PixoChat is made by Rare Theory LLC. This page explains what we collect when you use the PixoChat website and the PixoChat app for iPhone, why we collect it, who else touches it, how long we keep it, and how to get rid of it.
The short version: we collect what it takes to run a drawing chat between friends and nothing more. We do not collect usage analytics. We do not track you across other apps or websites. We do not show ads. We never sell your data.
Who we are
Rare Theory LLC is a limited liability company in Wisconsin, United States. We are the data controller for everything described here. You can reach us about anything on this page at hello@pixochat.app.
The website
This website sets no cookies and runs no analytics. It remembers a few choices you make on it, such as sound on or off, the light or dark look, and a language if the site offers one, in your browser's local storage, which stays on your device and is never sent to us.
The site's fonts are served by Google Fonts. When your browser loads a page, it requests those font files from Google, which means Google receives your IP address and browser details as part of that request, the way it would for any web font. Our hosting provider, Hostinger, keeps ordinary server logs (IP address, page requested, time) for security and operations.
If you join the mailing list, you give us your email address and we store it with Kit, our email provider, together with the language you were reading the site in. We use it for one thing: telling you when PixoChat is out, and occasionally what is new. You have to confirm your address by email before you are added. Every message we send has an unsubscribe link, and unsubscribing removes you. Joining the mailing list does not create a PixoChat account.
The app: what we collect
Your account. You sign up either with Sign in with Apple or with an email address and password. Either way we hold a user ID and an email address. If you use Sign in with Apple and choose to hide your email, we only ever see the private relay address Apple gives us. Passwords are handled by Firebase Authentication and are never visible to us.
Your age. When you sign up you enter your date of birth. We keep two things from it: an age range (13 to 15, or 16 and up) and the month and day of your birthday, so your friends can see a small birthday note on the day. We do not store the year. If the date you enter shows you are under 13, no account is created, the sign-in you just made is deleted, and nothing about you is kept.
Your profile. A display name, a friend code, a photo, and a short bio. Your favorite color for the app (purple, pink, orange or blue), saved on your account so it follows you to your other devices. The app doesn't show it to anyone else. If you sign in with Apple, you start with a made-up display name, which you can change; we never use the name on your Apple account. Your friends can see your profile. People in a room with you see your name there.
Profile photo (optional). If you choose one, you pick a single picture through Apple's photo picker, so we never see the rest of your photo library. That picture is checked automatically for safety before it appears (using Google Cloud Vision), stored so your friends can see it as your avatar, and replaced or removed whenever you change it.
Photo prints (optional). You can also post a single picture to your status, which your friends see for a day. It goes the same way as a profile photo: picked through Apple's photo picker, checked automatically for safety before it appears, stored so your friends can see it, and removed when the status expires or when you take it down.
What you make. The messages and drawings you send in chat, the doodles you choose to save, and the notes you keep for yourself. The statuses you post (a doodle, a short note or a photo print), which your friends see for a day and which are deleted when they expire or when you take them down. Group rooms are temporary. A room closes once everyone has left, when its set time runs out if it was given one, or when the friend who made it closes it, and its messages are then gone from our servers. A group room that nobody has used for 30 days is closed too. A direct chat between you and a friend is kept, so you can both scroll back through it. When you reply to a message, the reply records which message it answers and who sent it, not a copy of it. If the original is deleted, the quote goes with it. When you and a friend stop being friends, or either of you blocks the other, your direct chat stays readable but takes no new messages or likes until you are friends again, and we record that the chat is closed. Things you deliberately save, and your direct chats, stay until you delete them or delete your account.
Your friends. Who you are friends with, friend requests you send and receive, who you have blocked, any reports you file, and any reports filed about you. A report keeps a copy of what was reported: the message itself, its drawing and its words; for a report made from someone's Studio, their bio, and their profile photo while it is still up; for a status, the words of a note, a link to a photo print, or which drawing it was. For a message or a Studio, our server takes that copy; for a status, the app sends what was on screen. A photo or drawing from a status can only be seen until the status expires or is deleted. The person reported is never told who reported them. We also keep short-lived counts of how many reports an account files and how many friend codes it tries in an hour, to stop floods. These are needed for the app to work and to keep it safe. On the App Store, PixoChat's privacy label lists this as Contacts. That is Apple's category for your in-app friend list, which Apple calls a social graph. It does not mean we read your phone's contacts.
