Pixel-Drop
Gallery

Privacy Policy

Last updated: June 2026

1. Data Controller

Pixel-Drop is responsible for the processing of your personal data. For contact information, please refer to our Impressum.

2. Data We Collect

We collect the following data:

  • Account Information: Username, email address, and password (encrypted)
  • OAuth Data: If you sign in with Google or Discord, we receive your name, email address, and account ID from the respective provider. We use this to create or link your Pixel-Drop account.
  • Uploaded Content: Images and videos you upload to the service
  • Payment Information: Processed securely by Stripe. We do not store credit card details.
  • Usage Data: IP addresses are cryptographically hashed with a daily rotating salt and cannot be traced back to individual users. Browser information is hashed and stored only as anonymous category identifiers. Referrer domains (not full URLs) may be recorded for share analytics.

3. How We Use Your Data

  • To provide and maintain our service
  • To create and authenticate your account (including via Google or Discord OAuth)
  • To process your payments (via Stripe)
  • To send important notifications about your account (email verification, password resets)
  • To prevent abuse and ensure security

3a. Staff Access to Your Content

To operate the service safely and lawfully, our administrators and moderators may access content and account information you upload or provide — only where strictly necessary — in order to: enforce our Terms of Service; review and act on reports; detect, prevent, or investigate illegal content, abuse, or security issues; and comply with legal obligations.

Such access is strictly limited to these purposes. All persons with such access are bound to confidentiality and may only process your data on our instructions (Art. 29 and Art. 32(4) GDPR). We never access your content for any other purpose, and staff content access is logged.

4. Third-Party Services

We use the following third-party services:

  • Google OAuth: For account sign-in. We receive your name and email address. Google Privacy Policy
  • Discord OAuth: For account sign-in. We receive your username, display name, and email address. Discord Privacy Policy
  • Stripe: For payment processing. Stripe Privacy Policy
  • Cloudflare: For DDoS protection, CDN, and DNS. Cloudflare may process connection metadata (IP address, request headers) to provide its security services. Cloudflare Privacy Policy
  • Cloudflare Web Analytics: Privacy-first, cookieless analytics (aggregated page views and performance metrics). It sets no cookies and does not track you across websites; it processes limited request metadata such as IP address, page URL, and referrer. Learn more

All fonts are self-hosted on our servers. No requests are made to external font services (such as Google Fonts).

4a. Why We Collect Your Email

We collect your email address (either directly or via OAuth providers) for the following purposes:

  • Account verification and security
  • Password reset functionality
  • Important service notifications (account suspension, DMCA notices)
  • Payment receipts (for premium subscribers)

We do not send marketing emails or share your email with third parties for advertising purposes.

4b. International Data Transfers

Some of our service providers (Stripe, Cloudflare, Google, Discord) are based in the United States. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards under Chapter V GDPR — in particular the EU-U.S. Data Privacy Framework (to which Stripe is certified) and/or the European Commission's Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR, together with supplementary measures where necessary.

5. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

  • Contract performance (Art. 6(1)(b)): Processing necessary to provide the service you signed up for (account creation, media hosting, sharing features).
  • Legitimate interest (Art. 6(1)(f)): Processing necessary for security, abuse prevention, and service improvement.
  • Consent (Art. 6(1)(a)): Where you have given explicit consent, such as agreeing to our terms during registration.
  • Legal obligation (Art. 6(1)(c)): Processing required by law, such as retention of payment records under German tax law (Abgabenordnung, AO).

6. Data Retention

We retain your data as follows:

  • Account data: Retained as long as your account is active. You can delete your account at any time via Settings.
  • Uploaded content: Deleted when you remove it or when your account is deleted.
  • Share analytics: Anonymized view data (hashed IPs, hashed user agents, referrer domains) is automatically purged after 90 days.
  • Payment records: Transaction data (invoice IDs, amounts, dates) is retained for 10 years as required by German tax law (§147 AO, §14b UStG). Credit card details are never stored by us (processed by Stripe).
  • Inactive accounts: Accounts with no login activity for 365 days may be deleted after a warning email is sent.

Account deletion is permanent and cannot be undone. All associated data, uploads, and shares are permanently removed.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Access: Request a copy of the personal data we hold about you. You can also download your data directly from Settings.
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data (you can also delete your account directly in Settings)
  • Restriction: Request that we limit the processing of your data
  • Objection: Object to data processing
  • Portability: Request your data in a machine-readable format. You can download a JSON export of your data from Settings.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

8. Cookies

We use only essential cookies that are strictly necessary for the service to function:

  • Authentication cookie: Keeps you logged in (expires after 7 days)
  • Share access cookies: Remembers password-verified access to shared content
  • OAuth state cookies: Temporary security tokens during login (expires after 10 minutes)

We do not use any tracking, advertising, or third-party cookies. Our analytics (Cloudflare Web Analytics) is cookieless and does not track you across sites. All cookies we set use httpOnly, secure, and sameSite flags for maximum security.

9. Data Security

We implement appropriate security measures including encryption, secure connections (HTTPS), and regular security updates.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the competent supervisory authority within 72 hours of becoming aware of the breach (GDPR Article 33)
  • Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34)
  • Document the breach, its effects, and the remedial actions taken

11. Data Processing Agreements

We have entered into data processing agreements (DPAs) with our third-party service providers (Stripe, Cloudflare) in accordance with GDPR Article 28. These agreements ensure that your personal data is processed only on our instructions and in compliance with applicable data protection law.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of any significant changes via email or through the service.

13. Contact

For privacy-related inquiries, contact us at [email protected]