Privacy Policy
Last updated: October 2026
What we collect
When you register, we store your email address and a hashed password. We never store raw passwords or raw API keys.
When you upload images, we store the image file in Cloudflare R2 and metadata (file size, dimensions, MIME type, upload date) in our database.
If you subscribe to a paid plan, payment is handled by Stripe. You enter your card details on Stripe's pages and they go directly to Stripe — PixelVault never sees or stores them. Stripe holds your billing details (name, company name, address, payment method) and invoice history; we keep only the Stripe customer and subscription identifiers, your plan, and the renewal date.
Our servers also keep short-lived request logs — timestamp, request path, response status, duration, IP address, and browser user-agent — so we can debug failures and investigate abuse. These logs are held by Cloudflare on our behalf for a short retention window (currently 3 days) and then deleted automatically. We don't use them to build profiles, track you across sites, or target advertising.
What we don't do
- We don't sell your data.
- We don't use your images for training AI models.
- We don't track you across the web.
- We don't use tracking cookies, cross-site trackers, or ad networks.
Analytics
We use Cloudflare Web Analytics to understand aggregate traffic. It is privacy-first: no cookies, no client-side state, and no fingerprinting, and it stores no personal data in your browser — so PixelVault needs no cookie-consent banner. We also record a small number of anonymous product events (for example, that an upload on a tool page finished, or that a Copy button was clicked) to see where people get stuck. These carry a random identifier generated fresh on each page load and held only in memory — never stored in your browser, never linked to you or your IP address — and they are skipped entirely if your browser sends Do Not Track or Global Privacy Control. Account milestones (such as when an account was created or a first image uploaded) are recorded against your account ID, not your email. The only thing we store in your browser is a login token (when you sign in), which is strictly necessary to keep you signed in.
Where your data lives
Your images and core account data are stored at rest in the European Union: image files in Cloudflare R2 (EU jurisdiction) and your account details and image metadata in our Neon PostgreSQL database (EU region). Our application runs on Cloudflare's global edge network, so each request is processed at the location nearest you. A couple of subprocessors (below) — transactional email, payments and aggregate analytics — may process limited data outside the EU under standard data-protection safeguards.
Subprocessors
We rely on a small set of infrastructure providers, each under a data processing agreement:
- Cloudflare — image storage (R2, EU), CDN, edge compute, cookieless analytics, and short-lived server request logs.
- Neon — PostgreSQL database (EU region) for account and image metadata.
- Plunk — transactional email (e.g. verification, password reset).
- Stripe — payment processing and invoicing for paid plans (card details, billing name and address, invoices). Stripe may process data in the United States under standard contractual clauses.
Data deletion
You can delete any image via the API. To delete your entire account, contact us at privacy@pixelvault.dev.
Contact
Questions about privacy? Email privacy@pixelvault.dev.