Privacy policy
Last updated: October 13, 2026
1. At a glance
- These websites set no cookies, use no tracking, no analytics, no ad trackers and load no external fonts or scripts.
- Personal data is only processed if you sign up for the beta or write to me – and only for that purpose.
- The Pixwish app works on your device. Photos and videos are not uploaded.
- The app is free and shows ads (Google AdMob), where required only after your consent. Ads never receive your photos or videos – details in section 9.
2. Controller
The controller for data processing on pixwish.app and beta.pixwish.app and for the beta is:
Alexander Boß
Freelance Softwareentwickler
Pollerstrass 49
26639 Wiesmoor
Deutschland
E-mail: info@b0ss.dev
3. Hosting and server log files
The websites are hosted by Hetzner. When you visit, the web server processes technically necessary data (server log files): IP address, date and time, requested page, amount of data, status code, browser and operating system (user agent) and, if sent, the previously visited page.
The purpose is secure and stable operation (delivery, error analysis, defence against attacks). Legal basis: Art. 6(1)(f) GDPR. Log files are deleted by the host after a short time (usually a few weeks). A data processing agreement under Art. 28 GDPR is in place.
5. Beta sign-up (beta.pixwish.app)
Data: your e-mail address (iPhone: your Apple ID address, Android: your Google account address), the chosen platform, the page language and the time and version of your consent and confirmation.
Purpose: running the beta – confirming your address, inviting you via TestFlight or Google Play, questions about your feedback.
Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time for the future – via the link in every e-mail (data is deleted immediately) or by writing to me.
Double opt-in: after signing up you receive an e-mail with a confirmation link. Unconfirmed sign-ups are deleted after 14 days.
Retention: until you leave or the beta ends; at the latest three months after the beta ends, all sign-up data is deleted.
6. Abuse protection
To prevent automated mass sign-ups, the number of attempts is limited. For this a hash of your IP address salted with a secret value (no plain IP) is stored for at most 24 hours. Legal basis: Art. 6(1)(f) GDPR.
7. E-mail contact
Confirmation and welcome e-mails are sent via the host’s mail server. If you e-mail me, your message and the data in it are stored to handle your request and not passed on without your consent. Legal basis: Art. 6(1)(b) or (f) GDPR.
8. Invitation via Apple TestFlight and Google Play
So that you can install the beta, I enter your Apple ID e-mail in App Store Connect (TestFlight) or your Google account e-mail in the Google Play Console (closed test). Apple and Google process data as independent controllers under their own privacy policies, possibly outside the EU – such as installation, device and crash data, which you can control in your device or store settings. Legal basis for the disclosure is your consent (Art. 6(1)(a) GDPR). If you send feedback via TestFlight or Google Play, I see your message and possibly device model and system version.
9. The Pixwish app
Pixwish needs no account and transmits no photos, videos or metadata to me or third parties. With your permission the app reads your device’s media library to show and sort media. Decisions, progress and small previews are stored locally on your device only. Nothing is deleted until you confirm the deletion list and the operating system agrees.
Ads (Google AdMob). Pixwish is free and funded by ads from Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). There is a banner on the Home, Calendar and Progress screens and, now and then, a full screen ad (also video) between two swipes. No ads are shown in the deletion list. The app contains no other analytics or tracking components.
Consent. Where required by law (e.g. in the European Economic Area, the United Kingdom and Switzerland), ads only start after you agreed in Google’s consent dialog (consent management). The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). On iPhone, Apple additionally asks whether the app may track you across apps (App Tracking Transparency); without that permission you get ads without the advertising ID. You can change or withdraw your choice at any time with effect for the future in the app under Settings → “Ad choices”. Without consent no ads are loaded.
Which data. To deliver, limit and bill ads, Google may in particular process your IP address, your device’s advertising ID, device and system information, an approximate location and information about how ads are used (impressions, clicks), and may transfer data to countries outside the EU (in particular the USA). Photos, videos, file names, metadata or identifiers of your media library are never passed to the ads component. I receive no personal data from the ads, only aggregated reports (e.g. revenue, number of impressions). Google processes the data as an independent controller; information: policies.google.com/technologies/ads.
Remove ads (in-app purchase). A one-time purchase in the app turns ads off for good. The purchase is handled entirely by Apple (App Store) or Google (Google Play); I receive no payment details, only aggregated reports (e.g. number of purchases, revenue). At start the app asks the respective store whether the purchase exists for your account and remembers the result locally on your device so that it also knows without internet that ads stay off. Anyone who owns the purchase gets no ads and no ad consent dialog; the ads component is not started then. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
10. Your rights
You have the right to free access to your stored data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)); earlier processing remains lawful. Just write to info@b0ss.dev.
You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work.
11. Security
The websites are encrypted via HTTPS. Confirmation and unsubscribe links contain random tokens of which only a hash is stored. Only the controller has access to sign-up data.
12. Changes
This policy is updated when the websites, the app or the law change. The version published here applies. The German version is authoritative.