Welcome to Picmaze. We respect your privacy and are committed to protecting your personal data across our website (picmaze.com), Web Checkout Services, and Mobile Applications (Android & iOS) globally. This policy explains how we collect, process, transfer, and safeguard your information under international data protection laws including EU GDPR, US CCPA/CPRA, COPPA, Apple App Store Guidelines, Google Play Policies, and the Digital Personal Data Protection (DPDP) Act 2023 (India).
🌐 International Data Transfer Notice: Picmaze's primary backend server and database infrastructure is hosted securely in the United States. By accessing our services from the European Union (Germany, France, Netherlands, Italy), United Kingdom, Canada, Brazil, India, or other international regions, your information is securely processed and stored in the United States under Cloudflare SSL/TLS encryption and Standard Contractual Clauses (SCCs).
01. Information Collection & Legal Grounds
We process your personal data under the lawful grounds of consent (GDPR Art. 6(1)(a)), contractual necessity (GDPR Art. 6(1)(b)), and legitimate interests (GDPR Art. 6(1)(f)):
Age Verification Data:
To comply with global children's privacy protection regulations (COPPA, EU GDPR Art. 8, and DPDP Act 2023), we collect your Age or Date of Birth during registration to confirm that you are legally eligible (18 years or older) to access our platform.
Account & Profile Data:
When you log in via Google Sign-In, Apple Sign-In, or Email, we process:
- Google & Apple Sign-In: Your Email Address, Display Name, Profile Picture (Avatar) URL, and a unique third-party account identifier.
- Email & Password: Your email address and securely hashed/salted password credentials.
- Profile Synchronization: Your virtual Picoin balance, transaction history, unlocked 4K wallpapers library, download records, and favorite items seamlessly across all your web, Android, and iOS devices.
In-App & Web Payment Data (Lemon Squeezy, Google Play & Apple App Store):
When you purchase Picoins or Premium Passes on our website or mobile apps, payments are securely processed by certified payment platforms:
- Web Checkout Purchases: Handled by Lemon Squeezy (acting as Merchant of Record). Lemon Squeezy processes credit/debit cards, Apple Pay, Google Pay, and regional payment methods under PCI-DSS Level 1 compliance.
- Android App Purchases: Handled securely via the official Google Play Billing System.
- iOS App Purchases & Lifetime Passes: Handled securely via official Apple In-App Purchases (StoreKit). You can restore previous non-consumable purchases anytime using the in-app "Restore Purchases" feature.
- Zero Card Storage Guarantee: Picmaze strictly does NOT collect, view, or store raw credit/debit card numbers, CVVs, or bank credentials on our servers.
Analytics, Telemetry & Session Diagnostics (PostHog & Firebase):
To understand user drop-offs, fix application crashes, improve wallpaper loading speeds, and optimize app navigation, we process aggregated telemetry and diagnostic session interactions via PostHog and Firebase Analytics (such as screen transitions, button clicks, search queries, and wallpaper downloads). Privacy Masking Guarantee: All text inputs, passwords, credit card fields, and personal identifiers are automatically masked/redacted before diagnostic recording. We strictly do not record personal passwords or payment data.
Mobile Device & Anti-Fraud Identifiers:
To deliver system notifications, execute background Auto-Wallpaper rotation, and prevent promotional fraud, we process technical specifications (device model, OS version, app build), Firebase Cloud Messaging (FCM) push tokens, and a unique Device Identifier (Device ID) strictly under Legitimate Interest (GDPR Art. 6(1)(f)) to prevent duplicate welcome bonus abuse and multi-account spam on a single physical device.
Location & Ad Data (Google AdMob):
To display banner, interstitial, rewarded, and native ads, our advertising partner (Google AdMob) processes Advertising Identifiers (GAID / IDFA), coarse location, and IP address. Where required by law (e.g. EU GDPR / CCPA / ATT), a Privacy Consent CMP banner allows you to manage or opt-out of personalized ad choices.
02. Third-Party Services & Infrastructure
To support web and mobile app functionality, edge security, multi-currency billing, and analytics, we use certified global service providers:
- Lemon Squeezy (Merchant of Record): Manages web payment processing, invoicing, regional multi-currency conversion, and global tax compliance (including Indian GST, EU VAT, and US Sales Tax). Learn more about Lemon Squeezy Privacy.
- Apple App Store (StoreKit): Manages secure iOS in-app purchases, subscriptions, and purchase restoration under Apple App Store Review Guidelines.
- Google Play Store Billing: Handles secure Android in-app coin purchases and subscriptions under standard safety guidelines.
