Privacy Policy

1. Key points

• pixkoz is run by BinaryBuddies, from India. Write to hello@binarybuddies.in about anything in this policy.
• We collect what you give us (your name and email from Google sign-in, your profile, likes, blocks and reports, and on the website the photos you cast and your credit purchases), what you do on pixkoz (such as the spells you view, copy and share), and technical data such as your IP address in our server logs.
• We do not sell your data, show ads, use advertising IDs or use tracking cookies, and no advertising company tracks you on pixkoz.
• We count what people do on pixkoz, such as the spells they open, prompt copies, Open in ChatGPT and Gemini taps, shares and searches, with our own usage statistics, to improve pixkoz and show creators how their spells do. While Usage statistics are on, we also use PostHog (data kept in the EU) on app.pixkoz.com and in the app, and Google Firebase in the Android app, for the same statistics, short surveys and error and crash reports; they never get your search words, photos or prompts. None of this is used for ads, and on the websites none of it stores a cookie or anything else on your device that recognises you. You can switch Usage statistics off in Settings; in the EEA, the UK and Switzerland they are off until you switch them on.
• The For you feed on Discover orders spells for you from what you do on pixkoz, such as the spells you copy, open in ChatGPT or Gemini, share, like and open, and from the ones it has already shown you, so that you see fewer repeats. It never uses your search words. Turn off Personalised For you feed in Settings and what it kept about you is deleted. In the EEA, the UK and Switzerland, while you are signed in, it learns from the cards you see and the spells you open, copy and share only once you have switched Usage statistics on (section 5).
• Our servers are in Germany. Cloudflare stores and delivers images and counts visits to our websites without cookies, and Google handles sign-in and, in the Android app, delivers the phone notifications you turn on. On the website, AI models from Google (Gemini) and OpenAI (GPT), reached through OpenRouter, create AI results, Anthropic's Claude (or, as a backup, another model through OpenRouter) suggests text to creators in Studio with Write with AI and runs the automatic safety check, and Razorpay takes payments.
• On the website, we check uploaded photos and results automatically for nudity, sexual content and anything that could harm a child, and we block what breaks our rules.
• You have the same rights wherever you live, and you can delete your account yourself at any time (section 12).
• pixkoz is only for adults aged 18 or over.

2. Who we are

pixkoz is run by BinaryBuddies, based in India, which is also the developer of the pixkoz app on Google Play. In this policy "pixkoz", "we" and "us" mean BinaryBuddies. We decide how and why your personal data is used, which makes us its controller (its "data fiduciary" under Indian law).

pixkoz is a library of AI photo styles, called spells, made by creators. On the website you can cast spells on your photos with credits, copy the prompts of free spells and publish spells of your own; the Android app lets you browse, search, like and share spells. This policy covers the website at app.pixkoz.com, the pixkoz Android app and pixkoz.com. Where the app works differently, section 10 says so. It explains what we do with your data; it is not something you have to agree to.

Privacy requests, legal notices and questions about this policy: hello@binarybuddies.in. Help with the product: contact@pixkoz.com.

3. What we collect

From you

• Account — your email address and name. Accounts are created with Google sign-in. A few accounts we create ourselves (for example for app review) sign in with an email and password instead; we store only a hashed form of that password. Required: without them we cannot create your account.
• Profile — the name you show (alias) and a profile picture you upload. Creators can also add a bio, a website and social handles. Optional. A creator's alias, picture, bio and links are public.
• Likes, dislikes and blocks — the spells you like or dislike and the creators you block. Optional.
• Reports — when you report something, we keep your account ID, what you reported, the reason you chose, any note you add, and whether you used the app or the website. A report sent from Report a problem, on the Contact us page, also keeps your device and browser type, to help us reproduce the problem, and, if you are not signed in, the email address you give us so we can reply. The spells you report are kept with your account so we can leave them out of what you see. Optional.
• Searches — the words you search for are sent to our server to find results. They are not saved to your account. Our usage statistics keep them without your account (below), and they can appear in our server logs (below). Your last 8 searches are kept on your device only.
• Spells you publish — if you are a creator, the spells you publish: their title, description, prompt and images.
• Photos you cast (website) — the photos you upload to cast a spell, and the results we make from them (section 6). Optional: only if you cast.
• Payments (website) — when you buy credits, Razorpay processes the payment. We receive the order and payment confirmation and keep a record of your credits, purchases and refunds. We never receive or store your full card, bank or UPI details. When you buy a pack priced in US dollars we keep the country your card was issued in and the country your connection comes from, as tax records.
• Creator earnings (website) — if you earn creator revenue, records of your earnings and payouts. Creators who cash out give us their PAN, the name on it, and a bank account or UPI ID; we keep them to pay you and to meet tax law, and share them with Razorpay to make the payment.
• Messages — what you write to us for support or other requests.
• Suggestions — what you send with Suggest an idea or Request this look (in Settings, in Help, and under a search that found no spell): the kind of suggestion, your text with any links taken out (up to 1,000 characters), the spell it is about, the page you sent it from, whether you used the website or the app (and the app's version) and, if you are signed in, your account. We keep it in our own database; nothing in it identifies you if you send it signed out. Your IP address is used only for a moment, to limit how many can be sent, and is not stored. Please leave out personal details. Optional.
• Survey answers — if you answer one of our short surveys in the product (shown by PostHog, only while Usage statistics are on and you are signed in), your answers go to PostHog with your statistics. Optional.

