is an international creative social platform that provides access to a community feed of AI-generated images and videos, encrypted messaging, real-time audio/video calls, Spaces (group content boards), Stories, a professional AI Studio for content generation, and related tools.

Contact email: [email protected]
Website: https://pixplace.space

2. Scope of This Policy

This Policy applies to:

• The PixPlace web portal at pixplace.space
• The PixPlace Creative Studio at app.pixplace.space
• The PixPlace Android application (available at pixplace.space/download)
• All API endpoints, webhooks, and integrations operated by PixPlace
• All email communications sent by PixPlace

This Policy does not apply to third-party websites, applications, or services that may be linked from our Platform. We are not responsible for the privacy practices of third parties.

3. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third parties.

3.1 Information You Provide Directly

• Account registration data: Email address, username, display name, password (hashed and managed by Supabase Auth).
• Profile data: Avatar image, biography, status message, social media links (Twitter/X, Instagram, personal website), birth year.
• Content you create: Posts, titles, descriptions, AI-generation prompts, images, videos, audio files, comments, reactions, reposts, Stories, and any other content you upload or generate through the Platform.
• Messages: The content of direct messages you send and receive through the Platform's encrypted messaging system.
• Onboarding preferences: Creative styles, professional role, and AI experience level provided during onboarding.
• Settings and preferences: Theme, language, notification preferences, privacy settings (follower visibility, contact visibility, website visibility, Spaces visibility).
• Reports: Content of reports you submit regarding other users or posts.
• Communications with us: Emails, support requests, partnership applications, and affiliate program applications you send to us.
• Push notification subscriptions: Web Push API subscription endpoint and keys stored when you opt in to push notifications.
• Payment context: Plan selection (Free, Pro, Studio) and add-on purchases. Note: PixPlace does not directly process or store payment card data. Payment processing is handled by third-party processors.

3.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, window size, CPU core count, RAM amount, GPU model, and network connection type.
• Session data: Session ID, session start and end times, session duration, last activity timestamp.
• Geographic data: Country and city derived from IP address via geolocation lookup.
• UTM and referral parameters: utm_source, utm_medium, utm_campaign when present in the URL at session start.
• Behavioral analytics events: Page views, post views (with 2.5-second dwell threshold), post likes, post shares, prompt clicks, image clicks, search queries, category clicks, profile views, video playback events, frame extraction events, and download events.
• Feed profile (behavioral preference model): A JSON object storing weighted category and tag preferences derived from your interactions, used to personalise the “For You” feed. For anonymous users, this is stored in localStorage. For authenticated users, this is stored server-side in your account record.
• Presence data: Online/offline status and last-seen timestamp, updated via periodic heartbeat signals.
• Log data: Server access logs, error logs, and API request logs.
• Cookies and local storage: See Section 10 for full details.

3.3 Information from Third Parties

• Authentication providers: If you sign in via a third-party OAuth provider (e.g. Google) through Supabase Auth, we receive your email address and name from that provider.
• AI generation providers: After you submit a generation request, third-party AI providers process your prompt and return generated media. The returned media file is uploaded to our Cloudflare R2 storage and associated with your account. We do not receive raw model weights or training data from providers.
• Email service providers: Delivery status and open/click events for transactional and campaign emails.
• Inbound email: If you email us at our domain, the message content is stored in our database for customer support purposes.

4. How We Use Your Information

We use your information for the following purposes:

• Providing the Platform: Creating and managing your account, delivering content, enabling social features (follow, like, comment, share, repost), operating Spaces, showing Stories, and enabling messaging.
• AI content generation: Transmitting your generation prompts to the selected AI provider, receiving the generated output, storing it in Cloudflare R2, and deducting Energy from your account balance.
• Personalised feed recommendation: Using your behavioral profile (category and tag weights) to rank and sort content in the “For You” feed using our proprietary scoring formula.
• Real-time communications: Enabling WebRTC audio/video calls between users, using ICE candidates and TURN server relay where direct peer connection is not possible.
• Push notifications: Sending you notifications about new messages, call invitations, likes, comments, follows, and system announcements via Web Push.
• Email communications: Sending welcome emails, product update emails, retention campaigns, and other transactional messages. You may opt out at any time.
• Security and moderation: Detecting abuse, reviewing reports, enforcing our Terms of Service, preventing fraud, and protecting user safety.
• Analytics and improvement: Understanding how users interact with the Platform, identifying bugs, measuring feature adoption, and improving product performance.
• Compliance: Complying with applicable law, responding to lawful requests from government authorities, and enforcing our legal rights.
• Affiliate program: Tracking referrals to award commissions to affiliated creators.

