Privacy Policy

Last updated: 22 October 2026

This policy explains how PixGB (https://pixgb.com) processes personal data. We aim to comply with UK GDPR and the Data Protection Act 2018. Controller contact: abuse@pixgb.com.

1. Data we collect

• Account data: username, email address, password hash (we do not store plaintext passwords), plan status, timestamps, ban status, Terms acceptance time.
• IP addresses: we record the IP address used to sign up, log in (including API login), upload images or files, replace a file, submit an abuse report, and attempt to unlock a password-protected file (including wrong passwords). Guest uploads also store the uploader IP. IPs are stored in full (not truncated) so we can investigate abuse and assist lawful investigations. See section 2.
• Device / request data: browser user agent on upload; essential cookies (section 10).
• Upload / content metadata: original filename, size, content type, dimensions (pictures), SHA-256 of the original bytes, public/private flag, album association, short codes/slugs, tags, expiry, timestamps.
• Uploaded files: the binary content you upload — pictures via Upload, and other allowed types (zip, PDF, video, audio, Office, text, and similar) via File upload — plus separately generated gallery thumbnails for pictures.
• File passwords: if you password-protect a file we store a one-way hash and wrapped encryption keys, not the password. The file is stored encrypted. We cannot recover the password. Encryption does not hide the uploader IP or filename from us.
• Guest sessions: a cookie that ties anonymous uploads to your browser so you can recover recent guest links.
• Abuse and security data: reports (reason, details, reporter account and IP), moderation notes, auto-scan labels/scores where enabled, audit logs of staff actions (which may include staff IP).
• Billing: Stripe customer and subscription identifiers; payment card details are processed by Stripe and not stored by PixGB.
• Usage: storage used, approximate view and bandwidth counters.
• Site statistics: when you view a page we record your approximate location (country and city, looked up from your IP address on our own server), the number of pages viewed and the time, against an anonymous visitor code that changes every week. The IP address itself is not saved for this, and these statistics are deleted after 90 days.
• API: API token identifiers and related request activity when you use the API.
• Twitch creator programme: for channels that opt in, their Twitch user ID, channel name, licence choice and acceptance record. If a creator separately authorises clip downloads, we store their Twitch access and refresh tokens encrypted using our application key. We use that grant only for the official Twitch clip-download endpoint for that creator's own clips.

2. IP addresses — why we keep them

Hosting can be misused for illegal or harmful content. We keep IP addresses so we can:

• limit guest and Free-account abuse (rate limits, multi-account flags);
• investigate AUP breaches, spam, malware, and account takeovers;
• respond to valid law-enforcement, court, or regulator requests;
• report child sexual abuse material and related account evidence to the appropriate authorities (including, where applicable, UK law enforcement / NCA channels and relevant hotlines), which typically includes IP, timestamps, username/email, and file hashes;
• notify a file owner of a wrong-password attempt (the email includes the attempting IP).

Legal bases: legitimate interests (security and abuse prevention) and legal obligation where we must retain or disclose data about illegal content. PixGB is not an anonymous or “no-logs” service. Using a VPN or guest mode does not stop us recording the IP we see on the request.

3. Purposes and legal bases

• Contract: creating accounts, hosting images and files, enforcing plan limits, providing billing portals.
• Legitimate interests: securing the service, preventing abuse/fraud, improving reliability, basic analytics of aggregate usage, notifying an account holder of failed password attempts, and keeping IP/user-agent logs for investigations.
• Legal obligation: responding to valid legal process; retaining and disclosing information required for investigations into illegal content (including CSAM), tax, or regulatory duties.
• Consent: where we ask for optional marketing (we do not currently send marketing email by default).
• Creator permission: featuring Twitch clips and, where separately authorised, downloading and preparing a creator's clips for PixGB's Shorts workflow.

4. Public vs private content

Public uploads and associated usernames may be visible on the gallery (pictures only), profiles, and via direct links you share. Non-image files are not listed in the public gallery. Private uploads are restricted to the owner (and authorised staff for moderation/abuse/legal/security) as described in the Terms; metadata (including IP) may still be processed by us for hosting and abuse prevention. Password-protected files are not served to the public until the correct password is entered; we still hold the uploader IP and may decrypt or preserve ciphertext as required by law.

