Privacy Notice

Updated September 22, 2026 · Version 2026-09-22

Who is responsible for your information

PixoraHQ is the controller of the personal information described in this notice. Its published mailing address is 1219 Lakeview Ave, Dracut, MA 01826, United States, and its privacy contact is info@pixorahq.com. PixoraHQ has not appointed EEA or UK representatives, so Pixora Locator is not offered, marketed, or distributed to external testers or customers in the European Economic Area or United Kingdom.

What PixoraHQ processes

We process account email and name, security credentials in protected form, account and device security events, profile and circle information, connections, posts, replies, drafts, message read settings, media, reports, moderation records, notifications, and technical records needed to operate and protect the service. If you use Budget, we also process the household names, account labels and balances, transactions, categories, recurring bills and income, savings goals, imported CSV contents, settings, and Planner calendar items that you choose to sync.

If a signed-in member asks PixoraHQ to send a Connect invitation, we process the recipient mobile number only to deliver that one invitation. Pixora does not add the number to an alert or recurring-message list and does not retain it in the member's Connect profile. Our messaging provider may retain limited delivery and opt-out records.

If you use Pixora Locator, we process the latest location you choose to share, sharing precision and duration, device name, battery percentage, update time, saved Places and radii, selected arrival and departure settings, place-event entries without coordinates, hour-grouped family-map access records, optional avatar, accepted Locator connections, push token, Safety alert and timer records, and Google Play or App Store product, entitlement, renewal, expiration, and protected transaction information. Google Play or Apple, not PixoraHQ, processes your payment-card information.

PixoraHQ does not sell, rent, or share mobile numbers or messaging data with third parties or affiliates for marketing or promotional purposes. We share this information only with telecommunications and service providers as necessary to deliver the one invitation requested by a member and honor opt-outs. Message and data rates may apply.

Budget privacy

Pixora Budget does not ask for online-banking usernames or passwords and does not connect directly to a financial institution in this version. Budget data belongs to the Pixora household account and is limited to authenticated household owners and adults. Selected bill, payday, and goal information is copied to the adult-only portion of the household’s Planner calendar when a user chooses calendar sync. CSV files are parsed to create transactions; users should remove sensitive columns that are not needed before importing.

Age assurance

For a self-managed account, you provide birth month and year so we can determine whether you are at least 18. We retain only an age category, the method and policy version, and the time of the check—not your birth month, year, or full birth date. For a parent-managed profile, the parent provides the month and year; we retain only whether the person is under 13, age 13–15, or age 16–17, plus the parent’s consent record. Age screening is not government-ID identity verification. Parent-managed profiles for ages 13–17 require the parent to reauthorize with their adult account. Under-13 profile creation is unavailable unless PixoraHQ has enabled a reviewed verifiable-parental-consent process; an ordinary checkbox or account password is not treated as that consent.

How information is used

We use information to provide and personalize PixoraHQ, deliver content to selected audiences, support parent and group controls, authenticate users, detect abuse and security threats, process reports, troubleshoot, improve reliability, comply with law, and communicate service or security notices. Age information is used only for eligibility and safeguards.

Legal bases for EEA and UK users

We process account, current-location, Places, connection, Safety, device, and subscription-entitlement information as needed to provide the service you request and perform our contract with you. Optional features remain under your control, and we request the device permissions needed for them. A device permission is not by itself our legal basis under data-protection law. We rely on our legitimate interests, subject to a balancing assessment, for proportionate account security, fraud prevention, service-integrity, map-access logging, and legal-claim records. We process records when necessary to comply with a legal obligation. Where consent is the required basis, you may withdraw it without affecting processing that was lawful before withdrawal.

Pixora Family location privacy

Pixora Family location sharing is off by default and begins only when the person carrying the phone turns it on. That person chooses precise or approximate sharing, a time limit, and whether updates may continue in the background. Approximate coordinates are rounded on the phone before transmission and checked again before storage. Android shows an ongoing system notification and iOS shows its system location indicator while background sharing is active.

The household's authenticated owner and adult members can see locations currently shared with that household. A user may also accept a one-time Locator invitation; acceptance creates a mutual connection so each person can see the other's current shared location, and either person can remove the connection at any time. A user may also join a temporary Locator group after receiving an email or text invitation. For text delivery, the mobile number is sent to our configured SMS provider and is not retained in the group record. Joined group members can see one another's current shared locations only until the creator's selected expiration; a member can leave, or the creator can end the group, at any time. An optional map avatar is resized and shared only with the household, accepted Locator connections, and active temporary groups the user joined. Pixora records a limited, hour-grouped access history so household members can see who opened the family map. Pixora keeps only the latest accepted location for a sharing device, automatically removes it after 24 hours, and removes it immediately when the person stops sharing or selects deletion. Signing out stops that phone from sending updates but does not by itself delete the last accepted point; the point remains until sharing is stopped, it is separately deleted, it expires after 24 hours, or the account is deleted. Saved family places remain until an authenticated adult deletes them. Location is not sold and is not used for advertising or analytics.

