Privacy policy

1. Data controller

This Privacy Policy describes how Pixel Galaxies s.r.o., a Czech limited liability company (IČO: 19429614), located at Albertova 826/20, Pražské Předměstí, 500 02 Hradec Králové, Czech Republic ("we", "us", "our", or "Pixelrepo") collects, uses, and shares information about you when you use our website and services (collectively, the "Service").

As a company established in the Czech Republic, we comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information we collect

2.1 Information you provide to us

• Account Information: When you create an account via Google OAuth, we collect your email address, name, and profile picture from your Google account.
• User Content: Images you upload, pixel art you create, collections you organize, and any other content you submit to the Service.
• Communications: If you contact us directly, we may receive additional information about you.

2.2 Information we collect automatically

• Usage Data: We use Plausible Analytics, a privacy-focused analytics service that doesn't use cookies and collects only aggregated, anonymous data about how our Service is used.
• AI Generation Data: Prompts you submit for AI generation and metadata about generated content.
• Session Data: Temporary session identifiers to maintain your login state (no persistent cookies are used).

3. Legal basis for processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract: To provide the Service you've requested (account creation, image processing, content storage)
• Legitimate interests: To improve our Service, ensure security, and prevent fraud
• Legal obligation: To comply with applicable laws and regulations
• Consent: Where you've given explicit consent for specific processing activities

4. How we use your information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process and complete transactions via Stripe
• Generate pixel art using third-party AI services
• Send you technical notices and support messages
• Respond to your comments and questions
• Analyze aggregated usage patterns to improve user experience
• Detect, prevent, and address technical issues
• Comply with legal obligations

5. Information sharing and disclosure

We do not sell, trade, or rent your personal information. We share your information only with:

• Service providers:
  • Cloudflare R2 (US) - for image storage
  • Stripe (for payment processing)
  • Third-party AI services (for pixel art generation)
  • Plausible Analytics (privacy-focused analytics)
• Public content: Images you choose to publish publicly are visible to all users
• Legal requirements: When required by law or valid legal process
• Business transfers: In case of merger, acquisition, or sale of assets

6. International data transfers

Although we are based in the Czech Republic, we use service providers located in the United States. When we transfer your data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Ensuring service providers comply with privacy frameworks
• Implementing additional security measures

7. Data retention

We retain your personal information for as long as:

• Your account is active
• Necessary to provide you with our services
• Required to comply with legal obligations
• Needed to resolve disputes or enforce agreements

You can request deletion of your account and data at any time by contacting support.

8. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restriction: Limit how we process your data
• Right to object: Object to certain types of processing
• Right to data portability: Receive your data in a structured format
• Right to withdraw consent: Where processing is based on consent

To exercise these rights, contact us at [email protected]. We'll respond within one month. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ) or your local supervisory authority.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Secure data storage infrastructure

However, no method of transmission over the Internet is 100% secure. We strive to protect your data but cannot guarantee absolute security.

10. Children's privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe we have collected information about a child under 16, please contact us immediately at [email protected].

11. Cookies

We don't use cookies for tracking or advertising. We only use essential session storage to maintain your login state. Our analytics provider (Plausible) doesn't use cookies and doesn't track individual users.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we may also notify you via email.

13. Contact us

For any questions about this Privacy Policy or to exercise your rights: