Privacy Policy

App: PixOrg | Package: com.pixorg.pixorg | Last updated: 23 Sep 2026

PixOrg ("we", "our", or "the app") is a private photo gallery for Android that sorts your Camera folder into real folders, finds any photo by the text or the scene in it, and turns your best days into short movies. All recognition and search happens on your phone. This Privacy Policy explains what data the app accesses, how it is used, and your rights as a user.

The short version: your photos, the text recognised in them, the faces and names you give them, and the AI "fingerprints" used for search never leave your device. We run no servers and have no user accounts. The app is free with occasional ads served by Google AdMob, which receives your advertising ID and device details, never your photos or anything derived from them. PixOrg Pro removes every ad.

1. Data We Access on Your Device

Photos and videos: With your permission (Photos and videos access), the app reads the images stored on your phone to display them as a gallery. You can grant access to all photos or only to selected ones; the app works with whatever you choose.
Text recognised in photos (OCR): The app runs on-device text recognition (Google ML Kit, offline model) so you can search for words that appear in receipts, whiteboards, screenshots and documents. The recognised text is stored in the app's private storage on your phone and nowhere else.
AI image fingerprints (embeddings): A small vision model (MobileCLIP, run with ONNX Runtime) turns each photo into a list of numbers that describes what the picture looks like. These numbers power "looks like" search, Moments, Look Up and Declutter. They are computed and stored on your device only and cannot be turned back into the original photo.
Faces and names (People): Faces are detected and grouped on your phone with offline models. Names you give a group are stored in the app's local database. No face data or name ever leaves your device, and nothing is matched against any outside database.
Photo location (EXIF GPS): If a photo already contains location data recorded by your camera, the app reads it to place the photo on the Map view and to name Moments. The app never uses your phone's GPS and never records where you are.
Ratings, tags, albums and folders: Star ratings, tags and smart-album rules you create are stored in the app's local database. Ratings and tags are also written into the photo file itself (or a sidecar file next to it) so other photo apps can read them. Moving photos into folders changes files you own. Each write to a file is confirmed through the Android system dialog.
Movies: Memory movies are rendered on your phone and saved to your gallery. Music you pick for a movie is copied into the app's cache so the choice survives.
Receipts export: When you export receipts as a CSV file, the file is handed to the Android share sheet. Where it goes from there is entirely your choice.
Vault: Photos you move into the Vault are encrypted with AES-256-GCM using a key stored in your phone's secure keystore, and are unlocked with your device biometrics or screen-lock credential. The app never sees or stores your fingerprint or face data; Android handles that check and only tells the app whether it succeeded.
Usage record for ads: To keep ads rare, the app keeps a small local record of the days you used it and how many ads it showed today. It contains no photo information and stays on your phone.

2. Data That Leaves Your Device

No photo, recognised text, AI fingerprint, face, name, tag, rating or location is ever transmitted to us or to anyone else. The app connects to the internet for three purposes:

Purpose	Who receives what
Map tiles (only when you open the Map view)	Map images are downloaded from OpenStreetMap tile servers. As with any web request, the tile server sees your IP address and which map areas you view. It does not receive your photos or their coordinates individually. Subject to the OpenStreetMap Foundation Privacy Policy.
Ads (free version only, see Section 3)	When an ad is requested, Google AdMob receives your Android advertising ID, device and app details, your IP address (from which a coarse location may be inferred) and your consent choices. It never receives your photos or anything read from them.
Purchases (only if you buy PixOrg Pro)	Payment and subscription status are handled entirely by Google Play Billing on your Google account. No other company is involved. See Section 4.

Everything else, including the AI models, is shipped inside the app and runs fully offline. You can use every feature except the Map view and purchases with the internet switched off; without a connection no ads are shown.

3. Advertising

PixOrg is free, funded by occasional ads served through Google AdMob. Ads are deliberately rare: none appear while you get to know the app, and afterwards at most a few a day, only between tasks (for example after a movie is made or a folder is moved), never over your photos. Making a movie beyond your first ten asks you to watch one short rewarded ad. PixOrg Pro removes every ad.

