Privacy
What we store, where it goes, how long it stays, and how you delete it. This page lists the actual columns and files, not a category.
Last updated 2026-08-19
What we store
| Data | Why | How long |
|---|---|---|
| Email address | Sign-in, password reset, billing receipts | Until you delete the account |
| Username | Shown to you in the studio | Until you delete the account |
| Password, hashed | Sign-in. We never hold the password itself. | Until you delete the account |
| Plan, credits used, billing period | Enforcing the monthly allowance | Until you delete the account |
| Your prompts and run settings | Rendering the run and showing your history | Until you delete the run or the account |
| Rendered images | Delivering the pictures back to you | 7 days, then deleted automatically |
| Reference images you upload | Used as the starting picture for an edit or an enlargement | 7 days, with the run |
| API keys, hashed | Authenticating API requests. The key itself is shown once and not stored. | Until you revoke it |
| Sign-in and reset tokens, hashed | Verifying an email address, resetting a password | Until they expire |
| Server logs | Finding faults. They carry request paths, timings and account ids. | Rotated by the system journal |
What we do not do
- We do not train models on your prompts or your images.
- We do not sell your data, and we do not share it with advertisers.
- We run no advertising tracker and no third-party analytics script on this site.
- We do not read your images except when a fault report names a specific run.
Who else sees anything
- SendGrid delivers account email — verification and password reset. It receives your email address and the message.
- Stripe handles card payment when paid plans open. Stripe receives your card details directly; we never hold a card number. We store the Stripe customer and subscription identifiers so the plan can be looked up.
Rendering happens entirely on hardware we own and operate. Your prompt does not leave our machines to reach a third-party model provider.
Cookies
One cookie, and it holds your sign-in session. It is HttpOnly, so no script on the
page can read it, and it is sent only to our own API. There is no advertising cookie and no
cross-site tracker to consent to. Signing out clears it.
Prompt screening
Prompts are screened before rendering, to enforce section 5 of the terms. The screen runs on our own machines, and the prompt is not sent anywhere to be screened. A refusal appears in the server log with the request, in the same way as any other refused request. We keep no separate list of refused prompts.
Your rights
- See it. Your prompts, settings and seeds are in your run history in the studio. For anything else, ask.
- Delete it. Delete a single run from the studio, or the whole account from the account page. Account deletion removes your runs, your images, your uploads and your API keys.
- Take it. Download any run as one zip, from the studio or
from
GET /jobs/{id}/archive. - Correct it. The studio has no field for changing an email address or a username yet. Write to us and we change it for you.
To exercise a right this page does not cover, write to support@pixelforge.app. We answer within 30 days.
Security
- Passwords are hashed, never stored in a readable form.
- API keys are hashed. The key is shown once, at creation, and cannot be read back.
- A delivered PNG carries no embedded prompt: the metadata chunk is stripped on the way out.
- A request without a key answers 401. A request for a run that is not yours answers 404, the same as one that does not exist.
Changes
If we change what we collect or who receives it, the date at the top of this page changes and the change is announced in the studio.
This page describes the service as it runs today. It is written in plain language and has not been reviewed by a lawyer. If you need a data-processing agreement, write to support@pixelforge.app.