- United States Infrastructure: Secure cloud servers located in the US for API processing and database storage.
- Cloudflare CDN: Used for edge caching, SSL/TLS media encryption, custom reverse proxy telemetry, and DDoS attack prevention.
- PostHog Analytics & Session Diagnostics: Used for product analytics, screen navigation tracking, and diagnostic session replays to identify UI friction and fix bugs. All sensitive inputs are masked by default. Learn more about PostHog privacy.
- Google AdMob & Analytics: Displays ads and analyzes aggregated app performance. Learn how Google uses ad data.
- Firebase & Crashlytics: Used for authentication, push notifications, and app crash diagnostics.
03. App & Web Platform Permissions
User Control: You can manage or revoke storage, location, notification, and tracking permissions via your mobile device system settings or browser preferences at any time.
| Feature / Permission | Purpose | Requirement |
|---|
| Internet / Network State | Fetch wallpapers, sync profile data, process coin transactions, and diagnostic analytics | Mandatory |
| Set Wallpaper / Auto-Changer | Apply background wallpaper automatically on mobile devices | Mandatory (Mobile) |
| Billing / Secure Checkout | Process web & in-app purchases securely via Lemon Squeezy, Google Play, or Apple StoreKit | Optional (For purchases) |
| Location Data | Display localized currencies/taxes, serve relevant ad content, and prevent fraud | Optional (User Choice) |
| Storage / Photo Library | Save downloaded 4K wallpapers to your device photo gallery | Optional |
04. In-App & Web Purchases, Picoins & Virtual Goods
Picmaze provides virtual tokens (Picoins) and Premium Passes to unlock high-resolution premium 4K wallpapers and exclusive creator artwork across web and mobile platforms:
- Virtual Digital Tokens: Picoins are digital, non-transferable virtual items. They possess no real-world cash equivalent, cannot be redeemed for fiat currency, and are exclusively meant for use inside the Picmaze ecosystem.
- Multi-Currency & Dynamic Pricing: Coin bundles and passes are dynamically priced and presented in your local currency (e.g. INR ₹, USD $, EUR €, GBP £) based on real-time rates from our payment infrastructure.
- Taxes & Statutory Compliance: Where applicable by regional law, statutory taxes (such as 18% GST in India, VAT in the European Union, or applicable US state sales taxes) are calculated and managed compliantly by our Merchant of Record (Lemon Squeezy), Google Play, or Apple.
- Instant Digital Delivery & Purchase Restore: Once purchased, Picoins and passes are credited to your balance instantly. Unlocking a wallpaper grants perpetual high-definition download access in your user profile library. iOS and Android users can restore past non-consumable purchases anytime via the in-app "Restore Purchases" button. Digital purchases and consumed coin unlocks are final and non-refundable, except where mandated by applicable law.
05. International Privacy Rights (GDPR, CCPA & DPDP)
Depending on your region (United States, European Union / Germany, India, Canada, etc.), you have statutory rights regarding your personal data:
- EU GDPR Rights (Germany, Netherlands, France, Italy): You have the right to access (Art. 15), rectify (Art. 16), erase / be forgotten (Art. 17), restrict/object (Art. 18 & 21), and port your data (Art. 20). You also have the right to lodge a complaint with a European Supervisory Authority (e.g., German BfDI).
- California CCPA / CPRA Rights (US Users): We do NOT sell your personal information to data brokers. You have the right to request disclosure of collected data and request deletion without discrimination.
- India DPDP Act 2023: You have the right to request data summaries, seek correction/erasure of personal and billing records, and register grievance redresses.
- Consent Management: You can manage personalized ad consent and App Tracking Transparency (ATT on iOS) choices anytime via device settings or CMP banners.
06. Age Restrictions & Children's Privacy
Picmaze is strictly intended for users who are 18 years of age or older (or age of legal consent in your jurisdiction). We verify your age during account setup. We do not knowingly collect or maintain personal data from minors under 18. If we discover an account belongs to a minor, we will immediately delete all associated account records and data. If you believe a minor has accessed our service, contact us at support@picmaze.com.
07. Data & Account Deletion Request Process
In compliance with Google Play Store and Apple App Store mandates and global privacy laws, you can permanently delete your account and personal data at any time:
- In-App / Web Deletion: Open the Picmaze App or Web Dashboard > Go to
Settings > Account > Delete Account.
- Email Request: Send an email to delete@picmaze.com or support@picmaze.com with the subject line "Account & Data Deletion Request". Upon verification, all your profile data, synced coins, and records will be permanently purged within 7 business days.