5. Sharing

We do not sell personal data. We share data with:

• Processors needed to run the service (e.g. hosting/VPS provider, Stripe for payments, email delivery if we send transactional mail such as wrong-password alerts or password reset).
• Twitch when a creator signs in or separately authorises clip downloads. Twitch processes that OAuth/API activity under its own Privacy Notice. A downloaded clip is stored in PixGB's private Shorts storage while it is queued and processed. If AI-assisted Shorts processing is enabled, the audio/transcript material needed for transcription and highlight selection is sent to the configured AI provider (currently OpenAI).
• Social platforms when PixGB staff publish an approved creator-authorised clip to an official PixGB social page. The video, caption and creator attribution then become visible to that platform's users and are processed under that platform's terms and privacy policy.
• Advertising networks on guest and Free sessions (currently Adcash; Google AdSense if that network is later enabled). They receive the page URL and typical request data (IP, user agent) to deliver and measure ads. Lite, Plus and Pro signed-in sessions do not load ad scripts.
• Authorities and rights holders when required by law or when we believe in good faith that content or accounts are involved in illegal activity — including reporting CSAM. We may disclose IP addresses, timestamps, usernames, emails, file hashes, filenames, and copies or descriptions of content.
• Professional advisers under confidentiality where needed.

6. International transfers

Infrastructure or processors may process data outside the UK. Where required, we use appropriate safeguards (such as UK adequacy regulations or standard contractual clauses).

7. Retention

Account and content data are kept while your account is active, subject to plan retention (guest and signed-in Free, Lite, Plus and Pro until you delete). After deletion or account closure we aim to remove content within a short operational window, except where we must retain data longer for legal claims, security, or mandatory reporting (including CSAM-related evidence and associated IPs). Server and access logs are retained for a limited period for security and abuse handling. Password hashes and encryption wraps for a file are deleted with the file unless preservation is required. Upload IPs stay with the file record while that record exists, and may be kept longer if the file is removed for legal reasons.

Twitch creator authorisation tokens are erased from PixGB when the creator disconnects clip access or withdraws from the programme; PixGB also asks Twitch to revoke the current access token. PixGB's private source copy of an imported clip is removed under the configured Shorts source-retention period after processing finishes (7 days by default). Queued or still-processing sources remain private until the job finishes or is cancelled; the source-retention period then applies. Approved output clips remain until staff remove them; a creator may request removal as described in the Twitch feature licence.

8. Your rights

Under UK GDPR you may have rights to access, rectification, erasure, restriction, portability, and objection, and to complain to the ICO (ico.org.uk). Some rights are limited where we must retain data for legal reasons (for example ongoing investigations into illegal content). Contact abuse@pixgb.com.

9. Children

The service is for users aged 18+. We do not knowingly create accounts for children. Sexual content involving minors is prohibited and reported as described in the AUP.

10. Cookies and advertising

We use essential cookies for authentication, security, theme preference, guest upload recovery, and (where you unlock a password-protected file) a short-lived HttpOnly cookie that lets that browser download the decrypted file without storing the password.

Guests and Free accounts may be shown third-party ads on PixGB pages, including the public clip viewer (/v/). Those networks may set their own cookies or similar identifiers. Lite, Plus and Pro signed-in sessions do not load advertising scripts by default. Direct /o/ image and file URLs never include ads or ad scripts, on any plan. Public clip pages may record aggregated, privacy-conscious view counts (without storing visitor IP addresses for analytics).

YouTube. Our /youtube page uses YouTube API Services to list trending videos and plays them in YouTube's embedded player. The player loads only when you press play and uses YouTube's privacy-enhanced mode; once it loads, YouTube (Google) may set cookies and collect data under the Google Privacy Policy, and watching is subject to the YouTube Terms of Service. PixGB stores only public video details (such as title, channel and view counts) for up to 30 days and does not link them to your account.

11. Security

We use reasonable technical measures (HTTPS, hashed account passwords, Argon2id + AES-256-GCM for password-protected files, access controls). No method of transmission or storage is perfectly secure; protect your password, file share passwords, and API token. We cannot recover a file share password.

12. Changes

We may update this policy by posting a new version with a revised date. Material changes will be noted on the site where practical.