Privacy Policy

1. Introduction

PixGuard ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our copyright detection service.

2. Information We Collect

2.1 Personal Information

When you create an account, you sign in with Google through our authentication provider, Clerk. We collect:

• Email address
• Full name
• Profile picture URL
• Your Clerk account ID
• Your email notification preferences

2.2 Image Data

When you analyze images, we collect:

• Image fingerprints: perceptual hashes (such as pHash, aHash and dHash), a content hash, and on Pro and Business, AI embeddings (numeric descriptions of an image used for similarity matching). These are not the full image
• Image URLs of the images found in your website scans
• File names of the images and PDFs you upload
• EXIF, IPTC, XMP and C2PA metadata (if present)
• Image dimensions and file size
• Analysis results (risk scores, signals, matches, source lookup and AI vision review results)
• Timestamp of analysis
• Preview thumbnails: for images you upload in the dashboard, a JPEG copy resized to at most 800 pixels, stored in Cloudflare R2 so it can be shown in your history

Important: We do NOT keep your original image files. An image you upload in the dashboard is held on our server only until its analysis finishes (at most about two hours if processing stalls). Images in website scans and API requests are analyzed in memory and not saved. We do keep the fingerprints, results, and preview thumbnails listed above.

PDFs: When you upload a PDF (Pro and Business), we extract the images inside it and analyze each one. We store the result for each image, but not the PDF itself.

Free check without an account: We fetch the page you enter and up to 3 of its images, analyze them, and then delete the images. Nothing is saved to an account. To enforce the limit of 3 free checks a day, we keep your IP address in server memory for up to 24 hours.

2.3 Usage Data

• Credit balance and transaction history
• Scan history (website URLs scanned, timestamps)
• Login timestamps
• Browser type and device information
• IP address (for security purposes and to enforce free check limits)
• Pages you visit and how you use the site, collected by the analytics tools described in Sections 4 and 8

2.4 Payment Information

Payment processing is handled by Paddle, our Merchant of Record. We store:

• Paddle transaction and subscription IDs
• Purchase amounts and dates
• Plan or image pack purchased

We do NOT store credit card numbers or payment details. These are handled securely by Paddle.

2.5 Email Sign-ups and Messages

• If you use "Email me a summary" on the free check, we email you a summary of that check and add your email address to our newsletter list
• If you subscribe to our newsletter, we store your email address and the date you subscribed
• When you create an account, we add your name and email address to our mailing list with our email provider, Resend
• If you use our contact form, we receive your name, email address, and message

You can unsubscribe from newsletter and product emails at any time using the link in any of them.

3. How We Use Your Information

We use your information to:

• Provide the service: Process image analyses, manage credits, maintain accounts
• Caching: Store image fingerprints and analysis results so repeat checks of the same image cost 0 credits. This cache is shared across accounts: if someone else checks the same image, they receive the cached result, but not your identity or account details
• Improve ML models: Use anonymized analysis data to train and improve our detection algorithms
• Customer support: Respond to inquiries and resolve issues
• Security: Detect fraud, abuse, and unauthorized access
• Legal compliance: Comply with laws and regulations
• Communications: Send service updates and security alerts, account emails (such as scan-complete, low-credit, and monitoring emails), and product emails (such as tips, reminders before free credits expire, and plan offers). Product emails are on by default for new accounts. You can turn them off in Settings or with the unsubscribe link in any of them
• Analytics and advertising: Understand how the site is used and measure how our ads perform (see Sections 4.2, 4.3, and 8)

4. Data Sharing and Disclosure

We do not sell your personal data for money. We do use advertising tags (Google Ads and Microsoft Advertising) to measure our ads, which some US state privacy laws treat as "sharing" personal data for advertising. You can opt out with "Your privacy choices" in the site footer, and we treat a Global Privacy Control signal from your browser as an opt-out of those tags. We may share information with:

4.1 Service Providers

• Clerk and Google: For account sign-in (you sign in with Google through Clerk)
• Paddle: For payment processing, subscriptions, and billing, as our Merchant of Record
• Hosting providers: Vercel (website and dashboard), Hostinger (the virtual private server that runs our API and image analysis)
• Cloudflare: For network security and traffic routing, and R2 file storage (including preview thumbnails of dashboard uploads)
• Database providers: Supabase (PostgreSQL, our main database, hosted in Singapore), Aiven (Redis, for job queues and short-term caches)
• Google Cloud Vision: On Pro and Business, receives image content to detect text in images and to look up web pages where a matching image appears
• OpenRouter: Receives image content for AI vision review (mainly on Pro and Business) and passes it to the AI model providers it works with
• Modal: Backup image-analysis servers, which receive image content only if our own analysis server is unavailable
• Resend: For sending email and managing our mailing list
• Sentry: For error monitoring
• Analytics and advertising: PostHog, Microsoft Clarity, Google Analytics, Google Tag Manager, Google Ads, and Microsoft Advertising (see below)

