Privacy Policy
The short version
- Your photos are only visible in your account. BackPix has no public gallery or feed.
- Your selfies go to the AI services that make your pictures only to make them, never to be sold or to train AI.
- We do not sell your data, and neither we nor our AI providers use your photos to train AI.
- BackPix does not ask for your location.
- The photo of each place is deleted after 30 days. The rest stays until you delete it or your account, within the limits under How long we keep it.
- We keep basic usage statistics to run and improve BackPix. On the website, cookies and ad measurement only run if you say yes, except in the United States, where they are on until you turn them off. In the app, nothing optional runs until you say yes, wherever you are. Session replays only ever run on a yes.
The short version helps you read the rest; the full policy below is what applies.
Who is responsible
The data controller is BackPix. Contact: support@backpix.app.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, and your name if you sign in with Google or Apple | Your account; confirming it is yours; receipts and service messages | Contract |
| Photos of your face, and of people you add | To create photographs that look like you. We do not use them to recognise or identify anyone, and we do not make face templates or other biometric identifiers from them. | Our contract with you: we need them to make the pictures you ask for. For people you add, also your confirmation in the app that they agreed |
| That you agreed, which wording, and when | Showing that the photos were sent with permission | Legal obligation; legitimate interest |
| The photo of the place you frame, and the time it was taken | To place you in that scene with the right light and perspective | Contract |
| The photos BackPix makes for you, and any instructions you type for a shot | So you can see, save and share them, and ask for changes | Contract |
| Purchases: what you bought, when, the amount and your country | Granting credits, handling payment problems, tax and accounting | Contract; legal obligation |
| A random device id, and a one-way hash of your IP address and email | Stopping the free credits being claimed over and over | Legitimate interest |
| Technical logs: IP address, browser and times of requests | Keeping the service secure and fixing errors | Legitimate interest |
| A push notification address, if you turn notifications on | Telling you when your photos are ready | Consent |
| Photos you report from the app | Reviewing content that may be offensive or made without someone's consent | Legitimate interest; legal obligation |
| Messages you send us | Answering you, and handling payment problems and reports | Contract; legitimate interest |
| Basic usage statistics: screens and buttons used, shots made, credits used and purchases, linked to a random account id and never to your name, email or photos | Understanding how BackPix is used, fixing what is confusing or broken, planning costs | Legitimate interest (you can object at any time) |
| Recognising your visits on this device over time, and anonymised session replays with photos and typing hidden | Finding what is confusing or broken | Consent (cookie choices); in the United States, on until you opt out, with session replays only on a yes |
| Which ad brought you, and whether you signed up or bought. If you allow this only after you have started, we also tell Meta when you started, if that was in the past seven days. | Measuring our advertising | Consent (cookie choices); in the United States, on until you opt out, and off for a browser that sends Global Privacy Control |
We only receive the photos you take in BackPix or pick yourself; we do not browse your photo library. Your email and photos are needed to provide BackPix; notifications, analytics cookies and ad measurement are optional, and BackPix works without them. Our front page counts visits without cookies and without identifying you.
How the AI uses your photos
To make a shot, your selfies and the photo of the place are sent to image-generation models run by our providers, and a description of the scene is planned by language models. Your name and email address are not sent with them. An AI also checks each result for quality before it reaches you. Under their terms, our providers may use your photos only to return the result to us and, for a limited time, to guard their service against abuse, and not to train their models. We ask OpenRouter to route our requests only to providers that neither store nor train on what they receive.
Your photos are sent only when you save them to make pictures. When you add someone else, the app asks you to confirm they agreed. You can stop at any time by deleting the people in Settings → Cast, or your account; nothing more is sent after that.
Every image BackPix makes is marked as AI-generated in its file (IPTC "trained algorithmic media"), as EU law requires. Each photo in the app has "Report this photo" for anything offensive or made without someone's consent.
Face photos and biometric laws
Some laws, such as those of Illinois, Texas, Washington and Colorado in the United States, can treat photos of a face as biometric information. BackPix does not scan, measure or template faces, and does not use them to identify anyone; the photos are only used as references to draw you. Even so, we treat them with the care those laws ask for: we only collect them when you choose to save them, never sell, lease or trade them, never disclose them except to the providers named below to make your pictures, and delete them on the schedule under How long we keep it, at the latest one year after you last use BackPix.
Who can see your photos
Your photos are only visible in your account. Apart from our providers processing them as described above, they leave your account only when you save or share them yourself. We look at an account's content only when you ask us to, for example to solve a problem you reported, or when we must investigate a report of illegal content or a legal request.
Automated decisions
An automated check decides whether a new account receives free credits, based on signs of repeat claims. It affects nothing else. If you think it got it wrong, write to us.
