隐私政策
一句话概括
PIXO TAP 是本地优先的软件。截图原图、照片、原文件内容和剪贴板正文只保存在你的设备上，不会上传。账号、同步、遥测和 AI 分析都是可选的：只有你自己配置了 AI 服务密钥并主动触发分析或发起对话时，本机识别出的 OCR 文字、活动时间线文字、对话消息以及自动注入的项目文字摘要与暂放区文件元信息才会直接从你的设备发送给该 AI 服务。同步默认关闭，开启前须你明确同意并设置同步口令或恢复密钥，同步内容全程端到端加密。反馈正文同样端到端加密，服务器只保存密文。
1. 屏幕、键盘与其他采集的范围
- Windows：只对前台窗口做设备上的文字识别（OCR），并跳过密码输入框。
- macOS：在你发起的会话中，对整个桌面做设备上的 OCR。开始前会先弹出提示并请求系统的屏幕录制权限。桌面是整屏截取的，请先整理桌面。
- Linux：在平台允许时，通过系统截图接口截取整屏并做设备上的 OCR。在 GNOME Wayland 下无法读取前台窗口。同样请先整理桌面。
- 摄像头：只在会话结束时拍一张照片，且只有你开启后才会拍。
- 键盘输入：不记录。所有端的代码都没有全局键盘钩子。
- 只有你点击开始后才会记录；每一类采集都需要系统或应用中的授权，并可随时关闭。
2. 我们处理的数据类别
| 数据类别 | 包含什么 | 存放位置 | 是否离开你的设备 |
|---|---|---|---|
| 账号 | 邮箱、密码哈希（不保存明文密码）、显示名称与语言、登录会话与刷新令牌（只存哈希）、同意记录、注册时的年龄确认声明 | 服务器（由我们运营的服务，托管在 Cloudflare 上） | 是，用于提供账号服务 |
| 本机工作记录 | 项目、会话、活动时间线、OCR 全文、恢复笔记，以及文件新建、下载、修改、移动的文件名与路径 | 仅本机 | 否（同步默认关闭，且需你明确同意） |
| 屏幕与 OCR | 截图原图（仅本机）、识别出的文字 | 仅本机；截图不上传 | 否。OCR 文字只在你触发 AI 分析时发送，见第 4 节 |
| 相机照片 | 会话结束时拍摄的一张照片（仅在你开启后） | 仅本机 | 否 |
| 剪贴板 | 只记录变化的类型与前台应用；剪贴板正文不保存 | 本机 | 否 |
| AI 请求 | OCR 文字、活动时间线文字，以及对话消息与自动注入的项目文字摘要和暂放区文件元信息（仅当你配置密钥并触发分析或对话时）；AI 服务密钥存于系统钥匙串或凭据存储 | 密钥仅存于本机；请求由你的设备直接发送，不经过我们的服务器 | 是，发送到 DeepSeek（位于中国） |
| 遥测 | 使用统计（仅当你明确同意后）；记录不含用户 ID 或任何账号标识，服务器无法把它与你的账号关联 | 服务器 | 是，发送到服务器。默认关闭，客户端均不开启 |
| 服务器日志 | 请求 URL（查询串不含密钥）、时间、IP 地址（日志中屏蔽 IPv4 与 IPv6）、已脱敏的应用日志、用户与管理员操作的审计记录（含用户与对象 ID） | Cloudflare 平台日志与我们的应用日志 | 由 Cloudflare 处理 |
| Cookie 与浏览器存储 | 公开页面不设置 Cookie。浏览器中仅保存 pixo-language（localStorage，语言偏好）与 pixo-selected-pet（sessionStorage，本次会话的桌宠选择）。账号中心与管理后台另使用必要的 HttpOnly 会话 Cookie 与 CSRF 令牌，用于登录状态 | 你的浏览器 | 否 |
| 反馈 | 你提交的留言正文（端到端加密，服务器只保存密文）、类别、应用版本、平台。管理后台不显示反馈的任何信息（包括元数据） | 服务器只保存密文；服务端与运营方均不持有能解密反馈的私钥，正文只能由发送者本机解密 | 是，以密文形式保存在服务器上 |
| 同步数据 | 你明确同意“数据同步”后，你选择的元数据（例如项目结构、恢复笔记和设置）。在本机加密后上传，服务器只保存密文信封，无法解密 | 服务器只保存密文；密钥只留在你的设备上 | 是，以密文形式离开你的设备 |
| 设备授权 | 哈希后的 IP 地址、浏览器与用户代理摘要、大致位置（国家、城市、网络服务商） | 服务器 | 是，保存在服务器上 |
| 邮件发送队列 | 收件邮箱地址与邮件内容（加密存储） | 服务器 | 是，交给邮件服务提供商发送 |
