Privacy Policy
Last updated: September 2026
What we collect
When you register, we store your email address and a hashed password. We never store raw passwords or raw API keys.
When you upload images, we store the image file in Cloudflare R2 and metadata (file size, dimensions, MIME type, upload date) in our database.
Our servers also keep short-lived request logs — timestamp, request path, response status, duration, IP address, and browser user-agent — so we can debug failures and investigate abuse. These logs are held by Cloudflare on our behalf for a short retention window (currently 3 days) and then deleted automatically. We don't use them to build profiles, track you across sites, or target advertising.
What we don't do
- We don't sell your data.
- We don't use your images for training AI models.
- We don't track you across the web.
- We don't use tracking cookies, cross-site trackers, or ad networks.
Analytics
We use Cloudflare Web Analytics to understand aggregate traffic. It is privacy-first: no cookies, no client-side state, and no fingerprinting, and it stores no personal data in your browser — so PixelVault needs no cookie-consent banner. The only thing we store in your browser is a login token (when you sign in), which is strictly necessary to keep you signed in.
Where your data lives
Your images and core account data are stored at rest in the European Union: image files in Cloudflare R2 (EU jurisdiction) and your account details and image metadata in our Neon PostgreSQL database (EU region). Our application runs on Cloudflare's global edge network, so each request is processed at the location nearest you. A couple of subprocessors (below) — transactional email and aggregate analytics — may process limited data outside the EU under standard data-protection safeguards.
Subprocessors
We rely on a small set of infrastructure providers, each under a data processing agreement:
- Cloudflare — image storage (R2, EU), CDN, edge compute, cookieless analytics, and short-lived server request logs.
- Neon — PostgreSQL database (EU region) for account and image metadata.
- Plunk — transactional email (e.g. verification, password reset).
Data deletion
You can delete any image via the API. To delete your entire account, contact us at privacy@pixelvault.dev.
Contact
Questions about privacy? Email privacy@pixelvault.dev.