Automatically

• Spells you view — while you are signed in and Personalised For you feed is on, staying on a spell's page for about 10 seconds records that you viewed it (at most once a day per spell; in the EEA, the UK and Switzerland, only once you have switched Usage statistics on, section 5).
• Your For you data — while you are signed in and Personalised For you feed is on: your interests (the kinds of spells you seem to like, worked out from what you do), a record of the spells you were shown, opened or used, your recent feed signals, and an older profile of the styles and creators you seem to like, worked out from your likes, dislikes and views and, on the website, your casts (section 5).
• Notifications — the messages on your Notifications page, when you last opened it, whether news shows there, and, for a policy notice, when you saw it and when you tapped Got it.
• Phone notifications (Android app) — if you turn them on: the kinds you chose (Your account, Your spells, News and new looks), and for your last change of them when you made it, which version of our words you agreed to and whether you were in the app or on the website. For each phone you get them on, while you are signed in: its push token (a random ID that Google Firebase Cloud Messaging gives the app to deliver notifications; not your phone number or a hardware ID), the app's version, your phone's time zone (so that none arrive at night), whether notifications from pixkoz are off in the phone's settings, and when the app last checked in. And a log of the phone notifications we sent: which one, to which phone, when, and whether it was delivered to Firebase.
• Usage statistics — on the website and in the app we record what you do on pixkoz: the pages and screens you open, and how long you stay on a spell's page; the spells you view, and the list, feed or search you found them in; which spell cards were shown on your screen in a list, and how far down a list you scrolled; when you copy a prompt, open its how-to, open it in ChatGPT or Gemini, press Cast on the website or share something (and through which app); the searches you run and how many results they found; when a sign-in is asked for, started and finished; when you open a notification; and when you open the app, or open a page in it from the website. Each record says when it happened, whether it was on the website or in the app, your country (worked out by Cloudflare from your IP address), your type of device (phone, tablet or computer), the app's version and, if you are signed in, your account. A visit also gets a random number that exists only while that browser tab, or the app, is open, and each list you look through gets one of its own, so the steps of one visit can be counted together; they are not stored on your device and are gone when you reload or close it (the For you feed's own visit number is in section 9). Your IP address is used, with your browser's type, only to make a code that changes every day, so we can count how many different people visit in a day; the IP address and your browser's details are not stored. Search words are kept apart from everything else: without your account, and with nothing that links them to your other actions. We never record your email address, your name, your photos or the text of a prompt. With Usage statistics off, and in the EEA, the UK and Switzerland until you switch them on, your actions are counted only anonymously: without your account, your visit's number or the daily code. The For you feed is separate (section 5): outside the EEA, the UK and Switzerland, it learns from what you do while you are signed in and Personalised For you feed is on, whatever Usage statistics says. Creators see totals made from these records for their own spells only, never who did what: for example views, copies and shares, the websites that sent them 2 or more visits, and search words only when 3 or more people searched for them. A link shared from pixkoz carries a mark so that visits from shared links can be counted: ref=share, or ref=own when creators share a link to their own spell or page, so that visits from it can be counted for them. The mark is in the link, and nothing is stored on the visitor's device.
• PostHog and Firebase — while Usage statistics are on, part of these statistics also goes to PostHog, from app.pixkoz.com and the app (not from pixkoz.com): the pages and screens you open, the spells you view and the list they were in, prompt copies and Open in ChatGPT or Gemini taps, shares and the app they went through, how many results a search found (never the words you searched for), sign-in steps and app openings; and, from our server, when a cast on the website finished or failed, when a credit purchase was paid (the credits, the amount and the currency, never payment details), and when a spell of yours is sent for review or published. In the Android app, the app's own events also go to Google Firebase (Google Analytics for Firebase and Firebase Crashlytics). With each event they get when it happened, your browser or device type and model, its operating system and language, and the app's version; PostHog also gets your country (from Cloudflare). PostHog and Google can work out your approximate location (region and city) from your IP address; PostHog is set not to keep the address. They also get error reports (what went wrong on a page or in the app, and where in our code) and, in the app, crash reports. How visits are told apart: PostHog stores nothing on your device that recognises you. When you are signed out, it counts you by a code its servers make from your IP address and browser, which changes every day; when you are signed in, we give it (and, in the app, Firebase) a random analytics ID that we made for this, never your account number, name or email address, and the visit's own numbers stay in its memory only. Firebase, in the app, keeps its own random IDs on your phone (section 10). We never send them your email address, your name, your photos, the text of a prompt or your search words, and sign-in tokens and codes are taken out of page addresses before anything leaves your device. Session recording, heatmaps and automatic click capture are off. With Usage statistics off, and in the EEA, the UK and Switzerland until you switch them on, nothing is sent to PostHog or Firebase.
• Technical data — your IP address, browser or device type, and the pages and requests you make. These are recorded in our server logs, and a log line can include your account number, your search words and, when you sign in, your email address. We also use your IP address for a short time to limit abuse, such as repeated sign-in attempts. Apart from our own usage statistics, PostHog and Firebase (above) and the visit counting below, we use no analytics or crash-reporting service.
• Visits to our websites — on app.pixkoz.com and pixkoz.com (not in the Android app), we use Cloudflare Web Analytics to count visits and measure how fast our pages load. For each page you open it records the page's address, the page you came from (the referrer), your browser and device type, your country and how long the page took to load. It sets no cookies, stores nothing on your device and does not track you across sites. Your browser sends this to Cloudflare (section 7), which works out your country from your IP address; we see only totals.
• Storage on your device — the cookies and stored items in section 9.