本机数据目录：macOS 为 ~/Library/Application Support/PixoTap，Windows 为 %LocalAppData%\PixoTap，Linux 为 ~/.local/share/PixoTap。AI 服务密钥不在这些目录中保存为文件：Linux 上若没有 Secret Service，密钥无法保存，也不会改存为明文文件。
3. 处理目的与法律依据
GDPR 指欧盟《通用数据保护条例》，PIPL 指中国《个人信息保护法》。
| 目的 | 数据 | 法律依据 |
|---|---|---|
| 提供本地记录、恢复笔记与设置 | 本机工作记录、屏幕与 OCR、相机照片、剪贴板变化 | 你开始记录并授予系统权限，即同意（GDPR Art. 6(1)(a)；PIPL 第 13 条第 1 款）。屏幕内容可能包含特殊类别信息，相关处理的依据待律师确认（GDPR Art. 9） |
| AI 分析 | OCR 文字、活动时间线文字 | 你配置密钥并主动触发，即同意（GDPR Art. 6(1)(a)；PIPL 第 13 条第 1 款） |
| 账号、会话与设备授权、数据导出与注销 | 账号、设备授权、同意记录 | 为提供你请求的账号服务所必需（GDPR Art. 6(1)(b)；PIPL 第 13 条第 2 款） |
| 遥测 | 遥测记录 | 你明确同意，可随时撤回（GDPR Art. 6(1)(a)；PIPL 第 13 条第 1 款） |
| 数据同步 | 同步你选择的元数据，在本机加密后上传 | 你明确同意“数据同步”，可随时撤回（GDPR Art. 6(1)(a)；PIPL 第 13 条第 1 款） |
| 处理你提交的反馈 | 反馈正文（端到端加密）、类别、应用版本、平台 | 依据待律师确认（GDPR 下可能为你的同意 Art. 6(1)(a) 或合法利益 Art. 6(1)(f)；PIPL 下的对应依据待确认） |
| 安全、防滥用与排错 | 服务器日志、审计记录、速率限制计数 | 依据待律师确认（GDPR 下可能为合法利益 Art. 6(1)(f)；PIPL 下的对应依据待确认） |
| 发送注册与找回密码的验证码 | 邮箱地址、验证码、必要的通知 | 为提供账号服务所必需（GDPR Art. 6(1)(b)；PIPL 第 13 条第 2 款） |
4. 同步与遥测
- 同步默认关闭。客户端默认不同步任何数据；同步须由你主动开启、设置同步口令或恢复密钥并明确同意“数据同步”（sync）。开启后只同步你选择的元数据与文本记录，例如项目结构、恢复笔记、多会话对话、偏好设置和端到端加密的 AI 密钥；不包含截图、照片、原文件正文、剪贴板正文、OCR 全文或活动时间线。同步内容在你的设备上加密后才上传，服务器只保存加密信封，无法解密；未同意或已撤回同意时，服务器拒绝同步请求，明文同步也会被服务器拒绝。
- 反馈端到端加密。你提交的反馈正文在你的设备上加密，服务器只保存密文，仅发送者本机可以解密。服务端与运营方均无法读取正文；管理后台不显示反馈的任何信息（包括元数据）。我们不会因客服或员工需要处理问题而读取用户内容。
- 遥测默认关闭。客户端均不开启遥测。服务器只为已明确同意遥测的用户存储遥测记录，并拒绝包含 URL、邮箱、IP 地址或文件路径形式的值。遥测记录不含用户 ID 或任何账号标识，服务器无法把它与你的账号关联：它保留 90 天后自动删除，注销账号时不会按账号删除它，导出也不包含它。你可以撤回同意，撤回后服务器不再接收遥测。
5. 发送给第三方 AI 服务的数据
客户端使用你自带密钥的 AI 服务（目前为 DeepSeek，服务地址为 api.deepseek.com）。只有你配置了密钥并主动开始分析或发起伙伴对话时，才会发送：
- 设备上识别出的 OCR 文字（经客户端清洗）；
- 带时间戳的活动时间线文字；
- 你在聊天框中输入的消息，以及自动注入的项目恢复摘要与暂放区文件元信息（仅文件名、类型与大小）。
不会发送：截图像素、照片、原文件内容、剪贴板正文。OCR 文字本身可能包含敏感信息，请按项目内容决定是否授权分析。发送后的处理受该 AI 服务自身的条款与隐私政策约束，我们无法控制。该服务位于中国，数据传输是因为你选择使用它。没有密钥或离线时，客户端只在本地生成摘要。
本网站不代理 AI 请求。
6. 保留期限
| 数据 | 保留期限 |
