Privacy Policy

Last updated: 30 May 2026

1. Data controller

Andreas Ploderer, Wiener Straße 45, 3390 Melk, Austria.
Contact: privacy@app-pixels.com.

2. What we collect and why

Account — email address and password hash, stored to authenticate you. Legal basis: contract (GDPR Art. 6(1)(b)).
Flash / download events — timestamp, your user ID, the app id and whether you flashed or downloaded. Used for usage analytics and abuse prevention. Legal basis: legitimate interest (Art. 6(1)(f)).
App submissions — if you submit an app, the GitHub URL/ref, slug, metadata, and screenshots you provide. Stored to review and publish your submission. Legal basis: contract (Art. 6(1)(b)).
Server logs — Vercel and Supabase keep request logs (IP, user agent, timestamp) for short periods. Used for security and reliability. Legal basis: legitimate interest (Art. 6(1)(f)).
Cookies — only an essential authentication session cookie set by Supabase. No tracking or marketing cookies are set.

3. Third-party processors

Supabase (database, auth, storage) — supabase.com/privacy
Vercel (hosting, edge runtime) — vercel.com/legal/privacy-policy
Fastmail (transactional email) — fastmail.com/about/privacy
GitHub (CI builds, source hosting) — github.com privacy

4. Retention

Account data is kept as long as your account exists. Flash/download events are retained for up to 12 months. Rejected or withdrawn submissions are purged after 30 days. Server logs follow the processors' own retention schedules.

5. Your rights

Under GDPR you have the right to:

Access your data (Art. 15)
Rectify inaccurate data (Art. 16)
Erase your data (Art. 17) — also via the "Delete account" button on /account
Restrict processing (Art. 18)
Data portability (Art. 20)
Object to processing (Art. 21)
Lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at)

6. Minimum age

You must be at least 16 years old to create an account. If you are between 13 and 16, we require verifiable parental consent (please contact us).

7. Changes