Privacy Policy
Last updated: May 2026
Your photos never leave your device
PixiPile is a local-first application. All photo viewing, sorting, rotating, and organizing happens entirely on your Mac. No photos, thumbnails, metadata, filenames, or folder paths are transmitted to any server — ever.
What we do collect
If you activate a license (Plus or Pro), the app communicates with our license server at pixipile.com. The request payload is limited to:
- Your license token (an opaque credential)
- A SHA-256 hash of your machine identifier (not the raw identifier)
- The app version string
This information is used solely for license validation, seat counting, and entitlement issuance. No photo data, usage patterns, or browsing history is included.
If you start a trial or purchase a subscription, we store your email address to deliver your license token and for account recovery. We do not sell, rent, or share your email with third parties. We use Resend to deliver transactional emails.
Payment processing
Payments are processed by Stripe. We do not store credit card numbers. Stripe's privacy policy governs the handling of payment information.
Analytics and crash reporting
PixiPile does not include any analytics frameworks, crash reporters, or telemetry SDKs. The only network traffic the app generates is the license check-in described above. If you use the Free tier without activating a license, the app makes zero network requests.
BYO AI keys (Pro feature)
Pro users who enable AI features provide their own API keys for services like OpenAI or Anthropic. These keys are stored in your macOS Keychain and are sent directly from your Mac to the AI provider — they never pass through our servers. When an AI feature processes a photo, the image data goes directly to the provider you chose.
macOS App Sandbox
PixiPile runs inside the macOS App Sandbox. It can only access folders you explicitly grant via the system file picker. It cannot read your contacts, calendar, browser history, or other applications' data.
Data retention
License server logs that include IP addresses are purged after 30 days. Machine fingerprint hashes are retained only as long as the associated seat registration is active.
Contact
Questions about this policy: support@pixipile.com