Privacy Policy

Last updated 7 August 2026

Written to match how the service actually works, not how it would be flattering to describe it. Creative Viral Inc. — incorporated in British Columbia, Canada, and based in Vancouver — operates Unpixel and is the controller of the data described here.

Your images

Converting an image requires our server to see it, so let us be exact rather than reassuring: when you trace something, the image is sent over an encrypted connection to our server, held in memory while it is converted, and never written to a disk, a database or file storage. We do not keep a library of your uploads, we cannot browse them, and we do not use them to train anything — there is nothing in this product that trains on anything.

One detail worth naming because it is the only thing that outlives the request: so that moving a slider re-renders instantly instead of redoing the whole conversion, a recent trace is kept in a small in-memory cache, addressed by a hash of the image bytes and settings. It is bounded and evicts oldest-first, and it disappears whenever the server instance recycles. It is memory, never storage, and nothing can look up an image in it without already having that exact image.

If your image is larger than the upload cap, your browser scales it down before anything is sent, and the app tells you when it does.

What we store

Only what a subscription needs. If you never subscribe, we hold no record of you at all.

• Your subscription: the email address you paid with, your Stripe customer and subscription identifiers, the plan status, the current period end and whether it is set to cancel. This is what the server checks, freshly, every time you download.
• Payment-event bookkeeping: the identifiers of payment notifications we have already processed, so a repeated notification cannot be double-counted.
• Download records: the time, whether it succeeded, the format, the size, and a truncated one-way hash of the email address — never the address itself. It answers “how many downloads did one subscriber make”, and it cannot answer “who”.
• Support messages: if you write to us, your message and your address sit in our email inbox like any other correspondence, and are used to answer you.

We never see or hold your card details. Payment is taken on Stripe’s own hosted checkout page; the card number never touches our servers.

Cookies

There is one cookie, and it is strictly necessary: after you subscribe (or unlock a browser with an access link) we set up_id, a signed cookie holding your email address and when it was issued. It says who you are, nothing more — whether you are entitled to download is decided against the subscription record on every single download, never by the cookie. It is HttpOnly, not readable by scripts, and lasts a year unless you clear it.

Our analytics set no cookie at all (see Analytics), there is no cross-site profiling, and outside a running advertising campaign there are no advertising cookies either — which is why this site shows you no cookie banner. The one exception is described under Advertising measurement: while we advertise on Google, its conversion tag sets two first-party cookies so that a purchase can be attributed to the ad that brought you here.

Separately, if you start a checkout, your browser stores your image and settings on your own device (in its local database) for up to 48 hours, so your work is still there when you come back from payment. That never leaves your device and clearing site data removes it.

Analytics

Every page loads PostHog, a product-analytics service, through our own domain and without cookies. The identifier it uses is a random value your browser keeps in the tab’s own storage: it is created when the tab opens, it disappears when the tab closes, it is never tied to your name or email, and no other site can read it. What we record is which steps of the converter a visit reaches — a page view, an upload, a trace finishing, the download screen, a checkout starting, a subscription starting, a download — together with the trace settings used, the browser, the country your address resolves to, and page-speed measurements. On some visits we also keep a replay of how the converter page was used, with every form field masked. Because ad blockers hide such scripts, our own server reports the same steps for the moments that matter most (a trace finishing, a subscription starting, a download) under the same anonymous identifier. None of this ever includes your image.

Advertising measurement

While an advertising campaign of ours is running, the converter also loads Google’s conversion tag. Google sets two first-party cookies (_gcl_au and _gcl_aw) that remember the ad click that brought you here for up to 90 days, and when you subscribe we send Google a one-way hash of the email address you paid with, so the purchase can be attributed to that click. The tag is not loaded when no campaign is running, it never receives your image, and what Google collects is governed by Google’s own privacy policy. If you arrived from a Google ad, your browser also keeps the click identifier from the link in the same tab storage until the tab closes, and if you subscribe we store that identifier with the subscription record, so a purchase can be attributed even when the tag was blocked.

Who processes data for us

We are a small operation and use a small number of established services. Each sees only what its job requires.

• Vercel — hosting and delivery. As with any web host, its servers see the requests your browser makes, including your IP address, and keep short-lived operational logs.
• Supabase — the database holding the subscription records described above.
• Stripe — payments, checkout and the billing portal. Stripe handles your card details directly under its own privacy policy.
• Resend — sending the emails we send: your welcome message, access links, and replies routed from the support form.
• PostHog — the analytics described above: the anonymous events, page-speed measurements and masked replays, plus your IP address for the country lookup. Requests reach it through our own domain.
• Google — only while an advertising campaign is running: the conversion tag described under Advertising measurement, and the hashed email on a purchase.

Your IP address is also used, in memory and in the moment, to rate-limit requests so a script cannot exhaust the free preview. Those counters are not written to a database and are forgotten continuously.

How long we keep things

• Images: for the length of the request, plus the short life of the in-memory cache described above.
• Subscription records: for as long as the subscription exists, and afterwards for as long as tax and accounting rules require us to keep records of a sale.
• Download records: retained in aggregate; they identify no one directly.
• Analytics events: up to a year; session replays: thirty days.
• Support email: kept while it is useful for supporting you, then deleted.

Your rights

Depending on where you live, you may have the right to ask what personal data we hold about you, to have it corrected, to have it deleted, or to receive a copy. Ask on the support page from the address you subscribed with and we will do it — in practice, for almost everyone, the entire answer is one subscription row and an email address.

We do not sell personal data, we do not share it for advertising, and the service is not directed at children under 13.

Changes to this policy

When the service changes, this page changes with it, and the date at the top says when. Material changes affecting subscribers are announced by email.

Contact

Privacy questions and requests go through the support page. Creative Viral Inc. operates Unpixel; see also the terms of service.