What pixexid holds, for how long, and who can reach it

Your account

Your Google sign-in gives us your name, email, and profile image. That's the account.

Your images

• Public images are public: the image, its title, prompt, author, and metadata are visible to everyone and indexed by search engines.
• Private images (generated or kept private) are visible only to you. They are stored so the product works: your gallery, your drafts and durable recovery of in-progress generations.
• Edit sources and uploads: the photo you upload to edit is kept privately with that generation, so you can compare before and after; it is deleted when you delete that generation. If the job fails, the upload is deleted. Images you attach in a conversation with Sema are kept for as long as that conversation exists, so you can close it and resume later; they are released when you detach them or delete the conversation. Account deletion erases all of the above.

Training

Private images and personal uploads are never used to train models. Images you generate from private uploads are not touched either, unless you share them publicly. Public images may inform platform features (for example, the connections between images that power related-image browsing).

Conversations with Sema

Stored so you can resume them. They are not used to train models. Deleting a conversation deletes it and releases its attached images.

Who can reach your data

Your private content is encrypted at rest and behind access controls limited to what operates the service. A small number of people can reach it only for specific jobs: keeping the service running, investigating abuse or safety reports, or helping you when you ask support. We do not sell your data and we do not read your private images for advertising.

Who processes it

Generating or editing an image means your prompt (and source image, for edits) is processed by our model provider (OpenAI) to produce the result. Google processes your sign-in. Both are bound by their own terms for that processing.

Cookieless use counts and search text

We count how the site is used with a self-hosted analytics service (Umami) that we operate ourselves, with no third-party analytics processor. It sets no analytics cookies. Umami uses a pseudonymous session identifier derived from the website, IP address and browser user agent, with a salt that changes each calendar month. The IP address itself is not stored in the analytics database. Location is recorded at country level only. We collect page views and page paths (including public indexed search page addresses; internally submitted and other unindexed search addresses are recorded as /s), two search events (that a search completed, with its result count or empty/fallback status, and that a result was opened) and, only when search-text collection is enabled, the search text itself: normalized, at most 100 characters, screened to reject obvious email addresses, URLs, tokens and long numbers. When a search falls back to different terms, we also record the query we actually searched. This tells us what people look for, so we can improve search and the images we make.

To help distinguish automated traffic from ordinary browsing, we also record the browser family and major version, operating-system family, device type, and whether the browser reports WebDriver automation or explicitly identifies itself as headless. These signals are imperfect and do not prove that a visitor is human or automated. We do not retain the full user-agent string, screen size, or browser language in our analytics records, and we do not link these diagnostics to your account or create an additional persistent identifier. The same retention periods and browser opt-out controls described below apply.

Raw events are deleted after 90 days, and encrypted backups are kept for 7 days. While the page navigates to the results, a screened copy of your query is held in your browser's sessionStorage; we read and remove this copy locally to build the analytics event, and never use it after two minutes. The dashboard is visible only to authorized staff, behind access control. Browser Do Not Track and Global Privacy Control signals are honored, and staff can opt their own visits out. This telemetry is best-effort, is not used for ads, and is not sold. If you type personal information into a search, it could be collected. We screen out obvious cases but cannot catch everything, so please don't search for personal data.

Cookies

Sign-in session only. No advertising trackers.

Your controls

Detach an image, delete a conversation, delete your account: each does what it says, immediately, using the same deletion path everywhere. Questions: [email protected].