|---|---|
| 本机数据 | 直到你删除。退出程序后删除对应目录即可清除 |
| 账号数据 | 账号存续期间。注销申请后有 14 天宽限期，期内可撤销；期满后立即永久删除账号与业务数据。与账号相关的残留（邮件队列中的收件人与正文、验证码、会话与刷新令牌、导出包、限流计数）在 7 日内清除。备份按其保留期自然过期，具体期限 [备份保留期限，待律师确认] |
| 反馈 | 服务器上的密文：直到账号注销或反馈被删除。目前尚未设置自动删除期限。 |
| 同步数据 | 服务器上的密文：随账号存续；撤回同意后服务器不再读写，随账号注销按第 6 节规则清除。[同步数据具体保留期限，待所有者确定] |
| 审计记录 | 与已注销账号相关的审计记录（含账号 ID）在注销完成后 7 日内清除。其他安全审计记录（不含账号标识，只含哈希化的来源）至少保留 180 天 |
| 邮件发送队列 | 已发送的邮件最多保留 7 天；发送失败的记录最多保留 30 天；与账号相关的邮件在终结（已发送或失败）后最多保留 7 天 |
| 服务器与平台日志 | 由 Cloudflare 决定，我们在应用层无法设定其保留期限 |
| 遥测记录 | [遥测保留期限，待所有者确定] |
| 设备授权记录 | [设备授权记录保留期限，待所有者确定] |
7. 共享与跨境传输
我们不出售个人数据，也不向广告商提供数据。数据可能被以下服务提供方处理：
| 服务提供方 | 处理什么 | 所在地 | 跨境传输机制 |
|---|---|---|---|
| Cloudflare | 网站托管、服务器与平台日志、账号服务的存储与处理 | 全球边缘网络，数据处理地点可能不止一处 | [待律师确认] |
| GitHub | 下载页读取发布信息。本站接口不可用时，下载页会从你的浏览器直接访问 GitHub 的公开发布接口，GitHub 会看到你的 IP 地址 | 美国 | [待律师确认] |
| DeepSeek | 仅当你配置密钥并触发分析时，由你的设备直接发送的 OCR 文字与活动时间线文字 | 中国 | [待律师确认] |
| 邮件服务提供商 | 收件邮箱地址、注册与找回密码的验证码及通知邮件 | 中国 | [待律师确认] |
整体的跨境传输状态：[出境安全评估 / 标准合同 / 认证状态，待律师确认]。
8. 你的权利
- 访问与导出：你可以在账号中心导出资料、已授权设备、会话摘要、同意记录、同步记录、反馈与本人审计记录（遥测记录与账号不可关联，不在导出范围内）。导出需要重新验证口令，下载链接有效期为 7 天。
- 更正：你可以修改显示名称和语言。
- 删除与注销：你可以申请注销账号。注销有 14 天宽限期，期内可撤销；期满后按第 6 节的期限处理。
- 撤回同意：对已实现的同意类型，你可以随时在账号中心撤回。撤回“数据同步”同意后，服务器从下一次同步请求起拒绝读写，同步随即停止。
- 本机数据：你可以直接删除本机目录，无需经过我们。
- 投诉：目前没有独立的投诉表单，请发送邮件至 [联系邮箱]。
- 监管机构：欧盟用户可以向其居住地成员国的数据保护监管机构投诉。中国大陆用户可以向国家网信部门或其他主管部门反映。具体适用与行使方式待律师确认。
9. 未成年人
注册账号时，你需要勾选确认已年满 14 岁。这是自我声明，服务器按勾选结果执行，但不做身份核验。未满 14 岁不能使用本服务；我们不提供监护人同意的注册途径。
10. Cookie 与浏览器存储
公开页面（首页、下载、使用说明、隐私政策、用户协议、关于我们）不设置 Cookie，也不加载第三方脚本、字体或跟踪器。浏览器中仅保存 pixo-language（localStorage，语言偏好）与 pixo-selected-pet（sessionStorage，本次会话的桌宠选择）。这些数据不会发送给我们。账号中心与管理后台使用必要的 HttpOnly 会话 Cookie 与 CSRF 令牌维持登录状态，不用于广告或跟踪。
11. 安全措施
- 密码只保存哈希；登录与验证码请求有速率限制；验证码短期有效。
- 会话与刷新令牌只保存哈希。
- IP 地址以带密钥的哈希存储，日志中屏蔽 IPv4 与 IPv6 地址。
- AI 服务密钥保存在系统钥匙串（macOS）、系统凭据保护（Windows）或系统 Secret Service（Linux），不写入项目文件，也不上传。
