Privacy
Short version: we never keep your images, and we only email you about offers if you say yes.
Images and SVGs
When you convert an image on the website or through the API, the image is sent over HTTPS to our converter, processed in memory and discarded as soon as the SVG is returned. We don't write images or SVGs to disk or to any database, and we don't use them to train anything. After you download your SVG, you hold the only copy. Edits you make in the editor happen in your browser and are never uploaded.
Accounts
An account is optional. If you create one we store:
- your email address, and your name if you give it;
- a salted hash of your password (never the password itself), or your Google account ID if you sign in with Google;
- what you tell us you'll use Pix2Path for and how you heard about us, if you answer;
- the country you signed up from (from your IP address, which we don't store) and the website or campaign that brought you, if any;
- a hash of each API key you create, its name and when it was last used;
- daily and monthly conversion counts, when you were last active, and a log of account events (sign-ins, API keys created, email preferences changed);
- whether you're a founding member and whether you agreed to receive product emails, and when.
We use this to run your account, enforce limits, honour the founding-member discount and understand who uses Pix2Path. We send account emails (confirming your address, resetting your password, important changes to the service). We send news and offers only if you tick the box for it; you can turn that off on your account page at any time, and every such email has an unsubscribe link.
We use your activity to understand how Pix2Path is used and, if you opted in, to tailor offers to you (for example, a discount for members who use Pix2Path a lot).
You can delete your account at any time from the account page. Deletion removes all of the above immediately. We keep an anonymous record of the deletion (the reason you give, how long you were a member, how many conversions you made) for statistics. If you tick “you may email me” when deleting, we also keep your email address and name so we can tell you about improvements or offers; every such email lets you unsubscribe, which removes them.
Sign in with Google
If you use Google sign-in, Google tells us your name, email address and that the address is verified. We don't get access to anything else in your Google account.
Visitor statistics
To count visitors we record page views and, once per day, a one-way hash of your IP address and browser type. The hash lets us count each visitor once a day and is deleted after two days. We also count which country visits come from and which website linked to us. There are no cookies, advertising trackers or third-party analytics involved.
To protect the service from abuse we count requests and failed logins per network and per email address. These counters hold only one-way hashes, never the addresses themselves, and expire after at most two days. Each signed-in device has its own session record, which is removed when you log out.
Cookies
We set cookies only when you log in: a signed session cookie that keeps you logged in, and a flag that tells the page to show your account link. During Google sign-in a short-lived cookie protects the login from forgery. If you arrive from a campaign link, the page remembers where you came from in your browser so we can attribute a sign-up to it.
Infrastructure
Pix2Path runs on Cloudflare. Account data is stored in Cloudflare D1 and email is sent through Cloudflare Email Service. Like any website, Cloudflare processes request metadata such as IP addresses to deliver the service and protect it from abuse.