Presence. Whether you are online right now, and when you were last seen, so your friends know when you are around. You can go invisible.
Read receipts. When you open a direct chat, the time you reached your friend's latest message is shared with that friend, who sees "Seen" under it. You can turn this off in Settings; you will still see theirs.
Status views and likes. When you view or like a friend's status, your name and the time are recorded on that status so its owner can see who saw it and who liked it. The app shows this only to the owner, never to other people, and nothing is shown as a public count. It is removed from the status when the status expires or is taken down. A like also appears in your friend's activity list, described below, where it is kept for about 30 days.
Message likes. When you like a message in a chat with a friend, your like is stored with that chat, so you both see it. Your friend is told you liked it, unless they have turned that notification off. Taking a like back removes it. Likes go when the message is deleted, and yours are removed from your chats if you delete your account.
Activity. The app keeps a private list of things that happened to you: a friend liked your status, someone became your friend, or a friend invited you to a room. Each entry records which friend it was, what happened, and when. The list also carries notes from PixoChat about your own account: if a moderator warns you, or removes something you posted, you get a note saying so, never who reported you or what the report said, and a notification that only says you have a note. Only you can see your list. It does not include your messages or who viewed your status. We also record how far you have read the list, so the app knows whether to show you a dot.
Notifications. If you allow notifications, a push token for your device so we can deliver them. It is removed when you sign out or turn notifications off.
Crash reports. If the app crashes, Firebase Crashlytics sends us a report with the technical state of the app at the time (device model, iOS version, memory, what the app was doing). It is keyed to an installation identifier, not to your account. This is the only diagnostic data we collect and it exists so we can fix bugs.
App integrity. The app uses Apple's App Attest through Firebase App Check to prove to our servers that requests come from a genuine copy of PixoChat. This checks the app, not you.
What we do not collect
The contacts on your phone. PixoChat never asks for Contacts permission and never reads your address book; friends are added with a friend code. Your location, microphone or camera. Your photo library beyond the single pictures you pick as your profile photo or a photo print. Payment details: there is nothing to buy in PixoChat. Usage or behavioral analytics. Advertising identifiers. Anything for the purpose of tracking you across other companies' apps or websites.
How we use it
To deliver messages and drawings between you and your friends, and to show them when you have read theirs. To show who is online. To show you who has seen or liked your status. To show you what your friends have done that involves you. To send notifications you have asked for. To enforce the age minimum and the safety rules, including an automatic check of any photo you upload and the text of your bio before other people see them. To handle blocks and reports, which includes telling our moderators that a new report is waiting; that notification says only that a report is waiting. To fix crashes. To operate, secure, and improve the service. That is the list.
Who we share it with
We do not sell personal data and we do not share it with advertisers. The companies below handle data on our behalf, only as needed to run PixoChat.
- Google Firebase (Google LLC, United States) runs our backend: accounts, database, cloud functions, file storage for the photos you upload, push delivery, app integrity checks, and crash reporting. Data is stored in Google's us-central1 region in the United States.
- Google Cloud Vision (Google LLC, United States) checks each photo you upload for safety before it is shown to anyone. The check runs from our backend in the same region; the photo is sent to the service for that check and nothing else.
- Apple (Apple Inc.) provides Sign in with Apple, push notification delivery and App Attest.
- Kit (formerly ConvertKit) stores the mailing list for the website.
- Hostinger hosts this website.
We will disclose information if the law requires it, for example to comply with a valid legal process, or if it is necessary to protect someone's safety. Where we are allowed to, we will tell you about a legal request that affects your account.