From others

• Google — when you sign in with Google, Google gives us your name, email address and profile photo. We keep a copy of that photo on our server as your account's default picture; it is not shown publicly and is deleted with your account. Your name is refreshed from Google each time you sign in.
• Other people — if someone reports your spell or profile, we receive their report. We do not tell you who reported you.

4. Why we use it, and our legal basis

The legal basis matters mainly if you are in the EEA, the UK, Switzerland, Brazil or a country with a similar law.

• Run your account and the service — sign you in, show your profile, likes, blocks, Liked list and Notifications page, and publish spells; on the website, cast spells on your photos and run your credits and creator earnings. Basis: to provide the service you asked for (contract).
• Order your For you feed from your activity, and remember which spells it has shown you (section 5). Basis: our legitimate interest in showing you spells you are likely to enjoy, and not the same ones again. You can object at any time by turning off Personalised For you feed (section 13). In the EEA, the UK and Switzerland, the cards you see and the spells you open, copy and share are used for it only once you have switched Usage statistics on where it says so (section 5), and for that part the basis is your consent.
• Count what people do on pixkoz, measure how fast our pages load, and find and fix errors — usage statistics (views, prompt copies, Open in ChatGPT and Gemini taps, shares, searches, likes and dislikes, cards shown in lists), visits to our websites and, while Usage statistics are on, the same statistics, short surveys and error and crash reports with PostHog and Firebase, to see which spells people use and which searches find nothing, to improve pixkoz and fix what goes wrong, and to show creators totals for their own spells. We look at the results in aggregate. Basis: legitimate interest; you can object at any time by switching off Usage statistics in Settings (section 13). In the EEA, the UK and Switzerland, counting that includes your account or your visit, and anything sent to PostHog or Firebase, happens only if you switch Usage statistics on, and then the basis is your consent; otherwise your actions are counted only anonymously.
• Read your suggestions and decide what to add or fix. Basis: your request, and our legitimate interest in improving pixkoz.
• Show news about pixkoz and new looks on your Notifications page (from November 23, 2026, never ads). Basis: legitimate interest; you can turn it off in Settings → Notification settings.
• Keep a record that you saw a policy notice. Basis: legitimate interest in showing we told you about a change.
• Send the phone notifications you turned on (Android app): about reports you made and your account, your spells, or news and new looks. Basis: your consent; you can withdraw it at any time by turning them off in Settings → Notification settings or in your phone's settings.
• Keep pixkoz secure — limit abuse, keep server logs and investigate problems. Basis: legitimate interest in protecting the service and the people who use it, and the law that applies to us.
• Review reports, moderate content and tell people what we decided. Basis: legal obligation (for example the EU Digital Services Act and India's IT Rules) and our legitimate interest in keeping people safe.
• Keep payment, refund and payout records, including creators' PAN and payout details (website). Basis: legal obligation (tax and accounting law) and defending legal claims.
• Reply to your messages and requests. Basis: contract or legitimate interest.
• Check uploaded photos and results for unlawful content (website). Basis: our legitimate interest in a safe service, and our legal duties (for example India's IT Rules and the Protection of Children from Sexual Offences Act).
• Report child sexual abuse material and serious threats to the authorities. Basis: legal obligation and protecting someone's vital interests.

We send no marketing by email or phone notification unless you turn it on. If we ever want to use your data in a way that needs your consent, we will ask first.

5. Recommendations and automated decisions

The For you feed on Discover orders spells for you. While you are signed in and Personalised For you feed is on in Settings (it is on unless you turn it off), it learns from what you do on pixkoz, on the website and in the app:

• What you do with a spell — copying its prompt, opening it in ChatGPT or Gemini, sharing it, liking it, opening it, staying on its page (for about 10, 30 and 60 seconds) and opening its How to use, and, on the website, casting it, wherever you found it. Not for me and reports push similar spells down.
• The cards it showed you — which spell cards appeared on your screen in Discover (in every tab) and on the home page, so that For you does not show you the same spells again, and learns a little from the ones you passed by. Cards you were shown in search results, hashtags, topics, creator pages and "More like this" are noted only so that For you does not push them at you straight after (a small effect that lasts 3 days).

It never uses your search words. From these actions it works out your interests: the kinds of spell you like, such as saree portraits, couple photos or a festival look, how much, and which ones you said no to. It starts with your first action, with no minimum to reach: until it knows you a little, it shows the same kind of mix that new visitors see, popular, new and trending spells, and it leans towards your interests as you use pixkoz. Recent actions count more than old ones.

Fewer repeats. A spell you were shown in Discover or on the home page, or opened, is not shown in For you again for 14 days, and never twice in one visit. A spell you copied, opened in an AI app, liked or cast is left out for 7 days; on the website, and in newer versions of the app, the ones you most recently copied, opened in an AI app or cast (up to 20, from the last 90 days) wait for you in a Recently copied row on For you. The 14 days have two exceptions. When you have seen everything else, For you shows the spells you have not seen for longest (the website and newer versions of the app first say "You're all caught up"). And now and then, when few new spells are left in one of your favourite looks, it brings back a spell of that look that you saw at least 3 days ago and did not use (marked "Seen before" there).

Visits. While you are signed in, every time you open pixkoz or reload the page, For you gets a new order. It keeps your place when you go off to use a prompt: if you copy a prompt, open a spell in an AI app or share it, and pixkoz reloads when you come back up to 45 minutes later, you get the same list again, from the top (on the website and in older versions of the app, a reload in the first 5 minutes still gives a new order); any other reload gives a new order. To keep a visit's order in place, the website and the app keep a random visit number for a short time (section 9).

Your own choices. Not for me, reports and the creators you block keep those spells out of For you, whether or not it is personalised.

