Privacy Policy

Kuhu Labs
Near HP Petrol Pump, At-Undel, Ta-Khambhat,
Anand, Gujarat, India – 388640
Email: info@pixcraft.site

By using PixCraft, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the App.

2.1 Account Registration & Authentication

PixCraft provides flexible account options powered securely by Firebase Authentication (Google Cloud Identity Platform):

• Google Sign-In: When you sign in with Google, we receive your name, verified email address, profile picture URL, and a unique Firebase User ID (UID).
• Facebook Login: If you choose to log in via Facebook, we receive basic public profile information and your associated email address through the official Meta / Facebook SDK.
• Email & Password: If you register directly with an email address and password, your credentials are encrypted using industry-standard cryptographic hashing (bcrypt/scrypt) managed directly by Firebase Authentication. Kuhu Labs never sees, accesses, or stores your plaintext password.
• Guest / Anonymous Accounts: If you choose to use PixCraft without signing in, a secure anonymous UID is automatically created. This allows your welcome bonus Coins, ad rewards, and editing progress to be safely tracked in our server ledger without requiring you to share personal information. You can link your guest account to Google or Email at any time.

2.2 Information You Provide

• Images and photos you import, edit, save, or export using the App
• Selfies or photos you upload for AI features such as Face Swap, AI Headshot, AI Avatar, AI Travel, AI Cosplay, or AI Time Travel
• Text prompts you enter for the AI Generation Studio (see Section 3)
• Communications, inquiries, or bug reports you send to customer support

2.3 Automatically Collected Information

• Device Hardware Anti-Abuse Hash: A non-reversible cryptographic hash (SHA-256) of your device hardware identifier is stored in our Cloudflare device_ledger strictly to enforce fair use of our one-time welcome bonus (preventing fraudulent multiple claims on a single physical device).
• Google Analytics 4 (GA4): Aggregated, pseudonymized usage metrics (app screen views, feature interactions, session durations, and engagement) to improve user experience.
• Crash Diagnostics: Anonymous crash reports and performance data via Firebase Crashlytics.
• Ad Interaction Data: Advertising IDs and AdMob SSV callback verification data where permitted by your device settings.

2.4 Media and File Access

PixCraft requests access to your photos/storage and camera solely to allow you to edit photos, capture images, and run AI features. Photos processed by AI tools are transmitted via encrypted HTTPS and are subject to the strict zero-retention safeguards in Sections 4 and 5.

PixCraft provides 1-click Trending AI Templates (including Studio Ghibli art styles, 90s retro yearbook trends, anime aesthetics, and weekly viral social styles). Instead of typing complex text prompts, you simply tap any trending template, select your photo, and let AI transform it into that template style.

• Your selected photo is transmitted over an encrypted HTTPS connection to our secure AI processing pipeline solely to render your image in the chosen template style.
• New viral AI templates are added on an ongoing basis as new aesthetic and visual trends emerge across social platforms.
• We do not retain, store, sell, or use your uploaded photos or generated template images for training public or private AI models.

All AI photo editing, background cutout, object replacement, enhancement, and face transformation tools operate through our secure backend proxy architecture.

• Zero Client Secrets & Cloudflare Proxy: The PixCraft mobile app never communicates directly with upstream AI providers and contains zero third-party API credentials. All requests and temporary image uploads pass through our authenticated Cloudflare Worker proxy (pixcraft-api) using encrypted HTTPS channels.
• Ephemeral Processing: When an image is uploaded for an AI edit (such as Cutout, Replace Object, Enhance, Upscale, FaceSwap, or Colorize), it is temporarily stored in isolated cloud memory solely for the duration required to generate the requested output.
• Immediate Auto-Purge: The source image and intermediate processing files are automatically deleted immediately once inference is complete. PixCraft does not retain your photos on cloud servers after processing.
• No Model Training: Your uploaded photos and generated edits are NEVER used to train, fine-tune, or improve any public or private artificial intelligence model.

This applies across our entire AI creative suite, ensuring that your original photos remain completely private and under your exclusive control.

Face Swap, AI Headshot, AI Avatar, and any tool that processes a face are treated as biometric processing and held to a stricter standard than ordinary photo edits.

