Privacy policy

PRIVACY POLICY

Discuții Pixelate

Document version: 1.2 — draft

Last updated: 12 November 2026

1. General information

Discuții Pixelate is an application intended for messaging and organizing personal contacts.

The application is developed as an independent project, presented under the name Discutii Pixelate.

Contact email: cevo.romania@gmail.com

Correspondence address: strada Teodor Mihali 31-35, Cluj-Napoca, Cluj, Romania.

Users may send requests concerning personal data to the email address above.

This policy covers the presentation site, browser/PWA access and Android app insofar as features are used. The administrator determines the purposes and means of processing for the service and acts as data controller. Using an ID and not requiring a personal phone number or email does not make use anonymous to the service infrastructure.

2. Data collected and processed

The following categories of data may be processed for the application to function:

• The username chosen when creating an account.

• The account's unique identifier.

• Information required for authentication and account recovery.

• Sent and received messages.

• Contacts and categories created by the user.

• Information about participation in discussion rooms.

• Application preferences and settings.

• Technical information necessary for operation and security of the service.

• Technical data necessary for notifications, when this feature is used.

At registration, the application does not require a telephone number or email address.

Additional features also involve the following information insofar as they are used:

• Sent photos, documents and audio files or recordings; these may contain the sender's or other people's image, voice and personal information.

• File name, type, size and identifier, integrity hash, sender, associated message/room, expiry and deletion state; save confirmations may include a user's ID, name and confirmation time.

• Coordinates voluntarily sent in a location message; technical accuracy may be used locally for preview. A shared point does not update automatically.

• Room access requests, administrator roles, abuse reports and requests sent to the administrator, with identifiers, reasons, explanations and, where applicable, a copy of the reported message.

• Reminders, recurrence and times, birthday names and days/months and locally stored preferences; the place selected for weather/air quality.

• IP addresses, connection/browser/device information, errors and logs needed for operation and security. Recovery rate limiting may use cryptographically derived IP and code identifiers.

• Notification tokens, installation identifier, language and account/message/conversation identifiers needed for delivery; the terms version accepted and acceptance time.

The app does not automatically import the phone address book. An email address used to contact the administrator is nevertheless processed to answer that request. Users must have the necessary rights and lawful basis before transmitting other people's information.

3. Authentication and account recovery

Users can create an account and set a personal code to recover access.

The database stores information derived from the recovery code, necessary to verify it, rather than a field intended to store the original code in plain text.

Users are responsible for keeping their personal recovery code in a safe place.

The complete code is transmitted over a secure connection to the registration/recovery service for verification; this does not mean it is stored as plain text in the database. Information needed to resume or complete registration and access, including recovery information, may be held on the device depending on the feature used. Protect the device and do not send the code in messages, reports or email.

4. Purposes and legal bases of processing

Data is processed for:

• Creating and administering accounts.

• Sending and receiving messages.

• Organizing contacts and conversations.

• Recovering account access.

• Providing notifications.

• Preventing unauthorized access and abusive use.

• Ensuring operation and security of the service.

Processing necessary to provide the service may be based on performance of the user agreement, while certain security measures may be based on the controller's legitimate interests.

Where processing requires consent, it will be requested separately.

GDPR Article 6(1)(b) applies to information objectively necessary for the account, requested messages/files/location and contact/room management. Legitimate interests in protecting users, infrastructure and rights support proportionate security and abuse-handling measures under Article 6(1)(f); applicable legal duties rely on point (c). Optional processing requiring consent relies on point (a), with information and agreement before activation.

For information about other people included in user content, a contract with those people is not presumed. The basis is assessed separately, including the legitimate interest in providing the requested communication, insofar as necessary and following an assessment of the data subjects' rights. Special-category information additionally requires a condition under GDPR Article 9; merely accepting the terms does not replace it. Avoid transmitting excessive information or information without appropriate rights.

Camera, microphone, location and notification permissions are managed by the browser/system and can be withdrawn in its settings. A technical permission alone does not authorise other purposes. Refusal affects the dependent feature, not features that do not require it. Withdrawal does not recall messages, files or coordinates already transmitted.

Accepting the terms is not general consent to advertising, profiling or processing any special-category information that a user might include in a document or message.

5. Data storage and security

Discuții Pixelate uses Supabase infrastructure for authentication, information storage and operation of certain services.

Authentication mechanisms and database-level access rules are used to protect data.

Access to messages, contacts, categories and profiles is restricted by security rules.

These measures aim to protect data but cannot guarantee elimination of all information security risks.

Cloudflare Pages hosts the presentation site and PWA; user files are held in Supabase Storage separately from interface assets. Infrastructure connections may generate technical delivery/security logs.

HTTPS connections and authorisation protect privately stored files accessed through temporary links. Links must not be redistributed without appropriate rights and may remain usable until expiry or invalidation under applicable technical mechanisms.

