Privacy Policy

• Customers are people with a Pixel Sentinel account. For customer data, we decide how it’s used, and this policy applies directly.
• Visitors are people who view a protected image on a customer’s website. We process visitor data on the customer’s behalf, only to protect their images, under our Data Processing Agreement. The customer’s own privacy policy also applies to their site.
• People asking for a free report on where their site’s images have been copied (Where are my images?). They don’t need an account for a report on their website; a report on pictures they upload needs one. For their data, we decide how it’s used, and this policy applies directly.

• Account details: Your email address. You can sign in with Google, Microsoft, Facebook or Pinterest, or with your email address and a password. For a social sign-in, we store the account ID that provider gives us and the email address it confirms. Pinterest shares no email address, so you type one and confirm it by email. If you sign in or connect with Pinterest, we also keep an encrypted access token for your Pinterest account, used only when you ask the dashboard to post a copy of an image to one of your boards, and deleted when you disconnect Pinterest. For an email and password sign-in, we store a salted hash of your password (scrypt), never the password itself. We never hold your scramble password in any form.
• How you found us: If you arrived from one of our ads or a tagged link, the campaign tags on that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id: which ad or campaign it was, not who you are) are kept with your account, so we know which of our ads work. If you accepted analytics cookies, we also keep the Google Analytics ID from your browser’s _ga cookie, so that your sign-up and your payments can be counted for that campaign (see Analytics). Neither is used for anything else.
• Settings: Your business or display name, your copyright notice, and the websites you approve.
• Your images: Stored scrambled, along with their file names and sizes. We also keep small thumbnails so you can find your images in your dashboard.
• Upload records: For each image you upload, a fingerprint of the file (a SHA-256 code worked out from it, which can’t be turned back into the picture), the time we received it, and an independent timestamp of that fingerprint. They’re evidence of when you had the file.
• Copies for social media: When you make one, we keep a record of its invisible watermark: which image, which platform and when. It holds nothing about anyone who sees your post.
• Content checks: When you upload an image, our own server scores it for possible sexually explicit material, nudity, graphic violence and war or conflict imagery, under our Acceptable Use Policy. We keep the scores with the image. Nothing is sent to anyone else for this, and your images aren’t used to train AI. If an image is flagged or reported, our authorized staff may look at its small preview to review it. We log each look and each decision.
• Safety checks: If you check your own website, the domains you’ve proved are yours with a DNS record, and each check’s report: the addresses of the pages and picture files it found there. To match pictures, our own server keeps a fingerprint of each of your images, made by the same model as the content checks (a list of numbers that can’t be turned back into the picture). Nothing is sent to anyone else for this.
• Approval requests: If you ask for approval to publish artistic nudity or conflict imagery, we keep what you tell us about yourself and your work, our decision, and our notes.
• Usage: How many views, downloads and uploads each image gets each day, so we can count your plan’s views and show you reports.
• Billing: Stripe runs checkout and collects your payment details, and Sold through Link, LLC (“Link”), a Stripe company, is the merchant of record. We never see or store card numbers. Stripe tells us your subscription status, plan, the amounts and tax charged, and the name, email address and billing country you paid with. Link keeps a record of your purchase so you can manage it at link.com. Stripe’s privacy policy and Link’s privacy policy cover what they do with your data.
• Messages: If you email us or use the Help button, we keep the conversation so we can help you.

When a browser asks for a protected image, or someone uses a download link a customer sent them, we record:

• the address of the page the image was shown on (or which download link was used);
• a shortened IP address (the last part is removed: /24 for IPv4, /48 for IPv6), which identifies a network rather than a single device, and the country that network is in, looked up in a geolocation database on our own servers (DB-IP): nothing is sent to anyone for that;
• the browser, operating system and type of device, from the user agent;
• whether the visitor got the real image or a scrambled copy, and why.

Large views of a real image, and every download, carry an invisible watermark. For each watermark we keep the details above, so a customer can trace a leaked copy back to a particular view.

While answering a request, our server also uses the full IP address and browser details to give known crawlers, AI bots and scripting tools the scrambled copy, to apply rate limits, and to count a reload as one view and cap how many views one visitor can run up in an hour, so the customer isn’t overbilled. Those hold the full address in memory for at most an hour, or a short code made from it, and never write it to our database, files or logs.

What we use it for. Only to protect the customer’s images, to stop bots and abuse, and to give the customer their traffic report (including its map of where views come from) and leak tracing. We don’t use visitor data for advertising or marketing, we don’t sell it or share it with anyone for theirs, and we don’t use it to build profiles or follow people across sites.

