This policy explains what Pilkix collects when you use the Pilkix app, why we collect it,
how long we keep it, and how you can have it deleted. Questions and requests:
pilkixapps@gmail.com.
What we collect
Account data. Your email address and the sign-in identity issued by Google
Firebase Authentication when you sign in. We also record sign-in events — the time, the IP
address and the device's user agent — to detect account abuse.
When you explicitly agree to our Terms, we record the accepted version and the time of
agreement on your account. This records your agreement to the service rules; it is not
consent to unrelated data processing. These acceptance records are removed when you delete
your account, subject to the backup rotation described below.
If you sign in with Apple. Apple gives us a token for your Sign in with Apple
authorisation. We keep it encrypted, with a key kept apart from the database, and use it for one
thing only: when you delete your account, we ask Apple to remove Pilkix's access to your Apple ID.
We do not use it to read anything from your Apple account.
Photos you upload. The images you choose from your device to be processed.
Each time you open the system photo picker, the app receives only the one photo you select;
a template that needs several photos asks you to select each one in turn. Only the photos you
choose this way are uploaded; the app does not browse your photo library. Saving a generated
result to your gallery, and checking whether that result is already saved there, is separate
and concerns only the file the app saved itself.
Images we generate. The results produced for you from the photo or photos you
uploaded.
Job records. Which published template you used, the parameters that template
exposes, the status of the job and its timestamps.
Purchases. When you buy tokens, Google Play sends us a purchase token and
order identifier so we can verify the purchase and credit your balance. We keep a ledger of
token credits and debits. We never see your card or payment details.
Notification token. When you sign in, the app asks Firebase Cloud Messaging
for this installation's notification token and sends it to us, and we store it linked to your
account. We use it only to tell you that a generation has finished or did not finish; the
notification carries the job reference and its outcome, not your photos or results.
Crash diagnostics. Firebase Crashlytics collects crash reports and the device
state around a crash so we can fix defects.
Reports you send us. If you report a generated image, we store which image and
job you reported, the reason you chose and anything you wrote.
You do not type prompts. Pilkix generates images only from templates we publish and review, so we
do not collect free-form prompt text from you.
How long we keep it
The photos you upload and the images we generate stay in your library so you
can find them again, and are deleted automatically when their time runs out:
30 days on the free plan, 90 days with a monthly
subscription, and 365 days with an annual one. The clock starts when the file
is created and does not restart when you open it.
If your subscription ends — it lapses, you cancel, or a purchase is refunded —
each file keeps the expiry date assigned when it was created. That change does not reset or
shorten its retention period.
You can delete any of them yourself at any time, from your library, and that
deletion is immediate rather than waiting for the period above to run out.
The job record is kept without the image data, so we can answer support
questions and account for token spending.
Account data is kept until you delete your account.
The encrypted Sign in with Apple token is kept while your account exists and is
erased as soon as Apple confirms that Pilkix's access to your Apple ID has been removed, when you
delete the account. If we hold no working token at that point, your account and data are still
deleted, and we tell you how to remove the access yourself in your Apple ID settings — we never
say it was removed when it was not. Database backups may contain the encrypted token until they
are rotated out; it cannot be read without the key.
A notification token is kept while it is registered to your account. The app
requests removal of the notification token when you sign out on that device. If the request
fails, the registration may remain. Registering the same installation successfully with another
account moves its token to that account. We remove tokens that Firebase Cloud Messaging reports
as invalid, and account deletion removes the tokens linked to your account.
Purchase and token records are kept after account deletion, because we are
required to retain accounting records. After deletion they carry no email address and no
sign-in identity — only the anti-abuse marker described below can connect them to a person.
Content reports are kept as safety records after account deletion.
A record of the deletion itself — its progress and outcome and, if the account
used Sign in with Apple, a keyed hash of that Apple ID so that a fresh Sign in with Apple can be
matched to the deletion — is kept for 30 days after it completes, so the app can still tell you
how it went after you have been signed out.
One anti-abuse marker is kept for twelve months after you delete your account:
irreversible hashes of the sign-in identities the account used — the identifier our sign-in
service gave it, the Google or Apple account linked to it, and your email address if it was
verified — and nothing else about you. It is what lets us recognise that you have already had
your free starting credits, even when you come back with a new account through the same Google
account, Apple ID or email address, and settle a refund that Google or Apple issues after the
account is gone. Without it, deleting and signing up again would be an unlimited supply of free credits,
paid for by everyone who does not do that.
Database backups held in Cloudflare R2 may still contain a copy of deleted
data until those backups are rotated out of storage.
Who else processes your data
Google Firebase Authentication — sign-in and identity verification.
Google Firebase Crashlytics — crash diagnostics.
Google Firebase Cloud Messaging — delivering notifications about your
generations.
Google Firebase Analytics — measuring how the app is used.
Google Play Billing — purchase processing and verification.
Cloudflare R2 — object storage for uploaded and generated images, and for
database backups.
Image generation — depending on the selected template and available capacity,
generation runs on machines we operate or through an external image-generation provider (Google).
Google may be the primary route for a template, not only a fallback when our machines are
unavailable. We send every photo you selected for the template, together with the generation
instructions, to the chosen processor to produce the requested result.
