Privacy Policy

Data we collect

We process only the data required to provide PiPic:

• Images you submit for compression, together with their file metadata (name, size, format), for the sole purpose of compressing them.
• If you sign in, we store your account profile (email, name and avatar from GitHub or Google — the email must be one the provider has verified) and the linked provider identity. Each signed-in session records a one-way hash of your IP address, not the address itself, plus your browser's user agent. API tokens you create for the Agent CLI are stored only as a SHA-256 digest — never as the plain token — together with the token's name, creation date and last-used date. If you subscribe to a paid plan, we also store your plan tier (free or pro), a Stripe customer identifier, and your subscription status, price and current billing-period end date — never your card details, which are collected and held by Stripe, not us. We also keep a monthly counter of how many images you have compressed through the CLI or API: a running total per calendar month used to enforce your allowance, not a log of individual requests.
• Standard usage and device data collected through Google Analytics — for example pages viewed and approximate region — but only after you accept analytics cookies.

How and why we use your data

We use your images to perform the compression you requested, which is necessary to provide the service you ask for. We use analytics data to understand how the site is used and to improve it, on the basis of the consent you give through the cookie banner. We do not use your data for automated decision-making or profiling.

Your files

Your images are transmitted over an encrypted connection, compressed, and returned to your browser. They are deleted immediately after processing and are never stored, backed up, shared, or used to train machine-learning or AI models. In the cases where an image is compressed locally in your browser instead — for example when our service is temporarily unreachable — it never leaves your device at all.

Third-party services

We rely on a small number of providers to operate PiPic: Google Analytics measures site usage, Cloudflare provides hosting, security and content delivery, and Stripe handles payment processing and subscription management for paid plans — checkout happens on Stripe's own hosted page, and we never receive or store your full card number. Each receives only the data it needs for its function. Some of these providers process data outside your country; where that happens, the transfer is covered by an adequacy decision or standard contractual clauses.

Data retention

Uploaded images are deleted as soon as compression finishes. Analytics data is retained according to our Google Analytics configuration and then deleted automatically. Signed-in sessions expire automatically after 30 days. Revoked API tokens stop working within about a minute. We keep a record of them — the name you gave it, its creation and last-used dates, and a one-way hash, never the token itself — so past access remains auditable. Account profile data is kept until you ask us to delete it.

Cookies and analytics

By default, PiPic sets no analytics or advertising cookies. On your first visit a banner asks whether you accept analytics cookies; Google Analytics runs only if you accept. If you decline, no analytics cookie is set and every feature keeps working the same. Your choice is remembered on your device — to change it, clear PiPic's site data in your browser and the banner will reappear.

Your rights

Depending on where you live, you may have the right to access, correct or delete the personal data we hold about you, to receive a copy of it, to object to or restrict its processing, and to withdraw consent at any time. To exercise any of these rights, email privacy@pipic.cc. You also have the right to lodge a complaint with your local data protection authority.

Children's privacy

PiPic is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time to reflect changes to the service or the law. When we do, we will revise the date at the top of this page, and significant changes will be highlighted on the site.