Privacy policy

Last updated: [DATE]

DRAFT — This text is a starting point that describes how the service actually works. It must be reviewed by a legal professional (for example under Mexico’s LFPDPPP, GDPR or other applicable law) before production use.

1. Who we are

[LEGAL ENTITY NAME] operates PixKit by xibi. Contact: xibiapp@gmail.com.

2. Your images never leave your device

All image processing (conversion, compression, resizing, renaming, metadata removal) runs in your browser, on your device.
We do not upload, receive or store your images, ZIP files, folder names, file names or image metadata.
The site sends a Content Security Policy that prevents the page from sending data to any domain other than this site and our authentication provider.

3. Data we process

The free tools require no account. If you create an account for Pro, we process:

Account data: email address and user identifier. If you sign in with Google, the basic profile data Google shares (such as your name).
Subscription data: subscription status, billing period dates and our payment processor’s customer identifier.

We never see or store your card details: payments are processed directly by Stripe.

4. Contact form

Image processing and the contact form are different things. Your images stay on your device. A message you send through the contact form is information you choose to send us:

What we receive: the name, email address, subject and message you write — nothing about your images, files or activity in the tools.
Purpose: to read and answer your request. Your email address is used to reply to you.
How: the form is delivered by email to our inbox through an email delivery provider. To prevent abuse we keep, for up to 24 hours, a one-way hash of the IP address that sent it (not the IP itself).

You can also write directly to xibiapp@gmail.com. [Define how long contact messages are kept.]

5. Service providers

Supabase — authentication and the database for accounts and subscriptions.
Stripe — payments, invoicing and the customer portal.
Cloudflare — hosting and delivery of the website; may log technical data such as IP addresses.
Resend — delivery of contact form messages to our inbox.
Google — only if you choose to sign in with Google.

Each provider processes data under its own privacy policy. [Review server locations and international transfers.]

6. Browser storage and analytics

Your browser stores your language and theme preferences locally and, if you sign in, your session so it survives a page reload. We use no advertising cookies. We currently do not use third-party analytics. If added, it will only record anonymous usage events (for example which tool was opened and a rough number of files), never file names, folder names, metadata or file contents, and this policy will be updated.

7. Retention and your rights

Account data is kept while the account exists. You can request access, correction, deletion or object to processing by writing to xibiapp@gmail.com. [Define retention periods and procedure.]

8. Changes

Changes will be published on this page with the date of the update.