The app does not currently provide end-to-end encryption. Content is processed on the server to operate the service; technical access by the administrator and providers must be limited to justified operational, security, support or legal needs, with confidentiality and access controls. Technical impossibility of every administrative access is not promised.

The Supabase project is configured in West EU (Ireland), in Ireland, for the primary database, authentication and Storage files. A European region does not guarantee that every auxiliary operation, support activity, distribution service or subprocessor is exclusively in the EEA. Relationships with Supabase and Cloudflare are subject to the applicable contractual terms, including data processing addenda (DPAs); transfers outside the EEA require GDPR-compliant mechanisms such as adequacy decisions or standard contractual clauses, as appropriate. Current recipients and safeguards are described in provider documents, including https://supabase.com/legal/customer-resources/data-processing-addendum and https://www.cloudflare.com/cloudflare-customer-dpa/.

Incidents are assessed and, where legal conditions are met, notified to the authority and affected individuals within applicable time limits.

6. Message confidentiality

Private messages are intended for the participants in the conversation.

Users can delete their own messages according to the application's features.

Deleting an original message does not automatically remove replies sent by others. The link to the deleted message may be removed, while replies may remain available.

Conversation content is not intended to be published as advertising material.

Room content is available to members entitled to access it. Reports separately provide the administrator with information submitted for review. Justified technical access is explained in section 5.

Deleting a contact or choosing “Clear conversation for me” does not delete every server file. Hiding a received file affects only that user's view. Deleting an own file withdraws access to that copy and requests storage removal; deleting a message/room/account may trigger cleanup of linked files.

Forwarded or separately sent copies are independent, with their own sender and retention period. They do not disappear merely because the original was deleted. Screenshots and downloaded copies are outside the service's direct control.

Save confirmations are communicated to the sender; rooms may show the names and number of users who confirmed. Confirmation may be technical or user-declared, does not guarantee permanent device retention and does not alone trigger deletion.

Location is shared at the user's request as a fixed point, not continuous tracking. Coordinates are part of the message and follow message retention rules, not the 90-day file expiry.

When a message is reported, its text may be retained separately in the report even if the original message or account is deleted. Access to the report is restricted and it follows the retention criteria in section 10; deleting the original does not automatically delete the report.

7. Deletion of accounts and data

Users can request or initiate account deletion through the features available in the application.

The system includes mechanisms to remove data associated with an account from the main database, including messages, contacts, categories and recovery information.

Some records may require limited retention for legal duties, reports or disputes, with restricted access and a concrete basis.

When an account is deleted, associated information is removed from the active database under account mechanisms. Files sent by it and objects left without a message/room are queued for cleanup; physical deletion may require technical tasks to run or retry. Instant physical deletion during every incident is not promised. The administrator does not currently make their own backups containing real users’ data; copies of project code are not database backups. Provider logs and any internal technical records/copies are distinct and subject to their applicable rules and retention.

Account deletion may affect rooms administered by it; transferring administration is a separate step before leaving if the room is to remain. Other senders’ independent copies and content reproduced in other people’s messages are not automatically removed by deleting the original account; requests about such information are assessed separately. Server removal does not automatically clear local information or downloaded copies.

8. Services and content provided by third parties

The application may integrate informational services such as:

• Weather information.

• Air quality information.

• Religious calendar.

• Exchange rates and conversion tools.

• Online radio stations.

• Links to external resources.

Providers of these services may process certain technical data, such as the IP address, when users access or load those resources.

These services may have their own privacy policies.

Google/Firebase Cloud Messaging may be used for enabled Android notifications. Technical tokens and identifiers and notice information such as a contact/room name are transmitted. The current push mechanism does not include the message text itself or the attached file. Displayed notifications may be seen by others near the device.

Google Maps receives coordinates in the link and connection information when a user opens the map. Weather uses MET Norway services and air quality uses WeatherAPI, through the app's server functions, with the selected place's coordinates; these are not automatically the user's GPS position.

External resources, including radio and third-party images or offers, may disclose IP and technical information when loaded, even before a link is clicked. Their providers' policies also apply. Data may be communicated to authorities or authorised advisers only where legally justified and necessary.

The browser/device may locally store sessions, preferences, recovery information, reminders, birthdays and public resources needed by the PWA. Caching the interface does not guarantee offline conversation or file access. Reminders and birthdays are currently managed locally, including operating-system local alerts, and are not automatically synchronised across devices.

Storage strictly necessary for the requested service is distinct from optional analytics/advertising technologies. At this revision, behavioural tracking such as Google Analytics is not integrated in the app/presentation code. Google Search Console indexing does not automatically install such a tool. Future non-essential integrations require the information and agreement mandated by law.

The religious calendar uses the Doxologia widget, loaded directly from the external service when the tool is displayed, including for the daily summary. The provider may receive the IP address and technical connection information even if the calendar's detailed list has not been expanded. Exchange rates are retrieved by the app server from the National Bank of Romania; this retrieval does not send conversation content or recovery codes to the bank.