5. Legal Bases for Processing (GDPR)

For users located in the European Economic Area (EEA), Switzerland, or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

6. Sharing and Disclosure of Information

We do not sell your personal data. We share data only in the following circumstances:

6.1 Service Providers and Sub-processors

We engage third-party service providers who process data on our behalf:

• Supabase (supabase.com): Authentication, PostgreSQL database hosting, and realtime presence/signaling infrastructure. Supabase is GDPR-compliant and offers a Data Processing Agreement.
• Cloudflare (cloudflare.com): Media file storage (Cloudflare R2 — S3-compatible object storage), CDN, and DDoS protection. Cloudflare complies with GDPR.
• AI generation providers: Third-party AI model APIs (including but not limited to Kling AI, Flux, Qwen Image, SDXL, and others configured dynamically via our AI provider system). Your text prompts and generation parameters are transmitted to these providers to generate images or videos. Providers are selected based on model availability and your request. We encourage you to review their respective privacy policies.
• Email service providers: Used to send transactional and marketing emails on our behalf.
• Hosting and infrastructure: Our main application server is hosted on a dedicated VPS. The TURN server for WebRTC is hosted on a separate dedicated server.
• n8n / automation: An internal automation platform used to process certain webhook events and media ingestion workflows.

6.2 Other Users

Your public profile information (username, name, avatar, bio, follower counts, public posts, and Spaces) is visible to all Platform users. Content you publish in public posts or Spaces is publicly accessible and may be indexed by search engines.

Your online status and last-seen time are visible to users you follow or who follow you, subject to your privacy settings.

6.3 Legal Requirements

We may disclose your information if required by law, regulation, court order, or governmental authority; or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of PixPlace, our users, or the public.

6.4 Business Transfers

If PixPlace undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred as part of that transaction. We will notify you of any material change in ownership or use of your personal data.

7. International Data Transfers

PixPlace operates globally. Your data may be processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country.

For transfers from the EEA to third countries, we rely on:

• European Commission adequacy decisions where applicable;
• Standard Contractual Clauses (SCCs) adopted by the European Commission where required;
• Other lawful transfer mechanisms as permitted by GDPR Chapter V.

For Russian users: your personal data may be stored and processed outside the Russian Federation. Where required by Federal Law No. 242-FZ, initial collection of personal data of Russian citizens is performed on servers located within the Russian Federation or through systems that comply with localization requirements. Please contact us at [email protected] for more details.

8. Data Retention

• Account data: Retained for the duration of your account and for up to 90 days after account deletion to allow recovery and complete pending obligations.
• Content (posts, attachments, comments): Retained as long as your account exists unless you or an admin deletes the content.
• Messages: Retained until deleted by the sender or until account deletion.
• Analytics events (UserEvent table): Retained for 12 months, after which records are aggregated or deleted.
• Session data (PlatformSession table): Retained for 6 months.
• Email logs: Retained for 24 months for compliance and deliverability analysis.
• Server access logs: Retained for 30 days.
• Legal hold: We may retain data for longer periods where required by law or pending legal proceedings.

9. Security

We implement technical and organizational security measures to protect your personal data, including:

• All data in transit is encrypted using TLS/HTTPS;
• Passwords are never stored in plaintext — authentication is managed by Supabase with industry-standard hashing;
• Media files are stored in Cloudflare R2 with access-controlled buckets;
• WebRTC calls use end-to-end encrypted DTLS/SRTP channels;
• Direct messages are transmitted over encrypted channels;
• Administrative access is restricted and access-controlled;
• We monitor for anomalous access patterns and security events.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

10. Cookies and Tracking Technologies

We use the following technologies to store information on your device:

10.1 Strictly Necessary

• Supabase authentication cookies: Session tokens required to maintain your logged-in state. Without these, the Platform cannot authenticate you.
• NEXT_LOCALE cookie: Stores your preferred display language.

