Privacy Policy

Last updated: 19 October 2026.

This policy covers the PyxiGrow Android app, this website and support enquiries.

Who we are

Optimal Control Labs, s.r.o., registered at Karpatské námestie 7770/10A, 831 06 Bratislava, Slovakia, operates PyxiGrow and is the controller for the processing of personal data described here. For support or privacy requests, contact support@pyxigrow.app.

Artwork and data on your device

PyxiGrow does not require an app account. Artwork, projects, creative presets, editing history and settings are stored on your device, along with limited usage counters and technical logs. We do not automatically upload your artwork or project files.

Android backup and device transfer may copy app data and preferences, including your crash-reporting choice, depending on your device settings. Exported images may also be accessed or backed up by gallery, backup or sharing services you choose to use.

Optional diagnostics

We use Google Firebase Crashlytics, including Firebase Sessions and Installations, to investigate crashes and unresponsive-app events and measure app stability. Diagnostic data can include:

• Error messages, stack traces, event times and app state.
• App version, device model, operating system, memory and storage information.
• Installation, session and event identifiers, session timing and network connection type, including sessions without a crash.

These identifiers can link events to an installation, so reports are not anonymous. Firebase may also process IP addresses. We do not deliberately attach your name, email, artwork or project files, although error messages may contain filenames, paths or text from a failed operation.

Reporting is off on a fresh installation without restored preferences. You can enable or disable it in Settings → Privacy → Send crash reports. Disabling takes full effect after a full app restart. It does not remove reports already sent or necessarily cancel queued requests. Enabling may send reports previously stored on your device. Drawing and project features work with reporting off.

The app has no ads and does not use Google Analytics for Firebase. We do not sell personal data or use it for targeted advertising.

Premium purchases

Premium is a one-time purchase through Google Play, which handles payment and provides purchase confirmations. The app and our backend do not collect payment-card or bank-account details.

Our Google Firebase and Google Cloud backend verifies and restores Premium access, acknowledges purchases and updates access following refunds or revocations. Verification can process purchase tokens, product and order identifiers, purchase status, purchase time and billing region. Our database stores purchase tokens, verification and acknowledgement status, and related timestamps. The app stores a verified access flag for offline use.

Firebase App Check and Google Play Integrity help protect purchase verification. These services process app and device integrity information, attestation tokens, installation and service identifiers, and network information such as IP addresses. Related service logs may contain request details, client information, response status and timing.

Turning off optional diagnostics does not disable purchase verification, related security checks or the Firebase services required for them.

Support

We use Gmail to handle support and privacy enquiries. We receive your email address, any name you provide, your message and attachments you choose to send. We use this information to respond and investigate your request. The app's support link opens your email app without automatically attaching projects, screenshots or diagnostics.

Website visits

This website provides information about PyxiGrow. It does not offer user accounts or forms and does not use website analytics, advertising trackers or cookies for its own functionality.

Cloudflare delivers the website and processes technical request information, such as IP addresses, requested URLs, browser headers and traffic security data, to deliver content and protect the site. Cloudflare may use strictly necessary security cookies depending on the security features enabled for this website.

Providers and international transfers

Google Play, Firebase, Google Cloud, Gmail and Cloudflare receive the information needed to provide the services described above and may use subprocessors. Google handles Play payment information under its own privacy terms. Backup and sharing services you choose have their own privacy policies. We may disclose information when required by law.

Our purchase-verification backend and purchase database are hosted in the EU. Other processing by our providers may take place outside the European Economic Area, including in the United States. Applicable transfer safeguards include adequacy decisions and standard contractual clauses, as described in Google's transfer framework and Cloudflare's data processing terms. Contact us for details or a copy of the safeguards relevant to your data.

Provider information: Google Privacy Policy, Firebase privacy and retention, and Cloudflare Privacy Policy.

Legal bases

Where the GDPR applies, we rely on:

• Consent for optional diagnostics. You can withdraw it using the reporting switch. Withdrawal does not affect earlier lawful processing.
• Performance of our contract with you to verify and restore Premium access and provide purchase-related support.
• Legitimate interests in operating and securing the app and website, preventing purchase abuse and answering other support enquiries.
• Legal obligations when handling statutory privacy requests or legally required disclosures.

Diagnostic reporting is optional and is not required to use the app. Purchase verification and related security checks are necessary to activate or restore Premium access. Support enquiries are voluntary, but we need the information you provide to respond.

Retention and deletion

Local projects, presets and other app data remain on your device until you delete them or clear the app's data. Some temporary recovery files expire earlier. Uninstalling normally removes app-private data. Exported images and backups must be managed separately and may be restored independently of the app.

• Premium records: Purchase-verification records are retained for 400 days from the last successful verification of a valid entitlement or, for revoked purchases, from our first confirmation of definitive revocation. For pending purchases, the period starts when we first receive the record. These records support Premium restoration, refund and revocation handling, dispute resolution and fraud prevention. Automatic deletion follows expiry of this period, unless purchase acknowledgement is still being completed or longer retention is legally required. Deleting a verification record does not limit a valid Premium entitlement or determine how long Google Play keeps its payment records.
• Support correspondence: Messages and attachments are retained while the enquiry is being handled and for 12 months after it is closed. Information may be kept longer where necessary to meet legal obligations or establish, exercise or defend legal claims.
• Diagnostics: Firebase Crashlytics retains crash traces and associated identifiers for 90 days before beginning deletion from live and backup systems. Other session, installation and registration data follow Firebase's service-specific retention and deletion rules.
• Backend operational data: Purchase notifications are retained in transit for up to 1 or 7 days, depending on the subscription. Duplicate-processing records expire after 30 days and are then automatically deleted. Operational logs are retained for 30 days, and certain audit logs for 400 days.
• Website request data: Cloudflare retains technical request and security information according to its service-specific retention practices and applicable legal requirements.

Deletion from provider backup and recovery systems may take longer than deletion from active storage. See Google's deletion information and the Firebase and Cloudflare policies linked above.

To request access or deletion, contact us by email. Because PyxiGrow has no app account, your email alone may not identify diagnostic or purchase records. We may ask for information needed to locate your data and verify your request. Deleting our purchase record does not delete the Google Play order; later verification or a purchase notification may create a new record.

Security

Local app data is protected by Android's application sandbox. Purchase verification uses HTTPS, app attestation and server-side access controls. Our cloud services use access restrictions and encryption to protect processed information.

Your rights

Depending on applicable law, you can request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. Contact us at support@pyxigrow.app. We respond within the applicable legal time limits and explain any limitations.

You may complain to a competent data-protection authority, including the Office for Personal Data Protection of the Slovak Republic or the authority where you live or work in the EU. You do not have to contact us first.

Age and intended audience

PyxiGrow is intended for users aged 16 and over and is not specifically designed or marketed for children under 16. A parent or guardian with a privacy concern can contact us.

Changes to this policy

We will publish updates here and change the date above. Where required, we will provide additional notice or request consent before changing how we use your data.