Looks, not people. For you's interests are about photo looks, such as the topics on our website, not about you: we never try to work out your religion, caste, gender or age. Festival looks, such as Diwali or Eid, only order your own feed: your interest in them fades twice as fast as other interests, and it is never used to group people. To time festival looks, For you uses the country your connection comes from, for that request only; it is not stored with your feed data.

In the EEA, the UK and Switzerland, and when we cannot tell which country you are in, while you are signed in, the cards you see and what you do on the website or in the app (opening a spell, time on its page, How to use, copies, Open in ChatGPT or Gemini, shares) shape For you only once you have switched Usage statistics on where it says that For you can learn from them: in Settings, or when newer versions of the app ask. If you switched it on before it said so, or in an older version of the app, those actions count only for our statistics until you switch it off and on again in Settings. Your likes, Not for me and reports, and your casts, are choices you make yourself, so they count either way. Everywhere else, India included, For you follows its own switch, whatever Usage statistics says.

Turning it off. Turn off Personalised For you feed in Settings and we delete your interests, the record of the spells you were shown, opened or used, your recent feed signals (so Recently copied starts empty), the older profile and the spell views of section 3, and our short-lived memory of your visit, and we keep nothing new while it stays off. For you then shows a mix of popular, new and trending spells that isn't based on you. Turned back on, it starts again from your likes, casts and Not for me. Deleting your account deletes all of it too (section 12).

Signed out. If you are not signed in, For you shows a mix of popular, new and trending spells that changes often. It is not based on you, and nothing about you is stored for it. Within one visit it may lean towards the spells you opened, copied or shared in that visit, and the spell a shared link opened, which your browser or the app holds in memory only, until you reload or close it. This happens in every country, because nothing is stored.

What our staff can see. To check that For you works and to help with support, a few administrators can open a summary, in words, of one person's For you interests, with the last few spells they copied, and a preview of the next cards For you would show them. Every look is logged, and the log is kept for 12 months, or until that person's For you data is deleted; your own Download your data lists the looks at yours. Nothing is exported. In the summary, festival interests show only as a number, and festival spells are left out of the last copied ones; in the preview, a card picked because of a festival interest is hidden.

For you only changes the order of spells. It makes no other decision about you, and nothing with legal or similarly significant effects. Newest, Popular and Top are not personalised. You can object to For you at any time (section 13).

Moderation. A person decides every report. To protect people while that happens, a spell is hidden automatically as soon as it is reported as involving a child, or when 3 or more different people report it for one of our most serious reasons. It stays hidden until a moderator decides. Spells from creators who are not yet trusted are checked by a person before they appear. On the website, we also check uploaded photos and results automatically (section 6). An automatic block stops only that cast or test, and you are not charged for it; a person reviews every block that may involve a child or sexual content, and you can ask us to review any block. We also automatically limit how often anyone can sign in, vote or report.

6. Your photos and AI

Spells, and the results they make, are AI-generated images. On pixkoz, spell images carry a visible "AI-generated" label on the spell page, as every image does in full-screen view, and each spell's menu has an "About this image" note. Pictures in grids carry a small AI mark. The share card and the link previews pixkoz makes carry the label too, and every AI-made picture pixkoz shows or lets you download carries embedded information that marks it as AI-made: downloads keep the Content Credentials (C2PA) and any IPTC data added by the AI model's maker, and the copies shown on screen carry IPTC data naming pixkoz. None of it includes your name or account. When you cast a spell on the website, your browser shrinks the photo and removes its hidden details, such as location (EXIF). We store it and send it, with the spell's prompt, through OpenRouter to the AI model the spell uses: Google's Gemini or OpenAI's GPT. They process it under their API terms to produce your result and send it back.

We do not use face recognition. We do not create face templates, faceprints or other biometric identifiers, and we never use your photos to identify anyone. We do not sell your photos or results, and we do not use them to train AI models of our own.

Photos of people. When you cast a spell or run a Studio test with your own photo, you confirm that it is of you, or that the people in it agreed to it; we record that you confirmed it (the version of the wording and the time) with the cast.

Automatic safety check (website). Before a photo you upload is used, and before a result is shown, an AI model checks it for nudity or sexual content, signs that a child is involved, and graphic violence. It estimates whether someone looks under 18; it does not identify anyone and creates no face template. For this check we do send a smaller copy of the photo you uploaded, and of the result, to Anthropic (the maker of Claude) through its API or, if that is unavailable, through OpenRouter to Anthropic's Claude (Google's Gemini as a backup), where we ask only for routes that don't keep the picture or train on it. Anthropic uses the pictures only to run the check, under its commercial terms: it does not use them to train its models, and it deletes them within 30 days. It can keep them longer only if its safety systems flag them (for up to 2 years) or the law requires it. A blocked photo is not used or charged, and a blocked result is refunded. We keep the outcome (passed or blocked, the rule, the model, which service ran it and when, and for a block a short description for our moderators), not the picture. When a block needs a person to look, such as anything that may involve a child or a sexual result, we keep the picture as evidence for that review (section 11).

Your photos and results are kept until you delete your account; there is no way yet to delete a single cast. They are not shown to other people in pixkoz (except the Studio test results a creator chooses for a spell's page, below), but they are stored on our image storage at long, unguessable links, so anyone you give a link to can open that image. Authorised pixkoz staff may access them only where necessary to operate, support or secure the service, or to comply with the law.

My photos (website, creators). If you save a photo to My photos in Studio, we keep it until you delete it or your account. Only you and our staff can see it, unless we share it with other creators with the pictured person's agreement.