To show an ad, the Google Mobile Ads SDK inside the app sends Google the data listed in Section 2. Google may use it to select ads and to measure them, as described in Google's Privacy Policy and How Google uses information from sites or apps that use its services.

Consent (EEA, UK and Switzerland): before the first ad, a consent form provided by Google asks whether you allow personalised ads. You can choose "Do not consent", in which case you still get ads but they are not personalised. Change your choice any time in the app under Settings → Ads → Ad settings.
Everywhere: you can reset or delete your advertising ID in Android Settings → Google → Ads (or Settings → Privacy → Ads), and opt out of ad personalisation there.
No other trackers: the app contains no analytics, attribution or crash-reporting SDKs. We do not receive usage statistics or device identifiers ourselves. If you choose to share a crash report through Google Play, that report is governed by Google's Privacy Policy.

4. Subscriptions and Payments

PixOrg Pro is an optional in-app purchase (monthly or yearly subscription, or a one-time lifetime purchase) that removes ads. Payment is processed entirely by Google Play on your Google account; we never see your card or payment details. The app checks with Google Play whether your account holds an active purchase; nothing about your purchase is sent anywhere else. Google Play's handling of purchase data is described in Google's Privacy Policy. Subscriptions renew automatically and can be cancelled any time in the Google Play app.

5. Data We Do Not Collect

We do not collect, upload or back up your photos or videos.
We do not collect the text recognised in your photos, the faces or names in them, or the AI fingerprints derived from them.
We do not collect your location, contacts, camera feed, or biometric data.
We do not require or create a user account, and we do not collect your name or email.
We do not sell, rent or share your photos or any data derived from them with anyone, including advertisers. The only advertising data is the advertising ID and device details the Google Mobile Ads SDK sends to Google (Section 3).
We do not use your photos or any derived data to train AI models. The models in the app are fixed and never learn from your library.

6. Data Retention and Deletion

Everything the app creates (the search index, recognised text, AI fingerprints, faces and names, ratings, tags, smart albums, receipts data, the ad usage record and the Vault) lives in the app's private storage on your phone and remains entirely under your control. To delete it:

Search index: Settings → AI index → Rescan or Re-index rebuilds it from scratch.
Vault: the encrypted files live in a folder you chose and survive uninstalling; restore photos to your gallery from the Vault screen, or open them later with your passphrase.
Everything: Android Settings → Apps → PixOrg → Clear data, or uninstall the app. This removes the index, the app's copy of the Vault key and the ad usage record.
Advertising ID: reset or delete it in Android Settings → Google → Ads; Google's retention of ad data is described in Google's Privacy Policy.

Ratings and tags written into photo files stay in those files, because they belong to you. Because we hold no data about you on any server, there is nothing for us to delete on our side.

7. Permissions Explained

Permission	Why the app asks for it
Photos and videos	To show your gallery and build the on-device search index. This is the core function of the app.
Audio files	Only when you pick your own music for a movie.
Media location	To read the GPS tags already stored in your photos for the Map view and Moments.
Biometrics	To unlock the Vault with your fingerprint, face or screen lock.
Notifications / run at boot	To continue indexing new photos in the background and to show indexing progress.
Internet	Map tiles, ads and purchases only (see Section 2).
Google Play Billing	To offer the optional Pro upgrade.
Advertising ID	Used by the Google Mobile Ads SDK to serve and measure ads in the free version.

The app does not request "All files access", fine location, camera, contacts, microphone or phone permissions.

8. Children's Privacy

PixOrg is not directed at children under the age of 13 and is listed for adults. We collect no personal information from anyone. Ads are configured for a general audience; if you believe a child has contacted us with personal information, please let us know so we can delete it.

9. Security

The app's database and index are stored in Android's app-private storage, which other apps cannot read. Vault photos are encrypted with AES-256-GCM under a key held in the Android keystore and protected by your device credential. The only data in transit is ad and billing traffic to Google and map-tile requests, all over HTTPS. We still recommend keeping your phone's screen lock enabled.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and describe any new data flow clearly. This version adds Google AdMob advertising (Section 3) and replaces the earlier third-party subscription service with Google Play Billing alone (Section 4). Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:
pixorg.support@gmail.com