Privacy Policy

Last updated: 10 September 2026

This policy explains how PixGB (https://pixgb.com) processes personal data. We aim to comply with UK GDPR and the Data Protection Act 2018. Controller contact: abuse@pixgb.com.

1. Data we collect

• Account data: username, email address, password hash (we do not store plaintext passwords), plan status, timestamps, ban status.
• Upload / content metadata: original filename, size, content type, dimensions, SHA-256 hash, public/private flag, album association, short codes/slugs, timestamps.
• Image files: the binary content you upload (and separately generated gallery thumbnails).
• Abuse and security data: upload IP address, user agent, report submissions, moderation notes, audit logs.
• Billing: Stripe customer and subscription identifiers; payment card details are processed by Stripe and not stored by PixGB.
• Usage: storage used, approximate view and bandwidth counters.
• API: API token identifiers and related request activity when you use the API.

2. Purposes and legal bases

• Contract: creating accounts, hosting images, enforcing plan limits, providing billing portals.
• Legitimate interests: securing the service, preventing abuse/fraud, improving reliability, basic analytics of aggregate usage.
• Legal obligation: responding to valid legal process; retaining and disclosing information required for investigations into illegal content (including CSAM), tax, or regulatory duties.
• Consent: where we ask for optional marketing (we do not currently send marketing email by default).

3. Public vs private content

Public uploads and associated usernames may be visible on the gallery, profiles, and via direct links you share. Private uploads are restricted as described in the Terms; metadata may still be processed by us for hosting and abuse prevention.

4. Sharing

We do not sell personal data. We share data with:

• Processors needed to run the service (e.g. hosting/VPS provider, Stripe for payments, email provider if password reset is enabled).
• Authorities and rights holders when required by law or to report illegal content — including reporting child sexual abuse material to the appropriate authorities.
• Professional advisers under confidentiality where needed.

5. International transfers

Infrastructure or processors may process data outside the UK. Where required, we use appropriate safeguards (such as UK adequacy regulations or standard contractual clauses).

6. Retention

Account and content data are kept while your account is active. After deletion or account closure we aim to remove content within a short operational window, except where we must retain data longer for legal claims, security, or mandatory reporting (including CSAM-related evidence). Server and access logs are retained for a limited period for security and abuse handling.

7. Your rights

Under UK GDPR you may have rights to access, rectification, erasure, restriction, portability, and objection, and to complain to the ICO (ico.org.uk). Some rights are limited where we must retain data for legal reasons (for example ongoing investigations into illegal content). Contact abuse@pixgb.com.

8. Children

The service is for users aged 18+. We do not knowingly create accounts for children. Sexual content involving minors is prohibited and reported as described in the AUP.

9. Cookies

We use essential cookies for authentication and security (session cookies). We do not use third-party advertising cookies.

10. Security

We use reasonable technical measures (HTTPS, hashed passwords, access controls). No method of transmission or storage is perfectly secure; protect your password and API token.

11. Changes

We may update this policy by posting a new version with a revised date. Material changes will be noted on the site where practical.