When you ask for a free “Where are my images?” report on your website, we collect:

• your website address and its domain, and the TXT record you add to show the domain is yours;
• your email address, to send you the link to carry on and the report;
• whether you ticked the box to hear from us now and then, and the wording you agreed to;
• your IP address, to stop abuse of the free report;
• the report itself: the public pictures on your site that we searched for, and the pages and sites where copies were found.

When you ask for a free report on pictures you upload (this needs an account), we collect the pictures, reduced to 1,000 pixels on the longest side, to search for them and to show them on the report; the originals aren’t kept and the pictures aren’t added to your account. We also note your website address if you give it, so your own pages aren’t listed as copies, and the report itself. The report is tied to your account and emailed to its address.

To find copies, we read your site’s public pages the way a visitor would. To say where each copy is hosted, we look up the address of the site it’s on in a geolocation database kept on our own servers (DB-IP): nothing is sent to anyone for that.

pixelsentinel.net uses cookies that are needed for signing in, and analytics cookies only if you agree to them:

Cookie	What it’s for	How long
pg_session	Keeps you signed in to your dashboard	7 days
ps_oauth	Protects a sign-in with Google, Microsoft, Facebook or Pinterest while it’s in progress	10 minutes
ps_pending	Remembers a social sign-in while you finish creating your account	30 minutes
_ga, _ga_EDY96CL8XT	Google Analytics: tells repeat visits apart, only if you click Accept	up to 2 years
Zoho Desk help widget	Keeps your help conversation open; set only after you click Help	session

The site also remembers your light or dark theme and your cookie choice, and, while the tab is open, the campaign tags of the link you arrived from. These stay in your browser and are never sent to us, except the campaign tags if you create an account (see How you found us). Protected images on customers’ sites don’t set cookies.

Analytics

Our public pages (not the dashboard) use Google Analytics to count which pages are visited, where visitors came from, and their approximate country, browser and device. We use it to improve the site and to see which of our ads bring customers. Advertising features are switched off: Google Analytics never gets your name, email address or account ID, and Google isn’t allowed to use the data for its own advertising.

A banner asks you first. Google Analytics only loads if you click Accept: then it sets the cookies above, and your browser sends Google the page details listed here, along with your IP address, which Google uses to estimate your country and doesn’t store. Clicks on “Protect my images” and on the live demo are counted too, and so is asking for a free report (that you asked, not your website or email address). If you then create an account or pay for a plan, our server tells Google Analytics that a sign-up or a purchase happened (the plan and the amount, under the same _ga ID from your browser), so the campaign that brought you gets the credit. If you click Decline or don’t choose, nothing is loaded from Google and nothing is sent to it, then or later. You can change your mind at any time with Cookie settings at the bottom of every page. Declining after accepting removes the cookies. Google processes this data in the United States under the EU-US Data Privacy Framework. We keep it for 14 months.

• To provide the service you signed up for (contract): your account, images, settings, sign-in and usage counts.
• To keep the service secure and protect customers’ images (legitimate interests): visitor records, watermarks, rate limits and bot detection.
• To enforce our Acceptable Use Policy and keep illegal content off the service (legitimate interests, and legal duties such as reporting child sexual abuse material): upload checks, reviews, approval requests and reports.
• Free reports (your request): your website, email address and report. Follow-up emails after a free report (consent): only if you tick the box, and you can unsubscribe at any time.
• Analytics cookies (consent): only after you click Accept, and you can withdraw it at any time.
• To meet legal duties: Billing records, tax, and responding to lawful requests.
• Email: We send account emails, such as sign-in links, verification and important notices. We’ll only send marketing email if you opt in, and every marketing email has an unsubscribe link.

We use a few service providers, each bound by a contract to protect the data and use it only for us:

• Amazon Web Services hosts the service and stores images, data and backups, in the United States (Ohio region).
• Zoho sends and receives our email and runs our help desk (Zoho Desk). Account emails, such as verification links and notices, go through it. What you write to support, by email or with the Help button, is kept there along with your email address. The Help button only loads Zoho’s widget when you click it. If you’re signed in with a verified email, it tells Zoho that address so you can see your own requests.
• Google Analytics measures visits to our public pages, as described under Analytics.
• Stripe (Stripe, Inc., and its affiliate Sold through Link, LLC) processes payments and is the merchant of record for plan purchases.
• Google (Cloud Vision) and TinEye search for copies of your images, only when you start a copy patrol and tick the box allowing it. For each image you choose, they receive a reduced, unprotected copy of the real image to search with. Nothing else about you or your account is sent. For a free report, they receive reduced copies of the public pictures on your site, and nothing else.
• Cloudflare (Turnstile) checks that a person, not a bot, is filling in our sign-up, sign-in, forgot-password and free report forms. It sees your IP address and some details of your browser, only on those forms.
• Google (through Firebase), Microsoft, Meta (Facebook Login) or Pinterest, whichever you choose to sign in with. Each one tells us your account ID with them and your email address (Pinterest: your username, no email), and nothing else. We receive data from Meta or Pinterest only if you choose to sign in with them. If you post a copy of an image to Pinterest from the dashboard, that copy, its title and description go to Pinterest.
• Sentry (Functional Software, Inc.) receives error reports from our server and from our pages in your browser, so we can fix what breaks. A report says what went wrong, on which page and in which browser. We strip email addresses, cookies, form contents and query strings out before it’s sent, and ask Sentry not to store IP addresses.
• DigiCert timestamps each image you upload, for its upload record. It receives only the file’s fingerprint, never the image itself or anything about you or your visitors.