10.2 Functional / Preference

• px_theme (localStorage): Stores your selected UI theme (dark, light, custom). Cleared when you clear browser storage.
• px_custom_theme (localStorage): Stores your custom color theme configuration.
• feedProfile (localStorage): For anonymous users, stores your behavioral preference weights for the personalised feed. Capped at 200 viewed post IDs.

10.3 Analytics and Performance

We collect behavioral analytics directly through our own first-party system (no third-party analytics scripts such as Google Analytics). Analytics data is associated with your session ID and, for logged-in users, your user ID.

10.4 Managing Cookies

You can control cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using authenticated features. You can clear localStorage at any time through your browser's developer tools or storage settings.

11. Children's Privacy

The Platform is not directed to children under the age of 13 (or under 16 in the EEA, or under 14 in Spain/Portugal, or as required by applicable local law). We do not knowingly collect personal data from children below these age thresholds. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] and we will promptly delete such information.

Users are required to confirm they are of legal age during the onboarding process. We do not knowingly allow minors to access adult content or AI generation features.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

12.1 Rights Available to All Users

• Access: You may request a copy of the personal data we hold about you via [email protected].
• Correction: You may update most of your profile information directly in your account Settings page.
• Deletion: You may request deletion of your account and associated personal data. Certain data may be retained for legal compliance purposes.
• Opt-out of marketing emails: Use the unsubscribe link in any email or contact us.

12.2 Additional Rights for EEA/UK Users (GDPR)

• Right to access (Art. 15): Request a copy of your personal data and information about how it is processed.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure / “right to be forgotten” (Art. 17): Request deletion of your personal data in certain circumstances.
• Right to restriction of processing (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests, including profiling for direct marketing purposes.
• Rights related to automated decision-making (Art. 22): Not to be subject to solely automated decisions that produce significant legal effects.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawfulness.
• Right to lodge a complaint: Lodge a complaint with your national supervisory authority (e.g., the ICO in the UK, CNIL in France, BfDI in Germany).

To exercise your GDPR rights, contact [email protected]. We will respond within 30 days (extendable by a further 60 days in complex cases, with notice).

12.3 Additional Rights for California Residents (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties to whom we disclose it.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes other than providing the requested services.
• Right to Non-Discrimination: You will not be discriminated against for exercising your CCPA rights.

To submit a CCPA request, email [email protected]with subject line “CCPA Data Request.” We may need to verify your identity before processing your request.

13. Jurisdiction-Specific Provisions

13.1 European Union / European Economic Area / United Kingdom

PixPlace processes the personal data of EEA and UK residents in accordance with Regulation (EU) 2016/679 (GDPR) and, for the UK, the UK GDPR as implemented by the Data Protection Act 2018.

If you are located in the EEA or UK and wish to exercise your rights or have a complaint, contact our privacy team at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.

13.2 Russian Federation

PixPlace processes personal data of Russian citizens in accordance with Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” (Федеральный закон «О персональных данных» № 152-ФЗ), as amended, and Federal Law No. 242-FZ regarding data localization.

Operator: PixPlace Space (operator of the Platform)
Contact for personal data requests: [email protected]

Categories of personal data processed:

• Identification data: email, username, display name, date of birth (birth year)
• Contact data: social media links
• Profile data: avatar image, biography, status
• Technical data: IP address, device information
• Behavioral data: activity on the Platform
• Communication data: messages, comments

Purposes of processing:

• Providing access to the Platform and its features
• Ensuring security and combating fraud
• Sending service notifications and marketing communications (with your consent where required)
• Complying with applicable legislation

Consent: By registering on the Platform, you give your voluntary, specific, informed, and conscious consent to the processing of your personal data as described in this Policy, in accordance with Art. 9 of Federal Law No. 152-FZ.

Your rights under 152-FZ: You have the right to: access your personal data; request correction of inaccurate data; request deletion of your data; withdraw consent at any time (Art. 9, 14, 20 of Federal Law No. 152-FZ).