• ✓Zero permanent storage. Selfies or photos uploaded for facial AI tools are never permanently stored on our servers.
• ✓No AI training. Your photos are never used to train PixCraft's own models or any public/third-party AI model.
• ✓Auto-purge. The uploaded photo is automatically deleted from server memory immediately after the AI result is generated.
• ✓No selling. Facial data is never sold, rented, or licensed to any marketing agency or third party.

PixCraft features an authoritative server-side virtual credit economy (Coins/Tokens) to power cloud AI generations.

• ✓Server-Authoritative Ledger: Your Coin balance is stored and calculated authoritatively on our Cloudflare D1 distributed database ledger (coin_transactions). Balances are tied to your authenticated Firebase UID and cannot be modified locally or tampered with on client devices.
• ✓One-Time Welcome Bonus: Every new user receives 5 free welcome Coins upon initial launch. To prevent abuse, welcome bonuses are tied to our hardware device ledger (one claim per physical device).
• ✓AdMob SSV Verified Rewards: Free Coins earned by viewing rewarded advertisements are credited only after Google AdMob servers cryptographically confirm ad completion to our backend via Server-Side Verification (SSV). A daily limit of 10 rewarded ads applies.
• ✓Automatic Refund on Generation Failure: If an AI generation fails or times out due to cloud server issues, the spent Coins are automatically refunded to your server balance. Coins are non-refundable once an image generation has successfully completed.

• To provide, operate, maintain, and improve PixCraft
• To enable photo editing, AI generation, exporting, saving, and creative effects
• To process and deliver results for AI features described in Sections 3–5
• To personalize the app experience and improve performance
• To process purchases, subscriptions, and Token balances
• To show advertisements and measure ad performance
• To monitor usage, analytics, crashes, and technical issues
• To detect misuse, fraud, abuse, or security risks, including Token tampering
• To respond to support requests and comply with legal obligations

PixCraft displays banner, interstitial, and rewarded video ads via Google AdMob and Google Mobile Ads SDK. Ad partners may collect device advertising IDs (GAID), IP address, and general interaction data in accordance with Google's policies and your device consent settings.

Cryptographic Server-Side Verification (SSV): When you choose to watch a rewarded video ad to earn free Coins, Google AdMob servers communicate directly with our Cloudflare Worker endpoint (https://pixcraft-api.pixcraft.workers.dev/app/ads/admob-ssv) using an ECDSA P-256 SHA-256 cryptographic signature. This verifies authentic ad completion and protects against fraudulent reward claims.

A fair-use limit of up to 10 rewarded video ads per day (with a 30-second cooldown between views) is enforced by our server to ensure network integrity.

PixCraft offers optional consumable Coin packs and VIP subscriptions for enhanced AI creation. All in-app purchases and subscriptions are handled exclusively through Google Play Billing.

• No Financial Data Collection: Kuhu Labs never collects, processes, or stores your credit card numbers, debit card numbers, UPI credentials, bank details, or billing addresses. All payment processing is conducted securely by Google Play under Google's Privacy Policy and Security Standards.
• Transaction Ledger & Anti-Fraud: When you make a purchase, Google Play provides our backend with a purchase token and order ID. Our Cloudflare Worker verifies these tokens directly with the Google Play Developer API to credit Coins authoritatively to your account and record them in our fraud-resistant purchase ledger (preventing token replay across multiple accounts).
• Pricing & Plans: Available Coin packs and subscription tiers (including current pricing, bonus coins, and features) are dynamically displayed within the App at the time of purchase.
• Subscriptions & Cancellations: Subscriptions renew automatically unless cancelled via Google Play Store at least 24 hours prior to renewal. Refunds are governed by Google Play's standard refund policies.

For transparency, PixCraft partners with the following trusted industry providers to deliver secure app functionality:

Each partner processes data under its own privacy policy in accordance with relevant data protection laws.

We use Google Analytics 4 (GA4) (Property ID 525406540) and Firebase Crashlytics to monitor application performance, analyze which screens and tools are most popular, identify user pain points, and fix software defects.

