Skip to main content

Privacy Policy

Last updated: October 14, 2026

This Privacy Policy explains how PictoFlex AI ("PictoFlex," "we," "us," or "our") processes information when you access or use pictoflex.com and related services (collectively, the "Service").

1. Scope

This Policy applies to information processed through the Service, including account creation, image generation and editing, support requests, purchases, and use of our website and mobile app.

2. Information We Process

Depending on how you use the Service, we may process:

  1. Account and authentication information, such as your name, email address, profile image, authentication identifiers, language, and account preferences.
  2. Service and device information, such as feature usage, session events, timestamps, IP address and approximate location derived from it, browser and device information, visitor identifiers, and anti-abuse signals.
  3. AI request information, such as prompts, style selections, reference images, generation parameters, and information needed to process and deliver a result.
  4. Transaction information, such as subscription and payment status, plan identifiers, credit usage, purchase references, and billing metadata supplied by payment providers, including Google Play. We use purchase references and store status to verify payments, deliver credits and membership, restore purchases, and handle refunds. We do not store complete payment card numbers.
  5. Support information, such as the name, email address, messages, and attachments you provide when contacting support.
  6. Cookie and similar technology information, including information needed for login, preferences, security, Google Analytics, PostHog product analytics, and Adsterra.
  7. Android installation and referral information, such as the download source, campaign identifiers, referral-click and installation timestamps supplied by Google Play Install Referrer. A randomly generated handoff identifier may connect a website download interaction with an app installation. On its first eligible launch, the app reads this information and records a local completion marker to avoid repeated reads on subsequent launches. We send selected attribution fields to PostHog, not the complete raw referrer string.

3. How We Use Information

We use information to:

  1. Provide, maintain, and protect the Service.
  2. Authenticate users, manage accounts, and process payments, subscriptions, and credits.
  3. Process image generation or editing requests and deliver results.
  4. Prevent abuse, fraud, security risks, and violations of our Content Policy.
  5. Respond to support requests and send necessary service notices.
  6. Understand aggregated, non-content operational activity to maintain security, reliability, and cost controls.
  7. Display advertising and measure website visits and use.
  8. Measure product use and conversion across our website and Android app, including installation, sign-in, creation outcomes, purchase interactions, and fulfillment status, without sending AI content to product analytics.

4. AI Content Handling

Your prompts, reference images, and generated outputs are used only to complete your request, protect the Service, and address necessary troubleshooting.

PictoFlex does not use your prompts, reference images, or generated outputs to train AI models, improve products, publicly display content, or market the Service.

To complete a generation or editing request, we may transmit the content necessary for that request to the applicable third-party model provider. That provider may process the received information under its applicable terms and privacy practices. We do not separately provide your AI content to a provider for the purposes listed above.

5. Temporary Reference Image Handling

Most model providers support data_url delivery. For those requests, a reference image is sent directly as image/base64 data and is not stored on PictoFlex servers.

When a model provider requires a reference image URL, we temporarily store the image in Cloudflare R2 only to complete that request. The R2 lifecycle policy automatically deletes those temporary files after 24 hours.

6. When We Share Information

We may disclose necessary information to service providers that help us provide the Service, including:

  1. AI model providers that process a request for your selected model.
  2. Providers of cloud storage, authentication, security, email, and infrastructure services.
  3. Payment providers that process payments, subscriptions, and billing. For Google Play purchases, we send pseudonymous account and purchase references to associate the transaction with your Service account and receive purchase, subscription, and refund information from Google Play.
  4. Google Analytics and Cloudflare Web Analytics for website analytics and performance measurement, and Adsterra for advertising.
  5. PostHog for product analytics and, only when enabled, masked session replay. We send selected page, device, source, interaction, and transaction-status attributes using pseudonymous visitor or internal account identifiers. We do not send raw prompts, uploaded or generated image content, authentication credentials, full payment details, or support messages to PostHog. See PostHog's privacy information.

We may also disclose information when required by law; to protect users, the Service, or our rights; to enforce our Terms and policies; or in connection with a reorganization, merger, or asset transfer.

Service providers process information only as needed to provide their services and may be subject to their own terms and privacy policies.

7. Retention and Account Deletion

We retain information only for as long as needed to provide and protect the Service, meet applicable obligations, and handle necessary operational matters.

When you delete your account, we delete your account and associated user content through our deletion process.

We retain limited transaction references as needed to reconcile payments, prevent duplicate purchase claims, and meet applicable recordkeeping obligations. Deleting an account does not itself cancel a Google Play subscription; manage cancellation through Google Play before completing account deletion.

8. Security

We use reasonable technical and organizational measures to protect information. No internet transmission or electronic storage method can be guaranteed to be completely secure.

9. Cookies, Advertising, and Your Choices

We use cookies and similar technologies for login, preferences, and security. We use Google Analytics to measure website use; see how Google uses information from sites that use its services. Cloudflare Web Analytics measures website use and page performance through a browser beacon; see Cloudflare Web Analytics.

When enabled, PostHog measures product use and conversion with a pseudonymous visitor identifier that is linked to an internal account identifier after sign-in. Session replay is disabled by default; if enabled, text, form values, and media are masked. You can contact us using the address below for an analytics privacy request.

Android app version 1.0.2 and later uses PostHog for product analytics. It sends app lifecycle events and selected interactions, together with app version, operating-system and device information, pseudonymous identifiers, and the installation attribution described above. PostHog may derive an approximate country, region, or city from the network IP address; the app does not request GPS or precise device location for analytics. Android session replay and screen recording are disabled. Browser cookie controls do not control app analytics, and the Android app does not provide an in-app analytics opt-out switch. Signing out resets the app's analytics identity; it does not itself delete historical analytics records. You may contact us to request access to or deletion of analytics information associated with your account.

We use Adsterra to provide advertising on eligible public pages for visitors and free accounts. When advertising is enabled, Adsterra and its advertising partners may use cookies and similar technologies and process technical information, such as IP addresses, browser and device information, page visits, and ad interactions, to deliver and measure advertising and prevent fraud. See Adsterra's Privacy Policy. Our integration does not add your prompts, image URLs, email address, internal account ID, or payment information to advertising parameters.

Advertisements and sponsored links may open third-party websites in a new tab or window. Those websites apply their own privacy practices. Accounts with a currently effective paid plan do not receive advertising from this integration.

You may manage your account information or delete your account in account settings, and control cookies through your browser settings. Limiting cookies or blocking third-party resources may affect parts of the Service. For privacy requests or assistance, contact [email protected].

10. Access, Correction, and Deletion Requests

Where applicable law provides these rights, you may request access to, correction of, or deletion of information we hold about you by contacting [email protected]. To protect account security, we may need to verify your identity before acting on a request and may limit or decline a request where permitted by applicable law.

11. Adults Only

The Service is for users who are at least 18 years old. We do not provide the Service to people under 18.

12. International Processing

Information may be processed in countries or regions other than the one where you live in order to provide the Service.

13. Changes and Contact

We may update this Policy from time to time and will update the "Last updated" date on this page. Continued use of the Service after an update means you accept the updated Policy to the extent permitted by applicable law.

For questions about this Privacy Policy, contact [email protected].