A signed-in user may select a one-time migration file created by the Pixora Locator Home Assistant App from selected zones. Locator verifies the file, sends only the zones selected in its import preview, and deletes its temporary cached copy. Pixora independently verifies the selected payload and creates or matches the selected Places. The exporter does not read recorder history, and the file contains no tracker records, coordinate trail, or arrival/departure activity. Home Assistant credentials are never included, and Pixora retains no migration receipt. New Places start fresh; existing matching Places keep their current activity and settings. Imported Places follow ordinary Place retention.

For a limited troubleshooting test, an administrator may explicitly enable a delivery watchdog for two named household test phones. While enabled, Pixora keeps a restricted diagnostic log of location requests those phones send, how the server processes them, and map responses generated for the other selected phone. It includes exact coordinates, GPS and server times, accuracy, movement, battery level, the phone-reported app version and build, and rejection reasons. Repeated unchanged map responses are sampled rather than logged on every poll. This temporary log is separate from the normal current-location record, is visible only to an authenticated Pixora administrator, is kept in a rolling 48-hour diagnostic window with periodic cleanup, and is removed when the test is disabled or a selected phone is removed. It is not shown as a route or shared with Locator friends.

Automated safety screening

Before Connect delivers a post, reply, Private Room message, edited message, supported image, or attachment caption, it sends the submitted content to OpenAI's moderation service to check for serious safety concerns. This check applies even in Private Rooms. A flagged submission is not delivered and may be retained in a restricted moderation record for authorized Pixora administrators to review. Pixora does not use this screening alone to make automatic permanent-ban or law-enforcement decisions. When the first check does not flag a submission, a second context-aware check may also review the new text together with up to six recent conversation snippets to distinguish credible safety concerns from support, prevention, recovery, news, or fictional discussion. This second check uses OpenAI's GPT-5.4 nano model and returns a short, structured safety classification; it does not publish or reply to the conversation.

Sharing

Content is shared with the people or circles selected by the user, subject to blocks and safeguards. We may use hosting, email, security, and other processors to operate the service; disclose information with consent; respond to valid legal process; or protect people, rights, and the service. We do not promise that recipients will not copy or redistribute content.

Security

Pixora encrypts service traffic in transit. Current location, Places, access records, and Safety records are encrypted at the application layer before database storage in production. Access controls limit who can view information, session revocation lets you end account sessions, and rate limits help protect against misuse. Pixora also maintains incident-response procedures. These safeguards reduce risk, but no method of storage or transmission can be guaranteed completely secure.

Service providers and integrations

PixoraHQ uses service providers only for defined operating purposes. These currently include Render for application hosting, databases, and key-value infrastructure; configured object storage for encrypted backups and Connect media; Resend for account and safety email; OpenAI for the safety screening and optional assistant features described in this notice; Expo and its notification infrastructure for optional mobile push notifications; Firebase Cloud Messaging and Apple Push Notification service for platform notification transport; Google Maps Platform for Android map display and user-requested address lookup; Apple Maps for native iPhone and iPad map display; Google Play for Android subscription purchase and Apple App Store for iPhone/iPad subscription purchase when Apple sales are enabled. The applicable store manages renewal, cancellation, restoration, tax, and payment processing. PixoraHQ receives entitlement and transaction identifiers from the applicable store but not payment-card numbers. When a user enables an integration, Pixora may also send the information needed for that request to the selected provider, such as Google Photos, Home Assistant, Hubitat, Pushover, Telegram, Slack, Discord, or a user-configured webhook. If Pixora text messaging is enabled, Pixora sends the destination number and message content to its registered telecommunications provider solely to deliver and manage those messages. Those providers process information under their own terms and privacy notices. Pixora does not give an integration access to unrelated Planner or Connect information.

Some providers process information in the United States or other countries. Before offering Locator in the EEA or UK, PixoraHQ will document the applicable adequacy decision, Data Privacy Framework participation, Standard Contractual Clauses, UK transfer mechanism, and supplementary measures for each relevant transfer. Contact PixoraHQ for the current provider and transfer-mechanism list or questions about a particular transfer.

Advertising

Pixora apps and the public PixoraHQ site do not currently display active advertising. The public site loads Google AdSense code for site verification and advertising readiness. That request may provide Google with ordinary browser, device, network, and page-request information under Google's own privacy terms. If active advertising is enabled, this notice and the site's consent controls will describe the applicable processing. Parent-managed child accounts will not receive personalized advertising, and private household information will not be used to target ads.