We don’t sell or rent personal data. We’ll disclose data if the law requires it, for example in response to a valid court order. Where we’re allowed to, we’ll tell the affected customer first.

• Account data, settings and images: While your account is open. When you delete an image or close your account, we remove the data from our live systems straight away, and from backups within 30 days.
• Visitor traffic records: 180 days, then deleted automatically.
• Watermark records (which view or download a watermark belongs to): two years after that viewer last saw the image, then deleted automatically. Copies often turn up long after they were made, and this is what lets a customer trace one. They’re deleted sooner if the customer deletes the image or closes their account.
• Upload records, and watermark records of copies you made for social media: With the image, and deleted with it. The social media ones hold no visitor details, so they don’t expire after two years: a post can stay up for years.
• Content check scores, and safety check fingerprints: With the image, and deleted with it. Safety check reports: while your account is open. Approval requests: while your account is open. The review log (who looked at a flagged image or decided on it, and when): 2 years, then deleted automatically, even if the account is closed sooner, so we can show how we handled a case.
• Free reports: The report, your email address and your IP address for 90 days after the report finishes, then deleted automatically, or straight away if you click Delete this report. A request whose DNS record was never added is deleted after 7 days. If you ticked the box to hear from us, we keep your email address until you unsubscribe. We keep the domain and the date for good, because each site can only have one free report. For a report on pictures you uploaded, the reduced copies of the pictures are kept and deleted with the report, and the date is kept with your account, because each account can only have one; deleting your account deletes the report.
• Billing records, subscription history and payment dispute records: 7 years, for tax and accounting. They aren’t deleted with your account. Stripe and Link keep their own records too.
• Support requests: In our help desk (Zoho Desk), so we can see what we’ve already discussed with you. Zoho moves a request into an archive once it has been closed for 120 days, and keeps it there until we delete it. Ask us and we’ll delete yours sooner.

Wherever you live, you can ask us to:

• give you a copy of your personal data, including in a machine-readable form you can take elsewhere;
• correct it;
• delete it, or close your account;
• stop or limit how we use it, or object to a particular use;
• withdraw consent you gave, such as for analytics cookies, without affecting what happened before.

You can do the most common ones yourself. In your dashboard, under Your data, Download my data gives you everything about your account as a JSON file, and Delete my account erases your account, images and history straight away. You can correct your details in the dashboard, and change your cookie choice with Cookie settings at the bottom of any page.

For anything else, email support@pixelsentinel.net from the address on your account. We’ll reply within 30 days. If you’re a visitor to a customer’s site, contact that site first. We’ll help them respond. You also have the right to complain to your local data protection authority.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. The automated checks we run (such as bot detection deciding whether a browser gets a scrambled copy) only affect how an image is shown.

All traffic is encrypted with HTTPS. Images are stored scrambled with a key tied to your account, in private storage that only our server can reach. One-time links are stored as hashes. No system is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires.

Pixel Sentinel isn’t offered to people in the European Economic Area, the United Kingdom, Gibraltar or Switzerland. Sign-ups from those places are declined. Visitors to customers’ websites can be anywhere, and the visitor section above covers them wherever they are.

We’re based in, and store data in, the United States. If you’re outside the US, your data is transferred there. Where a customer is nonetheless subject to the GDPR or UK GDPR, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

We don’t sell personal data, and we don’t share it for cross-context behavioural advertising. We don’t show ads on our pages or use your data to target advertising. If you’re a California resident, the rights listed under Your rights include your rights to know, delete and correct, and we won’t treat you differently for using them.

Pixel Sentinel isn’t for children. You must be at least 16 to create an account, and we don’t knowingly collect children’s data.

If we make significant changes to this policy, we’ll email customers before they take effect and update the date at the top.

Pixel Sentinel LLC · 16970 Meadow Ln, Nampa, ID 83687, USA · support@pixelsentinel.net