PixlPal

Privacy Policy

Last updated:

Who we are

PixlPal is a photo editor that runs in your browser. Pixel processing happens on your device. This policy explains what information the PixlPal website (the “Service”) handles, what leaves your device, and what we store. Questions: contact@pixlpal.com.

This policy covers the website only. It does not cover a third-party model provider’s own practices, or an endpoint you configure under Use your own API key.

The short version

  • We do not ask you to create an account or give us an email address.
  • Full-resolution photos are decoded, edited, segmented, and exported in your browser. We do not upload them to PixlPal for storage.
  • Opening a photo, or sending a chat, can send a downscaled JPEG preview of the current look to an AI model so it can see the frame. That is the main time image pixels leave the device.
  • We set one HttpOnly cookie so the hosted assistant can cap anonymous chats. Alongside it we store only an anonymous visitor id and the chat ids that visitor has opened.
  • Optional API keys you type into Model settings stay in this browser’s localStorage and are sent to the endpoint you chose, not to PixlPal.

Photos and on-device processing

When you open a JPEG, PNG, or WebP file, the browser reads it into memory. A Rust engine compiled to WebAssembly applies your edit pipeline (exposure, grain, masks, and the rest) inside a Web Worker. Undo, redo, and export (JPEG or PNG download) also stay local. Subject segmentation uses Florence-2 in a dedicated worker on this device; the model sees pixels only in that worker.

The preview sent to a model, when one is sent, is a recoded JPEG (longest side about 768 pixels), not your original file. Embedded metadata such as EXIF is not copied into that JPEG.

When a preview leaves the device

Automatic edit suggestions

After you open a photo, the editor asks the assistant for a few first-prompt suggestion chips tailored to that frame. That request includes the downscaled JPEG. On the hosted path it goes to our Cloudflare Worker at /api/agent/suggest, which forwards it to the configured model provider. Suggestion requests do not consume a chat quota slot. If the request fails, the panel falls back to generic chips and nothing is stored by us.

Chat with the assistant

Each message you send can include: your text; a fresh downscaled JPEG of the current look; a description of the active edit pipeline; tool schemas the model may call; and later, tool results. Tool results can include on-device measurements (brightness, clipping, color cast, and similar numbers) and mask identifiers — not full-resolution pixels and not the original file. Older turns keep text only so stale frames are not resent.

The editing loop itself runs in your browser. The Worker’s job is to hold the product API key, enforce the anonymous chat cap, reject oversized hosted messages, cap generated tokens, time out hung completions, rate-limit abuse, and proxy one model completion per request. We do not persist chat transcripts, prompts, or images in our quota store.

Bring your own key

If you fill in Model settings, the browser talks to the OpenAI-compatible endpoint you named. Previews and messages go there directly. That provider’s privacy policy and retention rules apply. PixlPal never receives your key.

Cookies, local storage, and site data

Visitor cookie

Cookie name: pixelcam_vid. It is HttpOnly, SameSite=Lax, Secure on HTTPS, and lasts one year. The value is a random anonymous id. We set it when the editor loads the hosted assistant quota, and when you use hosted suggest or chat. It is strictly necessary to enforce the free-chat limit and related rate limits without accounts. Clearing cookies (or using another browser) starts a fresh quota — that is the trade-off of no login.

Quota record

Cloudflare Workers KV stores a record keyed by that visitor id: the opaque chat ids already opened, plus a timestamp. No name, email, photo, or prompt. Records expire after one year, matching the cookie.

Model settings

Key pixelcam.agent.settings in localStorage may hold the endpoint URL, model name, and API key you entered. It never leaves this browser except when the browser sends the key to your chosen endpoint.

On-device model cache

The first time you run subject segmentation, the browser may download Florence-2 weights from Hugging Face (or from this origin if you have fetched them locally) and cache them with the Cache API or similar browser storage. Those downloads are model files, not your photos. Hugging Face may see a network request from your IP.

Infrastructure logs and rate limits

The Service is hosted on Cloudflare. Like most HTTPS hosts, Cloudflare and our Worker may process standard request metadata: IP address, date and time, URL, user agent, and coarse location derived from IP. We use this to operate the site, debug failures, and apply per-visitor rate limits on assistant and suggestion endpoints. Cloudflare observability may retain operational logs under Cloudflare’s own terms. We do not use a separate advertising or product-analytics SDK.

What we do not collect

  • Accounts, passwords, or payment details.
  • A name, email, or profile, unless you choose to email us.
  • Full-resolution photo archives on our servers.
  • Cross-site advertising identifiers or marketing pixels.

How we use information

  • To run the editor and the hosted assistant.
  • To cap anonymous chats and slow down abuse.
  • To generate photo-specific suggestion chips when you open a photo.
  • To respond if you email us.

We do not sell your personal information.

Who else sees information

  • Cloudflare — hosting, CDN, Workers, KV, rate limiting.
  • The hosted model provider — by default OpenAI, via https://api.openai.com. They receive suggestion and chat payloads described above, including downscaled previews. Their privacy policy governs what they retain and whether they use API data for training. We do not train a PixlPal generative model on your photos (we do not operate one).
  • Hugging Face — model-weight downloads for on-device segmentation when local weights are not shipped.
  • A provider you configure — if you use your own API key.

We may also disclose information if required by law, or to protect the Service and other users from abuse.

Retention

  • Visitor cookie: up to one year, or until you clear it.
  • Quota KV record: up to one year from last write.
  • Chat and suggestion bodies: not stored in KV. They exist in transit through the Worker and then with the model provider for as long as that provider keeps them.
  • Photos, masks, and chat UI state in the tab: until you close the tab, choose New photo, or clear the page.
  • localStorage settings and cached weights: until you clear site data for this origin.

Your choices

  • Edit with sliders only. Do not open a photo if you do not want a suggestion request; do not send a chat if you do not want a preview in that turn.
  • Use your own API key so hosted PixlPal never proxies the preview. You still send it to the endpoint you chose.
  • Clear cookies and site data to drop the visitor id, quota, key, and caches.
  • Skip subject segmentation if you do not want the browser to fetch Hugging Face weights.

International processing

Cloudflare and the default model provider operate in the United States and other countries. If you use the Service from the EEA, UK, or Switzerland, your information (including previews sent to the hosted assistant) may be processed in those countries.

Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has submitted information to us, email contact@pixlpal.com and we will delete what we hold (typically only an anonymous quota record).

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information, to object or restrict certain processing, and to appeal a refusal. Because we do not run accounts, the practical way to delete the visitor cookie and local settings is to clear site data. To ask about a quota record, email contact@pixlpal.com from a request that explains the issue — we cannot look up a person by name. California residents: we do not sell or share personal information for cross-context behavioral advertising.

EEA/UK users: our legal bases are performing the Service you request (the editor and assistant), legitimate interests in running a limited anonymous quota and preventing abuse, and consent where a rule requires it for optional features.

Changes

We will update the “Last updated” date at the top of this page when the policy changes. Continued use after a change means you accept the revised policy. Material changes to how previews are sent will be described here.

Contact

Email contact@pixlpal.com. Related: Terms of Service.