Security & Data Handling

What we never do

• We never use your files or content to train AI models.
• We never sell or publish your files. Infrastructure and processing providers handle them only as needed to deliver the operation you requested.
• Temporary processing files expire within 24 hours — except private Photo Editor uploads and editable designs, kept without automatic expiration while active in your account; and a result you deliberately share, which lives at its public link anyone who has it can open without automatic expiration while Pixoate provides the sharing service; when you are signed in, the small preview image behind each My Work entry, kept 7 days on the free plan or 180 days on Premium and never a copy of your file; and an image you explicitly tick a box to let our team investigate after a thumbs-down rating, kept up to 30 days.
• We never add a Pixoate watermark to your downloads. Standard tool use is free, with no signup required.

Public sharing and private account designs

Sharing a result is the only thing that ever makes it public, and it only happens when you ask for it. New share links keep that result — and, where the shared page shows a before/after, the photo you started from — without automatic expiration while Pixoate provides the sharing service. A link ends when you remove it, delete its owning account, or we remove it for abuse, legal requirements, or discontinuation of the sharing service. Lifetime sharing is not a guarantee of permanent archival storage; keep your own copy. Existing links with an expiry date keep that date, shown on their shared page. A share link is public: the address is unguessable, but it is not password-protected and does not require signing in, so anyone who has the link can open the result. The shared page is marked noindex, which instructs search engines not to include it in search results. Nothing is ever published unless you create the link yourself. To take a link down, open the result and choose “Remove link” — you can revoke your own share link at any time, and the page stops opening for everyone who has it. Once no active share or other disclosed retention exception keeps a file, it becomes eligible for the normal cleanup. Signed-in Photo Editor uploads and editable designs are stored privately in your account so you can reuse them on another device. Active saved work has no automatic expiration. Storage limits and subscription downgrades do not delete existing work; they can prevent new saves that need more space. Removing an item moves it to Trash for 30 days, except images still needed by saved designs, which remain with those designs. Deleting your account revokes access and queues removal of its stored files. The five previous design saves are kept for recovery, not as an independent backup. Keep exports of important work.

Your work history

If you are signed in, we also keep a short history of the results you make, so “My Work” still has them after a reload or on another device. An entry is a small preview image — at most 32 KB — plus the details of the job, such as the tool you used and the file name. It is never a copy of the file you uploaded, and it does not keep the processed file alive: that still deletes itself on the normal 24-hour schedule, after which the preview remains as a record but the result can no longer be opened. How far back the history reaches depends on your plan — 7 days on the free plan, 180 days on Premium — and each entry deletes itself automatically at the end of that window. You can remove a single entry or clear the whole list from My Work at any time, and deleting your account erases the history with it. Signed out, none of this happens: the recent-work list on a signed-out device is stored in that browser only and is never sent to us.

Images you ask us to investigate

If a result goes wrong and you rate it thumbs-down, we show you a tick-box that lets our team keep the photo you uploaded and the result we produced, so we can reproduce the fault and fix it. The box starts ticked so a quick report includes what we need to debug it, and you can untick it before submitting — then nothing is kept. It applies only to that specific result; there is no setting that turns it on for everything. What you consent to is narrow: the pair is readable only by our team behind an internal login, it is never published, never shared and never used to train models, and it deletes itself automatically after 30 days. Deleting your account deletes any samples with it.