- 待发送的邮件地址与内容加密存储。
- 同步内容在本机加密后才上传，密钥只留在本机；服务器只保存密文，无法解密。
- 反馈正文端到端加密，仅发送者本机可解；服务端与运营方均不持有能解密反馈的私钥，管理后台不显示反馈的任何信息（包括元数据）。
- 下载页使用内容安全策略（CSP）。
我们采取这些措施降低风险，但没有任何系统绝对安全。请妥善保管你的设备与密钥。
12. 政策变更
政策变更时，我们会更新本页的日期。重大变更时，我们可能请求你重新同意。
13. 联系方式
- 运营主体：[运营主体名称，待所有者填写]
- 联系邮箱：[联系邮箱]
- 数据保护负责人：[数据保护负责人，待所有者填写]
- 跨境传输状态：[出境安全评估 / 标准合同 / 认证状态，待律师确认]
Privacy Policy
In one paragraph
PIXO TAP is local-first software. Original screenshots, photos, original file contents and clipboard text stay on your device and are never uploaded. Accounts, sync, telemetry and AI analysis are all optional: only when you have configured your own AI service key and trigger an analysis or chat is the OCR text recognised on your device, the activity timeline text, or your chat messages and auto-injected project summary / shelf file metadata sent directly from your device to that AI service. Sync is off by default; before you can turn sync on you must explicitly consent and configure a sync passphrase or recovery key, and synced content is end-to-end encrypted. Feedback text is also end-to-end encrypted, and the server stores only ciphertext.
1. Scope of screen, keyboard and other collection
- Windows: on-device text recognition (OCR) of the foreground window only, skipping password fields.
- macOS: during a session you start, on-device OCR of the whole desktop. Before it starts you see an alert and are asked for the system screen recording permission. The desktop is captured in full, so please tidy it first.
- Linux: where the platform allows it, a full-screen capture through the system screenshot portal, with on-device OCR. On GNOME Wayland the foreground window cannot be read. Again, please tidy your desktop first.
- Camera: one photo at the end of a session, and only if you have turned it on.
- Keyboard input: not recorded. There are no global keyboard hooks anywhere in the code.