The Android app sends no photo to an AI provider: its only upload is your profile picture.

Write with AI (website, creators). In Studio, a creator can ask Write with AI to suggest a spell's prompt, name, About line, hashtags or photo names, or to fill its listing from its prompt (Fill from prompt). Only when you press the button, we send the text of that spell as it is on your screen (its prompt, name, About line, hashtags and photo names) and a list of popular public hashtags. To suggest a listing, we also send a smaller copy of the spell's cover result (before it has a cover, its newest result): an AI image, which may show a face. We never send your original photo, your name or your email address. We send it to Anthropic (the maker of Claude) through its API or, if that is unavailable, through OpenRouter to the model maker we choose (Anthropic, Google or OpenAI) with no data retention, where we ask only for routes that don't keep the data or train on it. Anthropic uses what we send only to write the suggestions, under its commercial terms: it does not use it to train its models, and it deletes it within 30 days. It can keep it longer only if its safety systems flag it (for up to 2 years) or the law requires it. Write with AI writes text only; it makes no images. Nothing on your spell changes until you pick or keep a suggestion. We keep a record of each use (when, which spell and part, the AI model and which service ran it, how much text, whether an image was sent, the request number and what it cost), not the text or the image.

If you are a creator, two kinds of image are public: your profile picture, shown with your name, and the images in the spells you publish. Your Studio test photos and results stay private until you choose a result as a spell's cover or as an example on its page; then that result is shown with the original photo it was made from, so people can compare. Only upload photos you have the right to use. Our rules forbid deepfakes of real people without their consent, intimate images shared without consent, and any sexual content involving minors.

7. Who we share data with

Companies that run parts of pixkoz for us, only on our instructions:

• Contabo GmbH (Germany, EU) — hosts our servers: the website, the app's server, our database, files, logs and backups. It holds all the data on our servers.
• Cloudflare, Inc. (United States; global network) — stores images (profile pictures and spell images, and on the website cast photos and results) in Cloudflare R2 and delivers them through its network. It sees your IP address when your device loads an image. On app.pixkoz.com and pixkoz.com it also runs Web Analytics (section 3): it receives the page's address, the referrer, your browser and device type and load timings, works out your country from your IP address, and gives us only totals.
• Google LLC (United States) — Google sign-in. Google handles your sign-in and gives us your name, email address and profile photo. Google Play also distributes the app, under Google's own terms.
• PostHog, Inc. (United States; our data is kept in the EU, in Frankfurt, Germany) — product statistics, surveys and error reports from app.pixkoz.com and the app, only while Usage statistics are on (section 3). It works on our instructions under a data processing agreement and does not use the data for itself.
• Google LLC (United States), Firebase, Android app only — Google Analytics for Firebase and Firebase Crashlytics: statistics and crash reports from the app, only while Usage statistics are on. Google processes them for us: sharing the data with Google for its own products is switched off, and the advertising ID is never collected.
• Google LLC (United States), Firebase Cloud Messaging, Android app only — delivers the phone notifications you turned on. It receives the push token of your phone and each notification: its title and text, its kind and the page it opens. Google processes them for us, under its Firebase data processing terms.
• OpenRouter, Inc., Google LLC (Gemini API) and OpenAI, L.L.C. (United States), website only — create cast results. OpenRouter passes the photo you cast and the spell's prompt to the AI model the spell uses, Google's Gemini or OpenAI's GPT, which receives them to create the result.
• Anthropic, PBC (United States), website only — runs Write with AI and the automatic safety check (section 6) through its API. For Write with AI it receives the text of that spell and, for a listing, a smaller copy of its cover result, never your original photo. For the safety check it receives a smaller copy of each photo you upload and of each result, to check it. It does not train its models on them and deletes them within 30 days, or keeps them for up to 2 years if its safety systems flag them.
• OpenRouter, Inc. (United States), website only — when Anthropic is unavailable, routes the same requests with no data retention: Write with AI to the model maker we choose, Anthropic, PBC, Google LLC or OpenAI, L.L.C. (United States), and the automatic safety check to Anthropic, PBC (Google LLC as a backup). They receive what Anthropic would, never your original photo, and don't keep it.
• Razorpay (India), website only — processes credit payments. It receives the amount, our order reference with your account number, and your name and email address to fill in the checkout. You give your card or UPI details to Razorpay, not to us, under Razorpay's own privacy policy. When a creator cashes out, it also receives the creator's name, PAN and bank account or UPI ID, to make the payment.

Public. If you are a creator, your alias, profile picture, bio, links and published spells are visible to everyone. Like counts are shown without names.

Authorities. We share information with the police, courts or other authorities where the law requires it, or to protect someone from serious harm. We report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) or the relevant national authority, as our Terms describe.

We do not sell your personal data, including photos of your face, we do not share it for advertising, and we show no ads.

8. International transfers

BinaryBuddies runs pixkoz from India. Our servers are in Germany. Cloudflare, Google and PostHog, and on the website OpenRouter, OpenAI and Anthropic, are US companies, and Cloudflare delivers images from the part of its global network nearest you. PostHog keeps our statistics in the EU (Frankfurt); Google keeps the app's Firebase statistics on its own servers, mainly in the United States, and Firebase Cloud Messaging handles push tokens and phone notifications on Google's servers in the United States. Anthropic stores the data it keeps in the United States and may process a request in another country where it runs its AI models. Razorpay is in India. So your data is handled outside your own country, where the law may protect it differently and where courts or authorities may be able to obtain it. We use providers that offer data protection terms for these transfers, such as the European Commission's standard contractual clauses where they apply. You can ask us about them at hello@binarybuddies.in.