Pilkix shows no ads. The app does not collect the advertising ID: it does not declare the
advertising-ID permission, and it switches off advertising-ID collection and ad-personalisation
signals in Firebase Analytics. We do not sell your personal data and we do not share it for
advertising. The providers above receive only what they need to do the job we use them for.
How we learn which parts of the app work
We collect analytics event data about how the app is used — which screens are opened, which
features are started and finished, and diagnostic reports when the app crashes — to measure usage
trends and to decide what to improve next. We use Firebase Analytics and Firebase Crashlytics to
do this.
These events describe actions, not content. They record that a design was opened
or a generation finished, together with the format or style involved. They never carry your
photos, the text of your designs, your prompts, your email address or your balance.
Separately from these events, the Firebase Analytics SDK records standard technical information
about the app installation and the device, such as an app-instance identifier, the device model,
the operating-system and app versions, and an approximate region, so that installs and sessions
can be counted.
One of these events records whether your device passed the integrity check that earns the free
starter tokens, and a short code for the result. It records the outcome only — never an
identifier for your device, and nothing about what the check examined.
Why we are allowed to process it
Where the GDPR applies, we rely on: performance of our contract with you, for everything needed
to run your account and produce the images you request; our legitimate interest in keeping the
service safe, for abuse detection, content reports and crash diagnostics; and our legal
obligations, for retaining accounting records.
The marker we keep after deletion
This is the one thing that survives deleting your account and can still be connected to you, so
it is set out on its own rather than buried in a list.
It is a set of one-way hashes: of the identifier our sign-in service gave the account, of each
Google or Apple account linked to it, and of your email address if it was verified. The hashes of
the Google or Apple account and of the email address are computed with a secret key kept apart
from the database, so they cannot be matched against guesses without it. We cannot read a person,
an email or a name out of them, and we do not use them to contact you or to profile you. They
answer exactly three questions: have you already been given free starting credits, does a refund
Google or Apple issued after the account was deleted belong here, and does a subscription you are still
paying for belong to your new account. Each hash is deleted twelve months after the deletion that
left it.
We keep it under our legitimate interest in preventing abuse of free credits and in settling
payments correctly. A hash is not anonymous data — it is still information about you — so it is
covered by the rights below, and you can ask us about it at the address at the top of this page.
Where your data is processed
Pilkix runs on servers in the European Union, and generated images and uploaded photos are stored
with Cloudflare R2. Some of the services listed above are operated by companies outside the
European Economic Area, so your data is transferred there when they are used:
Google — Firebase Authentication, Crashlytics, Cloud Messaging and Analytics,
Google Play billing, and the image-generation provider when it is used.
Cloudflare — storage and delivery of images, and protection of the site.
Both are used under their own data processing terms, which provide the transfer mechanism required
for personal data leaving the European Economic Area. If you want to know which mechanism applies
to a particular service, ask us at the address at the top of this page and we will tell you what
is in place rather than describe it in general terms here.
We do not sell your data, we do not share it with advertisers, and we do not use it to build a
profile of you for marketing.
How decisions are made
Automated safety checks affect what you get, at two points. Before generation, every photo you
selected is classified for adult content; if any of them is rejected, the generation stops and
nothing is sent on to be generated. After generation, every generated image is classified for
adult content before it is delivered, and an image the classifier rejects is not shown to you and
is deleted. These are filters on the photos and the output, not a judgement about you, and they
have no other effect on your account. They do not verify that you had permission to upload a
photo, and they cannot guarantee that every harmful image is detected. If you think a photo or a
result was rejected wrongly, write to us at the address above and a person will look at it.
Nothing else about your account is decided automatically. We do not profile you and we do not
make automated decisions with legal or similarly significant effects.
Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to
processing based on legitimate interest, or ask for your data in a portable form. Write to
pilkixapps@gmail.com. If you are in the EU or the UK you may
also complain to your national data protection authority.
Deleting your account
You can delete your account from inside the app, under Profile. You can also request deletion
without the app installed — see Delete your Pilkix account,
which lists exactly what is erased and what is retained.
If you are in the United States
Some states give you specific rights over personal information. We do not sell personal
information and we do not share it for cross-context behavioural advertising, so there is nothing
to opt out of. The rights to know, to delete and to correct are the same ones described under
Your rights above, and you can use them the same way. We will not treat you differently
for exercising them.
Children
Pilkix is for adults. You must be at least 18 years old to use it; it is not directed at
children or teenagers, and we do not knowingly collect personal data from anyone under 18. If we
learn that an account belongs to a minor, we delete it and the data associated with it.
Security
Traffic between the app and our servers is encrypted with TLS. Access to stored images requires
an authenticated request from the account that owns them. Access to production systems is limited
to the people who operate them.
Complaints
If you think we have handled your data wrongly, tell us first — the address is at the top of this
page, and we would rather fix it than have you find out from a regulator. You also have the right
to complain to a data protection authority, normally the one where you live or work. In Ukraine
that is the Verkhovna Rada Commissioner for Human Rights; in the European Union it is your
national supervisory authority.
Changes
If we change this policy we update the date at the top of this page. Material changes will also
be announced in the app.