- Nothing is recorded until you click start. Each kind of collection needs permission in the system or the app and can be turned off at any time.
2. Categories of data we handle
| Category | What it includes | Where it is stored | Leaves your device? |
|---|---|---|---|
| Account | Email, password hash (plain-text passwords are never stored), display name and language, sign-in sessions and refresh tokens (stored as hashes only), consent records, the age confirmation given at sign-up | Server (a service we operate, hosted on Cloudflare) | Yes, to provide the account service |
| Local work records | Projects, sessions, activity timeline, full OCR text, recovery notes, and file names and paths for files created, downloaded, modified or moved | Device only | No (the clients do not sync yet; sync is off by default and requires your explicit consent) |
| Screen and OCR | Original screenshots (device only), recognised text | Device only; screenshots are not uploaded | No. OCR text is sent only when you trigger AI analysis; see section 4 |
| Camera photo | One photo taken at the end of a session (only if you have turned it on) | Device only | No |
| Clipboard | Only the kind of change and the front app are recorded; clipboard text is not stored | Device | No |
| AI requests | OCR text and activity timeline text (only when you configure a key and trigger an analysis); the AI service key is kept in the OS keystore | Key on device only; the request is sent directly from your device and does not pass through our servers | Yes, to DeepSeek (located in China) |
| Telemetry | Anonymous usage statistics (only if you explicitly agree); records are not linked to your account and contain no user ID | Server | Yes, to the server. Off by default; no client enables it |
| Server logs | Request URLs (query strings contain no secrets), times, IP addresses (masked to hide IPv4 and IPv6 addresses in logs), redacted application logs, and audit records of user and administrator actions (including user and target IDs) | Cloudflare platform logs and our application logs | Processed by Cloudflare |
| Cookies and browser storage | Public pages set no cookies. The browser stores only pixo-language (localStorage, language preference) and pixo-selected-pet (sessionStorage, the companion chosen for this session). The account centre and admin console also use a necessary HttpOnly session cookie and a CSRF token to keep you signed in | Your browser | No |
| Feedback | The message you submit (end-to-end encrypted; the server stores only ciphertext), its category, app version and platform. The admin console shows no feedback information at all, including metadata | Server stores ciphertext only; neither the server nor the operator holds a key that can decrypt feedback, so only the sender's device can read the message | Yes, stored on the server as ciphertext |
| Sync data | Metadata you choose to sync (for example project structure, recovery notes and settings), after you explicitly consent to "Data sync". Encrypted on your device before upload; the server stores only encrypted envelopes and cannot decrypt them | Server stores ciphertext only; keys stay on your device | Yes, leaves your device as ciphertext |
| Device authorizations | A hashed IP address, a summary of the browser and user agent, approximate location (country, city, network provider) | Server | Yes, stored on the server |
| Email outbox | Recipient email address and message body (stored encrypted) | Server | Yes, handed to the mail service provider for delivery |
Local data folders: on macOS ~/Library/Application Support/PixoTap, on Windows %LocalAppData%\PixoTap, on Linux ~/.local/share/PixoTap. The AI service key is not saved as a file in these folders: on Linux without a Secret Service the key cannot be saved at all, and it is never written to a plain file instead.
3. Purposes and legal bases
GDPR is the EU General Data Protection Regulation; PIPL is China's Personal Information Protection Law.