9. Cookies and storage on your device

On the websites we use only our own cookies and device storage, and only to make pixkoz work and remember your choices. We use no advertising, analytics or tracking cookies, so we do not show a cookie banner. Our usage statistics, PostHog and Cloudflare Web Analytics (section 3) use no cookies and store nothing on your device to recognise you; the Usage statistics switch only remembers your own choice, and the one thing PostHog may keep is a survey's state (below). In the Android app, Firebase keeps its own IDs on your phone while Usage statistics are on (section 10); in the EEA, the UK and Switzerland, only once you have switched them on. If any of this changes, we will ask for your consent first.

• Website sign-in — keeps you signed in (30 days) and protects sign-in; the security cookies used during Google sign-in last only minutes.
• App sign-in token — keeps you signed in to the app for 30 days and is renewed while you use it. It is removed when you sign out and is left out of device backups.
• Feed visit — a random number that keeps one visit's For you order in place while you scroll, open spells and come back (section 5). On the website it is a cookie, set only when you are signed in, that lasts 30 minutes after you last loaded For you, or 50 minutes after you last copied a prompt, opened it in an AI app or shared a spell if that is later; in the app it is kept on your phone when you are signed in, and used for up to 50 minutes after you last loaded For you or did one of those. It holds nothing about you.
• Feed tab — the Discover tab you picked (For you, Newest, Popular or Top), kept for that browser tab until you close it, or in the app until you close the app.
• Recent searches — your last 8 searches, on this device only, removed when you clear them, sign out or delete your account.
• Preferences — your theme, your Usage statistics choice if you change it (in the app, also whether you answered its Privacy choices question), the tips you dismissed or have already seen (the prompt how-to and the copy-prompt tip on a spell page), whether you have seen the welcome after your first sign-in, and the layout of My casts on the website.
• Short-lived notes — a report or block you started before signing in (up to 30 minutes), your own profile, sign-in progress, the screen to return to, and the spells you have already viewed in this tab, so a view is counted once.
• Surveys (only while Usage statistics are on) — if PostHog shows you a survey, your device remembers that you saw or answered it, and keeps an answer you have not finished, so you are not asked again. These hold no ID, and switching Usage statistics off removes them.

Preferences stay on your device until you clear the site's or app's data. Global Privacy Control: if your browser sends it, we treat it as Usage statistics off: your actions are counted only anonymously, and nothing goes to PostHog. Outside the EEA, the UK and Switzerland, the For you feed is the one exception: it follows its own switch (section 5). Do Not Track: we do not track you across other sites or apps and let no advertising or analytics company do so on pixkoz (PostHog and Firebase work only for us, and only on pixkoz), so there is nothing more for it to switch off. Google's sign-in page and Razorpay's checkout are run by those companies under their own privacy policies.

10. The pixkoz Android app

The Android app uses the same accounts, spells and storage as the website, so everything above applies to it. In the app you can browse, search, like and dislike, share, report and block, edit your profile and delete your account. A few things are specific to the app:

• Permissions — the app requests internet access, network state so it can tell you when you are offline, and permission to keep the phone awake for a moment, which Firebase uses to finish sending statistics and to receive notifications. These need no prompt. If you turn on phone notifications, the app also needs permission to show notifications: from Android 13, Android asks you, only after you choose to turn them on; on earlier versions it is allowed unless you switch it off. You can turn phone notifications off at any time, in the app under Settings → Notification settings, or in your phone's settings (Apps → pixkoz → Notifications). It does not request access to your camera, microphone, contacts, location, or device files. You choose photos through your device's own picker, which hands us only the image you picked.
• Photos — an image you choose, such as a profile picture, is uploaded to our storage (section 7). If you are a creator, your profile picture is public: it is shown with your name, for example on your creator page. The app does not scan, index, or read your photo library, and sends no photo to an AI provider.
• Sign-in — Google sign-in uses your phone's Google account chooser, or opens in a browser tab, then returns you to the app.
• Stored on your device — a sign-in token, so you stay signed in, your recent searches, the For you visit number while you are signed in, and small preferences such as your theme and your Usage statistics choice (section 9). While Usage statistics are on, Firebase keeps its random IDs (an app instance ID and an installation ID) and any reports it has not sent yet; switching them off deletes the unsent reports and starts the app instance ID again, and so does signing out. The app also keeps a small count to decide when it may ask Google Play for its rating card (below): when it first ran, how many times you opened it and liked a spell, and when it last asked; it never leaves your phone. For phone notifications it keeps, also only on the phone, when it last offered them and how often you said Not now or Don't allow (so that it rarely asks), and whether this phone is registered for them and for which account; while they are on, Firebase keeps the push token on the phone. Signing out removes the sign-in token, the push token and your recent searches; uninstalling the app or clearing its data removes everything.
• Payments — there are no purchases in the app, and no payment details are collected in the app at all.
• Usage statistics — the app records the same usage statistics as the website (section 3), with the app's version and when you open it. While they are on, the app also sends them to PostHog and to Google Firebase, which adds crash reports (section 3). The first time you open the app, it asks whether to switch them on (in the EEA, the UK and Switzerland) or tells you that they are on (elsewhere). Switch them off in the You tab, under Settings → Usage statistics.
• Ratings — now and then, right after something went well (for example after you copied a prompt), the app asks Google Play to show its rating card, at most once every 120 days. Google decides whether it appears, and we never learn whether or how you rated.
• Phone notifications — off until you turn them on, in Settings → Notification settings, or when the app offers them (for example after you report something; it offers them rarely, and not again after you say Not now twice). Only while you are signed in. You choose the kinds: your account (reports you made and decisions about your account), your spells, and news and new looks (at most 2 a week, never between 10 pm and 9 am your time). On a locked screen, notifications about your account and your spells show only a general line. Turning them off, in the app or in your phone's settings, stops them; signing out stops them on that phone and deletes its push token there and on our server.
• No advertising — we do not show ads, and we do not use the advertising ID or any cross-app tracking identifier.
• This policy in the app — the app shows the copy of this policy it was built with, so an older version of the app can show an earlier copy. The current policy is always at app.pixkoz.com/privacy-policy.