Retention and security

We retain information as needed for service operation, security, moderation, legal obligations, dispute resolution, and backups. Expiring content is removed from ordinary access after its timer, but copies may persist temporarily in backups, logs, recipients’ devices, or legal holds. We use safeguards designed to protect information, but no system is completely secure.

Locator keeps one latest accepted point per sharing device. It is deleted when sharing is stopped or deletion is selected and otherwise expires after 24 hours. A Quick Check-in stores only its short message and time, replaces the prior check-in from that phone, and expires after 24 hours. Saved Places remain until an authenticated adult deletes them. Place-event entries contain the member name, Place name, event type, and time without coordinates and expire after the household-selected 1, 7, or 30 days. An avatar remains until replaced, removed, or the account is deleted. A Locator connection remains until either participant removes it. Push tokens remain while notifications are enabled for a signed-in device and are removed on sign-out or device removal. Operational map access records are hour-grouped and are deleted after 30 days. Active or alerted Safety timers remain available until completed or cancelled; completed and cancelled timer records are deleted after 30 days. Closed Safety incidents remain available for 24 hours. Subscription entitlement records remain while needed to provide or restore access, resolve a billing dispute, prevent entitlement reuse, or meet accounting and legal obligations.

Active account and workspace information is kept until the user deletes it, closes the applicable feature, or deletes the Pixora account, unless a shorter product timer applies. Connect report snapshots and preserved report media have a two-year deletion date unless a documented legal hold requires longer preservation. Connect safety events are limited to the most recent 2,000 records. School verification expires after 180 days. Account deletion removes credentials, sessions, devices, Planner, Student, Budget, Care, and Connect working data associated with the account. Account sessions expire after no more than 30 days; expired and revoked session records are removed during session maintenance. Account security-event records are deleted after 180 days unless a documented legal hold requires longer preservation. Limited copies may remain temporarily in encrypted backups, provider logs, fraud and security records, legally required transaction records, or legal holds and are isolated from ordinary product use until their applicable schedule expires.

When you withdraw text-message consent, Pixora removes the active mobile number from ordinary alert use and retains a limited record of the consent and withdrawal as needed to honor the opt-out, demonstrate compliance, prevent unwanted messages, and resolve disputes.

When a Pop-up Circle closes, ordinary messages and working media are deleted. Its empty Circle record and limited activity metadata are deleted after a seven-day recovery period. Separately stored report evidence or material under a legal hold may be retained for the stated safety or legal period. A recipient may already have made a copy.

School email verification

A school email verification proves control of an address at the shown domain; it does not prove current enrollment, age, identity, or school endorsement. Verification expires after 180 days. School Circles are independent communities and are not operated or endorsed by the named school. Verified adults may create lasting College Circles inside that school community. Their names, descriptions, and member counts are visible only to adults with a current verification at the same school; posts remain visible only to members. PixoraHQ does not use university seals to imply affiliation.

Choices and parent controls

Users can use audience controls, blocks, filters, reports, deletion, and security settings. Parents control approved contacts and safeguards for managed children. A verified parent or guardian may review or export a managed child’s information, revoke permissions, and request correction or deletion. We will give the parent direct notice before materially changing the information collected from a child. Applicable law may provide additional access, correction, deletion, objection, appeal, or portability rights.

EEA and UK rights and complaints

Depending on the circumstances, EEA and UK users may request access, correction, deletion, restriction, or portability of their information; object to processing based on legitimate interests; and withdraw consent where consent is used. We ordinarily respond within one month after verifying the request, subject to lawful extensions or exceptions. A user may also complain to the data-protection supervisory authority where they live or work or where they believe an infringement occurred. Contact info@pixorahq.com to exercise a right. EEA and UK representative contacts will be added here before Locator is offered in those regions.

Locator availability in the EEA and UK

Pixora Locator is not currently available to external testers or customers in the EEA or UK. Any future release there would be limited to adults age 18 and over unless a separate child-focused impact assessment, best-interests review, age and parental-responsibility process, child-facing notice, and appropriate product controls were completed.

Locator Settings provides a private JSON export for the signed-in phone and its associated person; authentication secrets and other people's current locations are excluded. Connect settings provide a private JSON export and Connect-only deletion. Student provides its own export and deletion controls. The account-security page provides complete Pixora account deletion. A user may also contact PixoraHQ to request access, correction, deletion, portability, restriction, objection, or an appeal of a privacy request decision where applicable. Pixora will verify the request and respond within the period required by applicable law.

Contact

Email info@pixorahq.com or use the contact information published at pixorahq.com for privacy requests. PixoraHQ's published mailing address is 1219 Lakeview Ave, Dracut, MA 01826, United States. We may need to verify the requester’s identity or authority before acting.