Privacy Policy

1. Who We Are

PixelScale ("we", "our", "the Service") is an image upscaling web application operated by its owner and developer ("Operator"). The Service is accessible at pixelscale.my.id.

This Privacy Policy explains what personal data we collect, how we use it, how we protect it, and your rights regarding your data.

2. Data We Collect

We do not collect: IP addresses for tracking, browser fingerprints, geolocation data, behavioural analytics, advertising identifiers, or any data beyond what is listed above.

3. Your Images — Zero Storage Policy

This is the most important section regarding your content:

• Images you upload are never written to disk. They are processed entirely in PHP memory (RAM).
• The upscaled output is streamed directly to you as a download and immediately discarded from memory.
• No image, original or processed, is stored in our database, filesystem, or any third-party storage service.
• We have no access to your images after the processing request is complete.
• We cannot recover, reproduce, or provide any previously processed image — they simply do not exist on our systems after delivery.

4. How We Use Your Data

• Email: Password reset links, plan upgrade confirmations, support replies. We do not send unsolicited marketing emails.
• Username: Display in the app and admin panel only.
• Plan & credits: Enforcing usage limits and tracking your subscription status.
• Support messages: Resolving your support requests. Admin can view these to assist you.

We will never: sell your data, share it with advertisers, use it for profiling, or disclose it to third parties except as required by law or as listed in Section 5.

5. Third-Party Services

We use the following third-party services in the operation of PixelScale. Each has its own privacy policy:

• Gumroad — Payment processing and subscription management. Your payment details (card number, billing address) are handled entirely by Gumroad. We never see or store your payment information. Gumroad Privacy Policy
• SMTP / Email provider — We use an SMTP service to send transactional emails. Your email address is transmitted to send you account-related messages only.
• Web hosting provider — Our server provider may log access requests as part of standard server operations. We do not control this logging.

We do not integrate with Google Analytics, Facebook Pixel, or any advertising or tracking platform.

6. Data Security

We take reasonable technical measures to protect your data:

• Passwords are hashed using bcrypt — we cannot see or recover your password.
• Sessions use httponly, SameSite cookies with a 7-day expiry.
• Database queries use prepared statements to prevent SQL injection.
• The configuration file is blocked from web access via server rules.
• Password reset tokens are cryptographically random and expire after 1 hour.

Important limitation: No system connected to the internet can be guaranteed 100% secure. While we implement industry-standard protections, we cannot guarantee absolute security against all possible attacks, breaches, or malicious actors. In the event of a security incident that affects your personal data, we will notify you by email as soon as practicably possible.

The Operator shall not be held liable for any loss, damage, or harm resulting from unauthorised access to your data caused by third parties, hackers, or events outside our reasonable control. By using the Service, you accept this inherent risk.

7. Data Retention

• Account data (username, email, plan, credits): Retained for as long as your account is active.
• Support messages: Retained until resolved or for up to 12 months, whichever comes first.
• Password reset tokens: Automatically deleted after 1 hour or upon use.
• Session data: Automatically expires after 7 days of inactivity.
• Images: Never retained — discarded immediately after processing.

You may request deletion of your account and associated data at any time by contacting us. We will process deletion requests within a reasonable timeframe.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update your username or email from your Account page at any time.
• Deletion: Request deletion of your account and all associated data.
• Portability: Request your data in a portable format.
• Objection: Object to any processing of your data beyond what is strictly necessary to operate the Service.

To exercise any of these rights, contact us at contact@pixelscale.my.id. We will respond within 30 days.

9. Children's Privacy

PixelScale is not intended for use by anyone under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it immediately. If you believe we have inadvertently collected data from a child, please contact us.

10. Cookies

We use only a single session cookie to keep you logged in. This cookie:

• Is set only when you log in.
• Expires after 7 days of inactivity.
• Is marked httponly (cannot be accessed by JavaScript) and SameSite=Lax.
• Does not track you across other websites.
• Does not contain any personal information — only a randomly generated session ID.

We do not use advertising cookies, analytics cookies, or any third-party tracking cookies.

11. Limitation of Liability for Privacy Incidents

To the maximum extent permitted by applicable law, the Operator of PixelScale shall not be liable for any damages, losses, or penalties arising from:

• Unauthorised access to your data by third parties, hackers, or malicious actors despite reasonable security measures being in place.
• Data breaches caused by vulnerabilities in third-party services (hosting providers, payment processors, email providers).
• Your disclosure of your account credentials to others.
• Actions of employees or contractors acting outside the scope of their authority.
• Events outside our reasonable control including cyber attacks, natural disasters, or government actions.

By using the Service, you acknowledge that no digital system is completely immune to security risks and that you accept the residual risk inherent in using any internet-based service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions, requests, or concerns:

• Email: contact@pixelscale.my.id
• Contact form: https://pixelscale.my.id/contact.php