11. How long we keep data

• Account — until you delete it. After that we keep an anonymised record of the closed account (an internal number, with no name or email) so that the records below still add up.
• Profile picture — until you change it or delete your account. Copies held by browsers and Cloudflare's network can last up to 1 year, but no link to them is shown anywhere.
• Likes, dislikes and blocks — until you undo them or delete your account.
• Your For you data — all of it is deleted as soon as you turn off Personalised For you feed or delete your account. Until then: your interests, which fade while you are not active (festival interests twice as fast); the record of the spells you were shown, opened or used, until 60 days after the last time; your recent feed signals, for 90 days; the older profile and the spell views of section 3; and, on our servers, the short-lived memory of a visit, for 30 minutes to 2 hours, and a note that a batch of signals arrived (so that it is never counted twice), for up to 2 days.
• Feed totals — daily counts that name no one (for example, how many visits started with spells people had not seen yet): 13 months.
• Staff looks at your For you data — the record of each time an administrator opened the summary of your interests or previewed your feed (section 5): 12 months, or until your For you data is deleted.
• Usage statistics — each record for 90 days, then deleted. Daily totals that name no one (for example, how many people copied a spell's prompt on a day) are kept. Daily counts of search words are kept for 13 months.
• Statistics in PostHog and Firebase — PostHog keeps events for 1 year, a period set by its plan that we cannot shorten. Google Analytics for Firebase keeps them for 14 months, and Firebase Crashlytics keeps crash reports for 90 days. When you delete your account, we delete the analytics ID that linked them to it and ask PostHog to delete the statistics it holds under it (section 12). Cloudflare Web Analytics keeps its visit counts for 6 months.
• Suggestions — 2 years from when you sent them, then deleted; at once if you delete your account.
• Recent searches — on your device until you clear them, sign out or delete your account. On our server, search words stay in temporary caches for up to 10 minutes, in our usage statistics without your account (above), and in server logs for the periods below.
• Cast photos and results (website) — until you delete your account.
• My photos (website, creators) — until you delete the photo or your account.
• Write with AI records (website) — the record of each use, which holds no text or image: until you delete your account, then only with the anonymised record of the closed account.
• Safety-check records (website) — as long as the cast they belong to. A picture kept as evidence of a block: for good when a child may be involved, so that it can go to the authorities; otherwise until a person has decided the review, then deleted.
• Reports and moderation records — one year after the case is decided, then deleted. Kept for longer, while that remains so: child-safety cases, cases holding evidence, cases whose action is still in force (a spell removed, a creator suspended or an account closed), and open cases.
• Payment, refund and payout records, including creators' PAN and payout details (website) — as long as tax and accounting law requires, normally 8 years after the end of the financial year they belong to, and to defend legal claims.
• Server logs — web server logs, which hold IP addresses, are kept for 14 days. Application logs, which can hold account numbers, search words and sign-in email addresses, rotate by size and are normally overwritten within days to weeks.
• Abuse limits — counters based on your IP address are kept in memory for up to 1 hour.
• Backups — we copy our database on the same server before updates. Deleted data can remain in a backup until that backup is removed.
• Messages to us — as long as we need them to help you and keep a record of what we agreed.
• Emails to you — deleted from our servers once sent; one that could not be sent is deleted 30 days after we prepared it.
• Notifications — the messages on your Notifications page, for 90 days. Policy notices are kept until a newer one replaces them. The record that you saw or acknowledged a policy notice is kept until 12 months after a newer notice replaces it, or until your account is deleted, whichever comes first. When you last opened the page, and whether news shows there, are kept until you delete your account.
• Phone notifications — a phone's push token, app version and time zone are kept until you sign out of the app on that phone, turn off all phone notifications, or the app has not been used on that phone for 30 days, whichever comes first. The log of the phone notifications we sent: 30 days. Your choices and the record of your last change (when, the version of our words, app or website) are kept until you delete your account.

12. Deleting your account

You can delete your account yourself, at any time. On a phone held upright, in the app or a browser, open the You tab, scroll to the end and tap Delete account. On a wider screen, such as a computer, most tablets or a phone turned sideways, select the round button with your picture or initial (top right) and choose Settings → Delete account. Then type DELETE and choose Delete my account. Full instructions are at app.pixkoz.com/account-deletion, which you can read without signing in. If you cannot sign in, email hello@binarybuddies.in from the address on the account and we will delete it within one month.

