Privacy

A plain-English summary of what PixelChat stores and why. It is not legal advice and it is not a contract.

What is stored

• Your email address and password hash, held by Supabase Auth.
• Your username and avatar image. Avatars are in a public bucket, so the image URL is guessable by design.
• Your messages, their timestamps, and who they were sent to.
• File attachments, in a private bucket reachable only through signed URLs.
• Friend requests and friendships.

Who can see it

Row-level security limits every read to rows you are a party to: you cannot query a conversation you are not a member of, and realtime channels are authorized the same way. Message contents are not end-to-end encrypted, so whoever operates the database can technically read them.

Third parties

Supabase hosts the database, auth and file storage. Sentry receives crash and error reports, which can include the page you were on and a stack trace. There is no advertising, no analytics profile and nothing is sold.

Deleting your data

Ask, and the account plus everything attached to it is removed. Copies already delivered to the people you chatted with stay with them.