Welcome to Picmaze. We respect your privacy and are committed to protecting your personal data across our website (picmaze.com), Web Checkout Services, and Mobile Applications (Android & iOS) globally. This policy explains how we collect, process, transfer, and safeguard your information under international data protection laws including EU GDPR, US CCPA/CPRA, COPPA, and the Digital Personal Data Protection (DPDP) Act 2023 (India).
🌐 International Data Transfer Notice: Picmaze's primary server, database, and backend infrastructure is hosted in the United States. By accessing our services from the European Union (Germany, France, Netherlands, Italy), Canada, Brazil, India, or other international regions, your information is securely processed and stored in the United States under Cloudflare SSL/TLS encryption and Standard Contractual Clauses (SCCs).
01. Information Collection & Legal Grounds
We process your personal data under the lawful grounds of consent (GDPR Art. 6(1)(a)), contractual necessity (GDPR Art. 6(1)(b)), and legitimate interests (GDPR Art. 6(1)(f)):
Age Verification Data:
To comply with global children's privacy protection regulations (COPPA, EU GDPR Art. 8, and DPDP Act 2023), we collect your Age or Date of Birth during registration to confirm that you are legally eligible to access our platform.
Account & Profile Data:
When you log in via Google Sign-In or Email, we process:
- Google Sign-In: Your Email Address, Display Name, Profile Picture (Avatar) URL, and a unique Google account identifier.
- Email & Password: Your email address and securely hashed/salted password credentials.
- Profile Synchronization: Your virtual Picoin balance, transaction history, unlocked 4K wallpapers library, download records, and favorite items across all your web and mobile devices.
Web & In-App Purchases & Payment Data (Lemon Squeezy & Google Play):
When you purchase Picoins on our website or mobile app, payments are securely processed by our certified payment partners:
- Web Purchases: Handled by Lemon Squeezy (acting as Merchant of Record). Lemon Squeezy processes your payment methods (Credit/Debit Cards, Google Pay, Apple Pay, UPI, Netbanking) under PCI-DSS Level 1 compliance.
- Mobile App Purchases: Handled securely via the official Google Play Billing system.
- Zero Card Storage Guarantee: Picmaze strictly does NOT collect, view, or store your raw credit/debit card numbers, CVVs, or bank credentials.
Analytics, Diagnostic & Session Replay Data (PostHog & Firebase):
To understand user drop-offs, fix application crashes, improve wallpaper browsing speed, and optimize app navigation, we process aggregated telemetry and diagnostic session interactions via PostHog and Firebase Analytics (such as screen transitions, button clicks, search queries, and wallpaper downloads). Privacy Guarantee: All text inputs, passwords, and sensitive fields are automatically masked/redacted. We strictly do not record personal passwords or payment data.
Mobile Device & Anti-Fraud Identifiers:
To deliver system alerts, execute background Auto-Wallpaper rotation, and prevent promotional fraud, we process technical specifications (device model, Android/iOS version, app build), Firebase Cloud Messaging (FCM) push tokens, and a unique hardware Device Identifier (Device ID) strictly under Legitimate Interest (GDPR Art. 6(1)(f)) to prevent duplicate welcome bonus abuse and multi-account spamming on a single physical device.
Location & Ad Data (Google AdMob):
To display banner, interstitial, rewarded, and native ads, our third-party advertising partner (Google AdMob) processes Advertising Identifiers (GAID / IDFA), coarse location, and IP address. Where required by law (e.g. EU GDPR/CCPA), a Google UMP Privacy Consent banner allows you to manage personalized ad choices.
02. Third-Party Services & Infrastructure
To support web and app functionality, edge security, multi-currency billing, and analytics, we use certified global providers:
- Lemon Squeezy (Merchant of Record): Manages web payment processing, invoicing, regional multi-currency conversion, and global tax compliance (including Indian GST, EU VAT, and US Sales Tax). Learn more about Lemon Squeezy Privacy.
- Google Play Store Billing: Handles secure in-app coin purchases and subscriptions under standard safety guidelines.
- United States VPS Infrastructure: Secure cloud servers located in the US for API processing and database storage.