Who processes it for us
- Google Firebase / Google Cloud: database, storage and servers in the EU (Belgium); sign-in accounts, which Google may process outside the EU.
- fal.ai (USA): runs the image-generation models, including models made by OpenAI, Google and Meta.
- OpenRouter (USA) and the AI providers it routes to (such as Google, Anthropic, and hosts of Alibaba's Qwen models): plans each photograph from the scene, and checks the results.
- Stripe and Link (Ireland / USA): payments on the website. They are also independent controllers for fraud prevention and, when Link acts as the reseller of your payment, for the sale, its receipt and its tax.
- Apple: purchases in the iPhone app, which Apple sells and processes as an independent controller under its own terms; Sign in with Apple; and notifications to iPhones.
- RevenueCat (USA): confirms App Store purchases so your shots arrive. It receives your account's random id, what you bought, and your email if you have an account.
- Google Sign-In: signing in with Google, if you choose it.
- Expo (USA): delivers notifications to the app, if you turn them on, and app updates.
- Your browser's push service (Apple, Google or Mozilla): delivers notifications on the website, if you turn them on.
- PostHog (EU): usage statistics; cookies and session replays according to your choices.
- Meta Platforms Ireland: ad measurement, according to your cookie or privacy choices. On the website, including sign-ups and purchases sent from our server with your email and account id hashed. In the iPhone app, app events that do not identify you (the app was installed or opened, an account was created, a purchase was made) through Apple's privacy-preserving ad measurement; your account id, email and your iPhone's advertising identifier only if you also allow tracking when your iPhone asks.
Each works under a contract that limits it to providing its service to us. Transfers to the USA rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. We do not sell your data or share it with anyone for their own marketing.
In the United States. Under California's and other states' privacy laws, letting Meta measure our ads can count as "sharing" personal information or "targeted advertising", though no money changes hands. You can opt out at any time from "Your privacy choices" at the bottom of the front page, in Settings → Cookie choices on the website, or in Settings → Privacy choices in the app, and a browser sending Global Privacy Control is opted out automatically. You can also ask what we hold about you, and have it corrected or deleted, by writing to support@backpix.app; we will not treat you differently for doing so.
We may disclose data where the law requires it, for example to a court or the police on a valid legal request. If BackPix is transferred to another company, for example one we set up to run it, your data moves with it under this policy, and we will tell you.
How long we keep it
- The photo of the place: 30 days, then deleted automatically.
- Your selfies and the people you added: until you remove them or delete your account, and in any case deleted automatically if BackPix is not used on the account for 12 months. Replaced photos are deleted when you replace them.
- The photos BackPix made: until you delete them or your account.
- Your account: until you delete it (Settings → Delete my account). If you never created an account or bought anything, everything is deleted automatically after 6 months without use.
- The record of your agreement: as long as the photos it covers, and as long as needed to show it afterwards.
- The hashes used to stop free-credit abuse: 12 months.
- Technical logs: about 30 days.
- Messages and reports you send us: as long as needed to deal with them and any follow-up.
- Payment records: kept by Stripe, Link or Apple, and in our accounts, as long as Italian tax law requires (currently 10 years), also after your account is deleted.
- Usage statistics: up to 12 months, linked only to a random account id.
Security
Data travels encrypted over HTTPS and is stored by Google Cloud in the EU. Access rules let each account reach only its own data, and card details are handled by Stripe alone. No system is perfectly secure; if a breach put your data at risk, we would tell you and the authority as the law requires.
Emails and notifications
We email you about your account and purchases: confirming your address, receipts and important changes to BackPix or these policies. We only email you about new BackPix features or offers if you asked for it, or if you have bought from us and did not object; every such email lets you unsubscribe. Notifications only arrive if you turn them on, and you can turn them off in your phone's settings.
Your rights
You can ask to access, correct, delete or export your data, to restrict or object to how we use it, and withdraw consent at any time (Settings → Cookie choices for analytics and ads; removing people or deleting your account for your photos). Deleting your account in Settings deletes your photos and account data, except the records the law requires us to keep. Write to support@backpix.app from your account's email address for anything else; we may ask you to confirm it is you, and we answer within the time the law sets. You can also complain to the Italian data protection authority, Garante per la protezione dei dati personali, or the authority where you live.
Age
BackPix is for people aged 18 and over: the Terms require it, and the App Store lists the app as 18+. A child can only appear in BackPix if a parent or guardian adds them. If you believe someone younger has an account, write to us and we will delete it.
Cookies
What we store on your device, and your choices, are explained in our Cookie Policy.
Changes
We may update this policy when BackPix, our providers or the law change. If a change matters, we will tell you in the app or by email before it takes effect.