To exercise your rights, contact us at [email protected]. Requests will be processed within the timeframes established by applicable law (typically 30 days).

You may also file a complaint with Roskomnadzor (Роскомнадзор), the federal body for supervision of communications, information technology, and mass media: rkn.gov.ru.

13.3 United States

In addition to California (see Section 12.3), users in other US states with enacted comprehensive privacy laws (including but not limited to Virginia — VCDPA, Colorado — CPA, Connecticut — CTDPA, Texas — TDPSA, and others) may have similar rights to access, correction, deletion, and opt-out. Please contact [email protected] to exercise any such rights.

14. AI-Generated Content and Third-Party AI Providers

When you use the AI Studio to generate images or videos, your text prompts and generation parameters (model, format, dimensions, style) are transmitted to the selected AI model provider. Different providers may have different data handling practices. We configure providers dynamically based on availability and model selection. Key providers include Kling AI, Flux, Qwen Image, SDXL, and others listed in the Studio model selector.

Prompt data:Your prompts are sent directly to the AI provider's API. We do not control how providers use this data for model training or improvement. You should avoid including sensitive personal information in your prompts.

Generated media: Outputs returned by AI providers are uploaded to our Cloudflare R2 storage and associated with your account. Generated content is subject to the content policies of both PixPlace and the respective AI provider.

Energy: Your AI generation usage is tracked via an Energy system. Each generation deducts Energy from your account balance based on the model, type, and parameters of the generation.

15. Push Notifications

If you opt in to push notifications through your browser or the Android app, we store your push subscription endpoint and cryptographic keys in your account. We use these to deliver notifications about new messages, call invitations, likes, comments, and follows.

You can revoke push notification permissions at any time through your browser or device settings, or by contacting us. Revoking will cause future notifications to fail silently.

16. Real-Time Communications

Audio and video calls are established using the WebRTC protocol. Call session signaling (SDP offers and ICE candidates) is transmitted through Supabase Realtime channels. Where direct peer-to-peer connection is not possible (e.g., across different network types), media traffic is relayed through our dedicated TURN server at 194.87.55.127. TURN relay traffic is not recorded or stored.

Call metadata (participant IDs, room ID, join/leave times) is stored in our database for a limited period for security purposes. We do not record audio or video calls.

Direct messages are stored encrypted in transit (HTTPS) and at rest in our database. While we make efforts to protect message content, direct messages are not end-to-end encrypted at the application layer in the current version of the Platform.

17. Affiliate and Partner Program

If you participate in our Creator Affiliate Program, we collect your name, email, social media profile URL, and audience information you provide when applying. We use this to evaluate your application and, if approved, to track referrals associated with your affiliate link and calculate commission payments.

Referral tracking may involve cookies or URL parameters associated with your unique referral code.

18. Analytics and Behavioral Profiling

We operate a first-party analytics system that tracks behavioral events as described in Section 3.2. This system is used exclusively for platform improvement, content recommendation, and administrative reporting. We do not share raw behavioral data with third-party advertising networks.

Feed personalisation:We maintain a behavioral preference model (“feedProfile”) that assigns weighted scores to content categories and tags based on your interactions. This model is used to rank content in the “For You” feed. The model decays over time (0.98× per session) to avoid over-indexing on past behavior. You may reset your feed preferences by clearing the feedProfile from your account settings or localStorage.

Session fingerprinting: When you start a session, we record device characteristics (CPU, RAM, GPU, screen resolution, browser, OS, network type) as described in the PlatformSession record. This information is used for security purposes (detecting anomalous access) and aggregate analytics (understanding device distribution across our user base). It is not used to track you across third-party websites.

19. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page;
• Send you an email notification (if you have a registered account); and/or
• Display a prominent notice on the Platform.

Your continued use of the Platform after changes take effect constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, please stop using the Platform and contact us to delete your account.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: [email protected]
Platform: https://pixplace.space

For GDPR-related inquiries from EEA/UK residents, please include “GDPR Request” in your subject line.
For CCPA-related inquiries from California residents, please include “CCPA Data Request.”
For Russian Federation inquiries, please include “152-ФЗ Запрос.”

© 2026 PixPlace Space. All rights reserved. This Privacy Policy was last updated on July 17, 2026.