9. Advertising and affiliate links

Discuții Pixelate may display advertising banners, commercial offers and affiliate links.

The application administrator may receive advertising revenue or commissions for purchases and other eligible actions carried out through affiliate links.

Commercial content will be distinguished from the application's informational tools.

Accessing a commercial link may redirect users to an external website administered by another entity.

At this revision there is no advertising or affiliate revenue; the technical possibility is prepared for the future. The current configuration does not use messages, files or shared locations to personalise advertising and does not sell data for advertising. Introducing advertising tracking, non-essential cookies or profiling requires legal assessment, updated information and prior agreement where mandatory.

10. Data retention

Data necessary for an account to function is retained for as long as the account exists, except for information deleted earlier or data subject to a legal retention obligation.

Copies of project code do not include users’ database information; the administrator does not currently make their own backups of real users’ data. The Supabase plan currently used does not include scheduled database backups.

Supabase processes technical logs for operation and security of the infrastructure according to its applicable terms. Under the current plan, the administrator ordinarily has dashboard access to logs for the last day. This access period does not confirm the deletion period for all of the provider's internal records.

Access to each published file copy expires after 90 days; earlier deletion or deletion of the message/room/account may trigger earlier cleanup. Physical removal uses server tasks with retries on failure. Technical records of identifiers, size and deletion state may remain for operation and cleanup tracking, without deleted binary content, and are handled under account/message mechanisms and legal requests. File expiry does not automatically delete message text or every metadata field.

Location coordinates in messages follow message retention rules, not file expiry. Local reminders, birthdays and preferences remain until deleted through available features or device/browser settings. Signing out does not guarantee erasure of every local item or downloaded copy.

Recovery rate-limit records use 15-minute checking windows, with deletion of records older than one day when the mechanism runs. The notification job queue removes records older than two days when delivery processing executes. Tokens may remain until revocation, account deletion or justified cleanup. Tasks cannot be guaranteed while infrastructure is stopped.

Reports, requests and acceptance records are retained as necessary to administer the account, resolve requests and defend rights. Retention after account deletion requires a concrete basis and justified duration; a possible future need does not justify indefinite retention. Infrastructure-plan, logging-policy or backup-practice changes require review of this notice.

Abuse reports are reviewed by the administrator and manually deleted after resolution if no longer necessary. Further retention is limited to justified situations, such as resolving a dispute or fulfilling a legal obligation, with restricted access and review of the need for retention. Merely marking a report as resolved does not automatically delete it.

11. Users' rights

Under the General Data Protection Regulation (GDPR), users have the following rights, as applicable:

• The right of access to data.

• The right to rectification.

• The right to erasure.

• The right to restriction of processing.

• The right to data portability.

• The right to object to certain processing.

• The right to withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

• The right to lodge a complaint with the competent supervisory authority.

To exercise their rights, users may send a request to cevo.romania@gmail.com.

To protect the account, do not send the secret recovery code by email.

Requests are examined and resolved under the conditions and within the time limits laid down by applicable legislation. The exercise of certain rights may be subject to conditions and exceptions provided for by law.

In Romania, users may contact the National Supervisory Authority for Personal Data Processing — ANSPDCP. Information on lodging a complaint is available on the authority's website.

A rights-request response is ordinarily provided within one month. For complex or numerous requests, this may be extended by a further two months, with notice and reasons within the first month, under the GDPR. Identity checks must be proportionate and do not require sending the secret code. Core account information is required to operate the account; files, location and optional features are not required for text conversations. The current configuration does not use solely automated profiling decisions with legal or similarly significant effects; automatic security limits can be challenged using the contact address. Complaints may be lodged through https://www.dataprotection.ro/ or with the competent authority in the state of residence/work or the alleged infringement, under the GDPR.

Requests concerning one's own data may be sent to the contact email and are distinct from reporting another user for abuse. Before disclosing data, the administrator proportionately verifies the requester's identity and connection to the account without requesting the secret CSR. Where a request is granted, data is provided through an appropriate secure method, including to the designated email address after verification, in a commonly used electronic format and, where portability applies, in a structured, commonly used and machine-readable format. Other people's rights and information are protected; merely requesting delivery to an address does not prove control of the account.

12. Updates to the Privacy Policy

This policy may be updated to reflect changes to the application's features, services used or legal requirements.

The version available to users will indicate the date of its latest update. Changes requiring users to be informed or separate consent to be obtained will be handled in accordance with applicable legislation.

13. Protection of minors' data

13.1. Service age limit. The app is not intended for people under 16, under its terms. This is a service-access rule, not a statement that processing an under-16's information is unlawful in every context. Registration uses the user's declaration, without automatic documentary age verification.

13.2. Administrative measures. If an under-16 has created an account, their parent/guardian or a person aware of the situation can contact cevo.romania@gmail.com. The administrator makes proportionate checks, may restrict access and deletes information without a retention basis, subject to legal duties and sections 7 and 10. Do not send identity documents or the secret code through unprotected channels.