4.2 Microsoft Clarity

We partner with Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization and fraud/security purposes. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

4.3 PostHog, Google, and Microsoft Advertising

We use PostHog for product analytics and session replay. Its data is processed on PostHog's servers in the United States. For signed-in users, PostHog receives your account ID, email address, and plan so that usage is linked to your account. We use Google Analytics and Google Tag Manager for site analytics, and the Google Ads and Microsoft Advertising (UET) tags to measure how our ads perform. These tools use cookies and similar technologies. For more information, see the PostHog Privacy Policy, the Google Privacy Policy, and the Microsoft Privacy Statement linked above.

4.4 Legal Requirements

We may disclose information if required by law, court order, or to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or security threats
• Protect user safety

5. Data Retention

We retain your data for as long as:

• Your account is active
• Necessary to provide services
• Required by law (tax records: 7 years)

Specific retention periods:

• Website scan results (image URLs, scores, and source lookup results): deleted automatically 365 days after the scan finishes
• Image analysis history (dashboard uploads, PDFs, and API requests): kept until your account is deleted
• Preview thumbnails of dashboard uploads: shown in your history for 3 days, after which we stop displaying them. You can ask us to delete stored copies at any time
• Original image files uploaded in the dashboard: deleted once analysis finishes, and within about two hours at most
• Free check images: deleted right after analysis
• Lists of image URLs found during a website scan: kept for 14 days so an unfinished scan can be resumed
• Shared analysis cache (image fingerprints, embeddings, and results): kept while it is in use. Entries that have not been used for 90 days and were used no more than twice are deleted automatically. Cache entries are not linked to specific users after account deletion
• Mailing list: until you unsubscribe

When your account is deleted, we delete your account record together with your scans, analysis history, credit history, monitoring settings, and API keys.

6. Your Rights (GDPR/CCPA)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in machine-readable format
• Opt-out: Unsubscribe from product and newsletter emails at any time, using the link in any of them (account holders can also turn product emails off in Settings)
• Objection: Object to data processing for specific purposes
• Opt-out of sale or sharing: Turn off analytics and advertising tags with "Your privacy choices" in the site footer; a Global Privacy Control signal turns off the advertising tags automatically

To exercise these rights, contact us at: [email protected]

7. Security

We implement industry-standard security measures:

• HTTPS encryption for all data transmission
• JWT tokens for authentication
• Encrypted database connections
• Regular security audits
• Access controls and monitoring

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. Cookies, Tracking, and Consent

We use:

• Essential cookies and local storage: Authentication tokens and session management (Clerk), your cookie choice, and a cookie that records whether your country needs a consent banner (required)
• Analytics and advertising cookies: PostHog, Microsoft Clarity, Google Analytics and Google Tag Manager for analytics, and the Google Ads and Microsoft Advertising tags for measuring our ads

How we obtain consent:

• Visitors in the EU, EEA, UK, Switzerland and Brazil (and anyone whose country we can't determine): a consent banner is shown, and no analytics or advertising tools load until you click "Accept". This applies when you are signed in too; creating an account is not consent to these tools. If you decline, the site works normally without them.
• Visitors in other countries: no banner is shown and analytics load by default. The advertising tags don't load if your browser sends a Global Privacy Control signal, and you can turn everything off with "Your privacy choices" in the site footer.

You can change or withdraw your choice at any time with "Your privacy choices" in the site footer, by clearing this site's cookies and local storage, or by contacting us. See our Cookie Policy for details.

9. Children's Privacy

PixGuard is not intended for users under 18. We do not knowingly collect data from children. If we discover we have collected data from a child, we will delete it immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. Our main database is hosted in Singapore, and our servers and several of our service providers are in the United States. We ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for GDPR compliance).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the service. Continued use after changes constitutes acceptance.

12. Contact Us

For privacy-related questions or to exercise your rights:

Email: [email protected]