| Purpose | Data | Legal basis (pending counsel review) |
|---|---|---|
| Local recording, recovery notes and settings | Local work records, screen and OCR, camera photo, clipboard changes | Consent, given when you start recording and grant the system permission (GDPR Art. 6(1)(a); PIPL Art. 13(1)). Screen content may include special-category information; the basis for that processing is pending counsel review (GDPR Art. 9) |
| AI analysis | OCR text, activity timeline text | Consent, given when you configure a key and trigger the analysis (GDPR Art. 6(1)(a); PIPL Art. 13(1)) |
| Accounts, sessions and device authorizations, export and deletion | Account, device authorizations, consent records | Necessary to provide the account service you requested (GDPR Art. 6(1)(b); PIPL Art. 13(2)) |
| Telemetry | Telemetry records | Your explicit consent, which you can withdraw at any time (GDPR Art. 6(1)(a); PIPL Art. 13(1)) |
| Sync | Metadata you choose to sync, encrypted on your device before upload | Your explicit consent to "Data sync", which you can withdraw at any time (GDPR Art. 6(1)(a); PIPL Art. 13(1)) |
| Handling the feedback you submit | Feedback text (end-to-end encrypted), category, app version, platform | Pending counsel review (under the GDPR this may be your consent, Art. 6(1)(a), or legitimate interests, Art. 6(1)(f); the PIPL equivalent is to be confirmed) |
| Security, abuse prevention and debugging | Server logs, audit records, rate-limit counters | Pending counsel review (under the GDPR this may be legitimate interests, Art. 6(1)(f); the PIPL equivalent is to be confirmed) |
| Sending sign-up and password-reset codes | Email address, codes, necessary notices | Necessary to provide the account service (GDPR Art. 6(1)(b); PIPL Art. 13(2)) |
4. Sync and telemetry
- Sync is off by default. The clients do not sync any data unless you turn it on. Turning it on requires you to give your explicit consent to "Data sync" (sync). Even if it is enabled in future, only metadata you choose is synced, such as project structure, recovery notes and settings. It never includes screenshots, photos, original files, clipboard text, full OCR text or the activity timeline. Synced content is encrypted on your device before upload; the server stores only the encrypted envelopes and cannot decrypt them. While consent is missing or withdrawn, the server refuses sync requests, and plaintext sync is rejected by the server.
- Feedback is end-to-end encrypted. The feedback text you submit is encrypted on your device, and the server stores only ciphertext; only the sender's device can decrypt it. Neither the server nor the operator can read the text. The admin console shows no feedback information at all, including metadata. We do not read user content, including when support or staff need to deal with an issue.
- Telemetry is off by default. No client enables it. The server stores telemetry only for users who have explicitly agreed to it, and rejects values that look like URLs, email addresses, IP addresses or file paths. Telemetry records are not linked to your account and contain no user ID or other account identifier, so the server cannot connect them to you. They are deleted automatically after 90 days, are not deleted by account, and are not part of the export. You can withdraw your consent, and after withdrawal the server stops accepting telemetry.
5. Data sent to a third-party AI service
The client uses an AI service with your own key, currently DeepSeek (api.deepseek.com). Only when you have configured a key and start an analysis is the following sent:
- OCR text recognised on your device (sanitised by the client);
- timestamped activity timeline text.
Never sent: screenshot pixels, photos, original file contents, clipboard text. OCR text may contain sensitive information, so decide per project whether to allow analysis. What happens after it is sent is governed by that AI service's own terms and privacy policy, which we cannot control. The service is located in China, and the transfer happens because you choose to use it. Without a key or when offline, the client only builds a local summary.
This website does not proxy AI requests.