Deletion is immediate and cannot be undone. What is deleted straight away:

• Your name, email address, Google photo and profile picture, and your alias, bio and links. The account is closed and can no longer be signed in to; signing in again later with the same Google account creates a new, empty account.
• Every photo you uploaded to cast a spell, and every result made from it, from our image storage.
• Your likes and dislikes, and everything For you kept about you: your interests, the spells you viewed, the record of the spells you were shown, opened or used, your recent feed signals, the older profile, and the record of staff looks at your For you data.
• The usage statistics recorded with your account. Search records never carry your account, and daily totals name no one, so those stay.
• The analytics ID that linked your account to PostHog and Firebase; we also ask PostHog to delete the statistics it holds under it.
• The suggestions you sent while signed in.
• Your notifications, your notification settings and the record of the policy notices you saw; your phone notification choices and the record of your last change; the phones registered for phone notifications, with their push tokens; and the log of the phone notifications we sent you.
• The creators you blocked, and the list of spells hidden from you after you reported them.
• The spells you made: they are taken off pixkoz, and their title, description, prompt, hashtags and images are deleted. Where a report or moderation record concerns a spell of yours, or you as its creator, that spell keeps its title, description and prompt, out of sight, until the record is deleted.
• Emails to you that we still store.
• Your recent searches on the device you delete from.

What is kept, and why:

• Records of casts, payments, refunds and creator payouts are kept, because accounting and tax rules require us to retain them. They stay attached to an account stripped of your name, email and picture, so they no longer identify you.
• Reports you made, and our moderation records, are kept for the period in section 11, so that our decisions can be checked, our rules enforced and legal obligations met. Your reports stay attached to the same stripped account, so they no longer name you. A record about something you published keeps a copy of what was reported, including the creator name it showed at the time.
• If a child-safety report about something of yours is still open, that content is kept as evidence, as our Terms describe.
• Statistics that Firebase received from the app, under the app's own random IDs, until Firebase deletes them (section 11).
• Server logs and backups, until they are overwritten or removed (section 11); copies in browsers and Cloudflare's network, for up to 1 year; and working copies of cast results on our AI server. Write to us if you want any of these removed sooner, and we will do what we can.
• Unused credits are forfeited; they cannot be refunded or transferred, unless the law of your country gives you a refund.

13. Your rights

Wherever you live, you can ask us to:

• give you a copy of your data (access), including in a machine-readable format (portability);
• correct it;
• delete it;
• restrict how we use it, or stop using it (objection);
• tell you who we have shared it with;
• and, where you gave consent, withdraw it at any time.

Some of this you can do yourself: change your alias and picture in Settings → Profile; your account name and email come from Google, so change them in your Google account and they update the next time you sign in. Remove a like, unblock a creator, turn off the personalised feed, Usage statistics or phone notifications, clear your recent searches or delete your account at any time. To get a copy of your data, use Download your data in Settings: it gives you a file in a common machine-readable format (JSON). It includes your notifications and the policy notices you saw or acknowledged, your phone notification choices with the record of your last change, and the phones registered for them (their app version, time zone and dates, without the push token). You can also email us for a copy.

For anything else, email hello@binarybuddies.in from the address on your account, so we know it is you. It is free. We reply within one month, or sooner where your local law requires. If a request is complex we may need longer where the law allows, and we will tell you why within the first month. If we refuse a request, we explain why, and you can reply to ask us to look at it again.

Your right to object. You can object at any time to our use of your data based on legitimate interests, including the For you feed (section 5). Turning off Personalised For you feed in Settings stops For you learning about you and deletes what it kept, and Newest, Popular and Top are never personalised. Switching off Usage statistics in Settings stops your actions being counted with your account or your visit, and stops anything going to PostHog and Firebase; from then on they are counted only as anonymous totals. In the EEA, the UK and Switzerland it also stops what you do on the website or in the app shaping For you while you are signed in; elsewhere For you follows only its own switch. For anything else, email us and we will tell you what we can do for your account.

Complaints. You can complain to us at hello@binarybuddies.in, and you can also complain to the data protection authority where you live: in the EEA, your national authority (listed at edpb.europa.eu); in the UK, the ICO; in Switzerland, the FDPIC; in Brazil, the ANPD; in Canada, the Office of the Privacy Commissioner (in Quebec, the CAI); in South Korea, the PIPC; in Japan, the Personal Information Protection Commission; in Australia, the OAIC; and in India, the Data Protection Board of India once it takes complaints. Section 18 has more for some regions.

14. Security

Every connection to pixkoz is encrypted (HTTPS). Our services can be reached from outside only through our encrypted web server, and they authenticate each other with secret keys. Passwords are stored only in hashed form, and only authorised people can reach our servers and data. No system is perfectly secure, so we cannot guarantee absolute security. If a breach puts your personal data at risk, we will tell you, and the authorities the law requires us to tell, as quickly as the law requires.

15. Children

pixkoz is only for adults aged 18 or over (or the age of majority where you live, if higher). You confirm your age when you sign in. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it and delete its personal data. If you believe a child has given us data, including as a parent or guardian, write to hello@binarybuddies.in.

16. Emails and notices

From November 23, 2026, your Notifications page may also show news about pixkoz and new looks (never ads). You can switch this off in Settings. Phone notifications or emails about new looks are sent only if you turn them on. Otherwise we contact you only about the service: the outcome of a report you made, a decision about your spell or account, and replies to your messages. We tell you by email or in the app where we can. If you are waiting to hear from us, you can always write to hello@binarybuddies.in. Razorpay may send you its own payment receipts.

17. Changes to this policy

We update this policy when what we do with your data changes. The "Last updated" date at the top shows when it last changed. Before a material change takes effect, we tell you in advance, on your Notifications page or by email where we can, and on this page; only where the law or people's safety requires a change straight away do we make it at once, and then we tell you as soon as we can. We will not start using data you have already given us for a new purpose without asking you first.

18. Regional notes

Everything above applies everywhere. These notes add only what a region needs on top.

19. Contact us

Privacy requests, questions about this policy and legal notices: BinaryBuddies, hello@binarybuddies.in. Help with using pixkoz: contact@pixkoz.com, or see Contact us.