If Rare Theory LLC is ever sold, merged, or reorganized, your account data may transfer to whoever takes over PixoChat, and it stays under this policy when it does. We will tell you before that happens.
How long we keep it
Account data stays as long as your account exists. Group room messages are deleted when the room closes, which includes a room left unused for 30 days. Direct chats, saved doodles and notes stay until you remove them. Read receipts stay with the direct chat they belong to. When an account is deleted, or closed for breaking the rules, its friendships end at once; the rest of a deleted account goes as described under Deleting your account. Message likes stay with the message they are on. Status views and likes are removed from a status when the status goes. A like is also kept in your friend's activity list. Entries in an activity list are deleted after about 30 days. An entry is removed sooner if the like is taken back while the status is still up, or if you and that friend stop being friends. The mailing list keeps your address until you unsubscribe.
Safety records are the exception. A safety record holds the report, a copy of the reported message, of the Studio photo and bio, or of a status's words or photo link, who reported and who was reported as account identifiers, the moderator's decision, and what was removed. Moderators see the names and profile photos of both people while they review it. If a report is filed about you or by you, the report and the moderation decision are kept for up to two years after the fact so that repeated behavior can be recognized and decisions can be reviewed. After you delete your account these records are no longer connected to a person we can identify.
Deleted data can linger in our backups for up to 30 days before those backups are overwritten. It is not used for anything in the meantime.
Deleting your account
Open Settings in the app and choose Delete Account. You can also delete it from the screen the app shows when your account is paused or closed, when it is waiting for sign-ups to open, or when the app needs an update. Your account is disabled immediately and you are signed out everywhere.
Your friendships end straight away, not at the 30-day erase. You leave your friends' lists, your direct chats with them stay readable on their side but take no new messages, and any friend requests to or from you are cleared.
Within 30 days we permanently delete your account, your profile, any photos you uploaded, your friend list, your saved doodles and notes, your push token, your read receipts, your activity list, and your presence data. Your likes and read receipts are removed from all of your direct chats, including chats with people who are no longer your friends. Entries about you are removed from your friends' activity lists too. Your friends will no longer see you, though a friend's copy of a direct chat you had with them remains in their app. This cannot be undone.
Until your account is erased, we keep a private record of who your friends were when you deleted it, so the erase can find and clean every chat you shared. Only our servers can read it, and it is deleted with the rest of your account.
If we close an account for breaking the rules, its friendships end the same way and its friend requests are cleared. Its data is kept as described for safety records under How long we keep it.
If you cannot get into the app, email hello@pixochat.app from the address on your account and we will do it for you.
Your rights
You can see and change your profile, favorite color, and notification settings in the app. You can delete your account in the app. For anything else, including a copy of the data we hold about you, a correction, or an objection to how we use it, email hello@pixochat.app. We answer within 30 days.
Before we act on a request about your data, we may need to confirm it is really you asking, usually by writing back to the address on your account. We will ask for no more than that takes.
If you are in the European Economic Area, the United Kingdom, or another place with its own privacy law, you may have additional rights under that law, including the right to complain to your local data protection authority. We will honor them.
Children
PixoChat is for people 13 and older and is not directed at children under 13. The age gate at sign-up does not create an account for anyone under 13 and stores nothing about them. If we learn that we have collected personal information from a child under 13, we delete it promptly. If you believe a child under 13 has an account, email hello@pixochat.app.
Security
Data travels encrypted between the app and our servers. Access to the backend is limited to what each part of the app needs, and administrative access is limited to the people who run PixoChat. No system is perfectly secure, and we will tell you if something goes wrong with your data.
Where your data lives
PixoChat is operated from the United States and your data is stored there. If you use PixoChat from somewhere else, your data is transferred to and processed in the United States.
Links to other services
This website and the app may link out to other services, for example Apple's, or to a page a friend shares with you. Those services have their own privacy policies, and this one does not cover them.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change matters to you, meaning it changes what we collect or what we do with it, we will tell you in the app before it takes effect.
Contact
Rare Theory LLC
hello@pixochat.app