6. Retention
| Data | Retention |
|---|---|
| Local data | Until you delete it. Quitting the app and deleting the folder removes it |
| Account data | While the account exists. After a deletion request there is a 14-day grace period that you can cancel; after it ends, the account and business data are permanently deleted at once. Related remnants (queued email recipients and bodies, verification codes, sessions and refresh tokens, export files, rate-limit counters) are cleared within 7 days. Backups expire under their own retention period, [backup retention period, pending counsel review] |
| Feedback | Ciphertext on the server: until the account is deleted or the feedback is removed. No automatic deletion period is set yet. |
| Sync data | Ciphertext on the server: lasts while the account exists; after consent is withdrawn the server no longer reads or writes it, and it is cleared under section 6 on account deletion. [Specific sync retention period, to be set by the owner] |
| Audit records | Audit records linked to a deleted account (including the account ID) are cleared within 7 days after deletion is completed. Other security audit records (no account identifier, only hashed sources) are kept for at least 180 days |
| Email outbox | Sent items up to 7 days; failed items up to 30 days |
| Server and platform logs | Set by Cloudflare; we cannot set their retention at the application level |
| Telemetry records | [telemetry retention period, to be set by the owner] |
| Device authorization records | [device authorization retention period, to be set by the owner] |
7. Sharing and cross-border transfers
We do not sell personal data and do not provide data to advertisers. The following providers may process data:
| Provider | What it processes | Location | Transfer mechanism |
|---|---|---|---|
| Cloudflare | Website hosting, server and platform logs, storage and processing for the account service | Global edge network; processing may occur in more than one place | [pending counsel review] |
| GitHub | Reading release information for the download page. If the site's own interface is unavailable, the download page reads GitHub's public release API directly from your browser, so GitHub sees your IP address | United States | [pending counsel review] |
| DeepSeek | OCR text and activity timeline text sent from your device, only when you configure a key and trigger an analysis | China | [pending counsel review] |
| Mail service provider | Recipient email address, sign-up and password-reset codes, and necessary notices | China | [pending counsel review] |
Overall cross-border transfer status: [outbound security assessment / standard contract / certification status, pending counsel review].
8. Your rights
- Access and export: in the account centre you can export your profile, authorized devices, session summaries, consent records, sync records, feedback and your own audit records (telemetry records are not linked to your account and are not part of the export). Export requires you to re-enter your password, and the download link is valid for 7 days.
- Correction: you can change your display name and language.
- Deletion and account closure: you can request deletion of your account. There is a 14-day grace period that you can cancel; after it ends, section 6 applies.
- Withdrawing consent: for the consent types that are implemented, you can withdraw at any time in the account centre. After you withdraw "Data sync" consent, the server refuses sync reads and writes from the next sync request, and syncing stops.
- Local data: you can delete the local folders yourself without contacting us.
- Complaints: there is no separate complaint form yet; please email [contact email].
- Regulators: users in the EU may complain to the data protection authority of their member state of residence. Users in mainland China may report to the Cyberspace Administration of China or another competent authority. The precise application and how to exercise these rights are pending counsel review.
9. Minors
When you sign up you must tick a box confirming that you are at least [minimum age, to be set by the owner]. This is a self-declaration. The server enforces the tick as a confirmation, not as verification of identity. People below the minimum age may not create an account. The guardian-consent mechanism for minors is pending counsel review.
10. Cookies and browser storage
Public pages (home, download, documentation, privacy policy, terms of service and about us) set no cookies and load no third-party scripts, fonts or trackers. The browser stores only pixo-language (localStorage, language preference) and pixo-selected-pet (sessionStorage, the companion chosen for this session). These are never sent to us. The account centre and admin console use a necessary HttpOnly session cookie and a CSRF token to keep you signed in; they are not used for advertising or tracking.
11. Security measures
- Passwords are stored only as hashes. Sign-in and code requests are rate-limited, and codes are short-lived.
- Sessions and refresh tokens are stored only as hashes.
- IP addresses are stored as keyed hashes; logs mask IPv4 and IPv6 addresses.
- The AI service key is kept in the macOS Keychain, Windows credential protection or the Linux Secret Service, is not written to project files and is never uploaded.
- Outgoing email addresses and bodies are stored encrypted.
- Synced content is encrypted on your device before upload, and the keys stay on your device; the server stores only ciphertext and cannot decrypt it.
- Feedback text is end-to-end encrypted and can be decrypted only on the sender's device; neither the server nor the operator holds a key that can decrypt feedback, and the admin console shows no feedback information at all, including metadata.
- The download page uses a Content Security Policy (CSP).
These measures reduce risk, but no system is perfectly secure. Please safeguard your devices and keys.
12. Changes to this policy
When this policy changes we will update the date on this page. For significant changes we may ask for your consent again.
13. Contact
- Operator: [operator name, to be provided by the owner]
- Contact email: [contact email]
- Data protection officer: [data protection officer, to be provided by the owner]
- Cross-border transfer status: [outbound security assessment / standard contract / certification status, pending counsel review]
See also the Terms of Service , About us and the documentation.