- Cloudflare CDN: Used for edge caching, SSL/TLS media encryption, custom reverse proxy telemetry, and DDoS attack prevention.
- PostHog Product Analytics & Session Diagnostics: Used for product analytics, screen navigation tracking, and diagnostic session replays to identify UI friction and fix bugs. All sensitive inputs are masked by default. Learn more about PostHog privacy.
- Google AdMob & Analytics: Displays ads and analyzes aggregated app performance. Learn how Google uses ad data.
- Firebase & Crashlytics: Used for authentication, push notifications, and app crash diagnostics.
03. App & Web Platform Permissions
User Control: You can manage or revoke storage, location, and notification permissions via your device system settings or browser preferences at any time.
| Feature / Permission | Purpose | Requirement |
|---|
| Internet / Network State | Fetch wallpapers, sync profile data, process coin transactions, and diagnostic analytics | Mandatory |
| Set Wallpaper / Auto-Changer | Apply background wallpaper automatically on mobile devices | Mandatory (Mobile) |
| Billing / Secure Checkout | Process web & in-app coin purchases securely via Lemon Squeezy / Google Play | Optional (For purchases) |
| Location Data | Display localized currencies/taxes, serve relevant ad content, and prevent fraud | Optional (User Choice) |
| Storage / Gallery | Save downloaded 4K wallpapers to your device storage | Optional |
04. In-App & Web Purchases, Picoins & Virtual Goods
Picmaze provides virtual tokens (Picoins) to unlock high-resolution premium 4K wallpapers and exclusive creator art across web and mobile platforms:
- Virtual Digital Tokens: Picoins are digital, non-transferable virtual items. They possess no real-world cash equivalent, cannot be redeemed for fiat currency, and are exclusively meant for use inside the Picmaze ecosystem.
- Multi-Currency & Dynamic Pricing: Coin bundles are dynamically priced and presented in your local currency (e.g. INR ₹, USD $, EUR €, GBP £) based on real-time rates from our payment infrastructure.
- Taxes & Statutory Compliance: Where applicable by regional law, statutory taxes (such as 18% GST in India, VAT in the European Union, or applicable US state sales taxes) are calculated and managed compliantly by our Merchant of Record (Lemon Squeezy) or Google Play.
- Instant Digital Delivery: Once purchased, Picoins are credited to your balance instantly. Unlocking a wallpaper grants perpetual high-definition download access in your user profile library. Digital purchases and consumed coin unlocks are final and non-refundable, except where mandated by applicable law.
05. International Privacy Rights (GDPR, CCPA & DPDP)
Depending on your region (United States, European Union / Germany, India, Canada, etc.), you have statutory rights regarding your personal data:
- EU GDPR Rights (Germany, Netherlands, France, Italy): You have the right to access (Art. 15), rectify (Art. 16), erase / be forgotten (Art. 17), restrict/object (Art. 18 & 21), and port your data (Art. 20). You also have the right to lodge a complaint with a European Supervisory Authority (e.g., German BfDI).
- California CCPA / CPRA Rights (US Users): We do NOT sell your personal information to data brokers. You have the right to request disclosure of collected data and request deletion without discrimination.
- India DPDP Act 2023: You have the right to request data summaries, seek correction/erasure of personal and billing records, and register grievance redresses.
- Consent Management: You can manage personalized ad consent anytime via the app's Privacy CMP settings.
06. Age Restrictions & Children's Privacy
Picmaze is strictly intended for users who are 18 years of age or older (or age of legal consent in your jurisdiction). We verify your age during account setup. We do not knowingly collect or maintain personal data from minors under 18. If we discover an account belongs to a minor, we will immediately delete all associated account records and data. If you believe a minor has accessed our service, contact us at support@picmaze.com.
07. Data & Account Deletion Request Process
In compliance with Google Play Store 2026 mandates and global privacy laws, you can permanently delete your account and personal data at any time:
- In-App / Web Deletion: Open the Picmaze App or Web Dashboard > Go to
Settings > Account > Delete Account.
- Email Request: Send an email to delete@picmaze.com or support@picmaze.com with the subject line "Account & Data Deletion Request". Upon verification, all your profile data, synced coins, and records will be permanently purged within 7 business days.