• What GA4 Collects: Screen view events, tool interaction events (e.g. Enhance, Cutout, Editor), session duration, approximate geographic region (country/city level), and device hardware models.
• What GA4 Never Collects: Your private images, personal photos, prompt text, passwords, or financial payment details are NEVER transmitted to analytics.

We take reasonable technical and organizational measures to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

Some edited images or temporary processing data may be stored locally on your device. Photos and prompts sent for AI processing are handled under the safeguards in Sections 3–5 and are not retained by third-party AI providers beyond the time needed to generate your output.

We may share information:

• With third-party AI service providers listed in Section 10, solely to process and return your requested output
• With service providers that help operate the App — analytics, crash reporting, advertising, hosting, or billing partners
• With app stores or payment providers to process purchases and subscriptions
• When required by law, regulation, legal process, or governmental request
• To protect our rights, users, security, property, or the public
• In connection with a merger, acquisition, reorganization, or asset sale

We retain information only as long as necessary to fulfill the purposes in this Policy. Images and files you edit remain on your own device unless you delete them. Photos and prompts processed through AI features are not stored beyond what is necessary to deliver your output, subject to the auto-purge rule in Section 5. Certain analytics, diagnostic, or transaction records may be retained for a reasonable period for support, fraud prevention, legal compliance, and internal analysis.

You have complete control over your account, data, and privacy preferences within PixCraft.

15.1 Account Deletion & Data Erasure (Google Play Requirement)

In accordance with Google Play's User Data policy and global privacy laws (including GDPR and India's DPDP Act), you have the right to request the permanent deletion of your account and all associated data at any time:

• ✓In-App Deletion: You can initiate account deletion directly inside the App by navigating to Profile > Settings > Delete Account (or visit our Account Deletion Page).
• ✓Email Deletion Request: You may also submit an account deletion request by emailing us at info@pixcraft.site or info@pixcraft.site with your registered email address or User ID.

15.2 Managing Permissions & Data

• Storage & Camera Permissions: You can grant or revoke device permissions at any time through your Android device settings (Settings > Apps > PixCraft > Permissions).
• Advertising Preferences: You can reset or opt out of personalized ads by resetting your Google Advertising ID in device settings.
• Subscriptions Management: Active subscriptions can be managed or cancelled at any time via Google Play Store > Subscriptions.

PixCraft is not directed to children under 13 (or a higher age threshold where required by local law), and we do not knowingly collect personal information from children without appropriate consent. AI face and portrait features should not be used by or on behalf of children without parental supervision and consent. If you believe a child has provided personal information through the App, please contact us so we can take appropriate action.

Your information, including photos, prompts, and Token data, may be processed in countries other than your own, depending on the location of our service providers, AI processing partners, app platforms, advertising partners, or analytics providers. By using PixCraft, you understand your information may be transferred to and processed in such locations, subject to applicable legal safeguards where required.

In line with Google Play's AI-Generated Content Policy, every AI result in PixCraft includes a Report button. If a generation is inappropriate, offensive, or violates our policies, you can submit a report directly from the app for our team to review. We may use report data to investigate misuse and to action accounts under the Terms of Service.

• Photos/Media/Files — to open, edit, save images, and upload photos for AI features
• Camera — to capture photos directly in the App, including for AI Headshot and Face Swap
• Internet/Network Access — to load ads, verify purchases, run AI features that need server-side processing, and sync your Token balance

You can control these permissions through your device settings. Some features, including AI tools, may not work properly if permissions are denied or internet access is unavailable.

Where required by applicable law, we process personal information based on: your consent; performance of a contract or provision of requested services; compliance with legal obligations; or our legitimate interests, such as improving the App, securing the service, and preventing fraud.

We may update this Privacy Policy from time to time, including to reflect new AI features, Token Economy changes, or new third-party partners. When we do, we will revise the Effective Date at the top of this page. Continued use of PixCraft after changes become effective means you accept the updated Policy.

If you have questions, concerns, or requests regarding this Privacy Policy, including how your photos, prompts, or facial data are handled, contact us at:

Kuhu Labs
Near HP Petrol Pump, At-Undel, Ta-Khambhat,
Anand, Gujarat, India – 388640
Email: info@pixcraft.site