Privacy Policy — Pixalea

Last updated: October 14, 2026

This policy describes how data is handled in the "Pixalea" mobile apps for iOS and Android (identifier com.opharana.pixalea; hereinafter, "the app"), whose data controller is OPHARANA LLC, with registered address at 99 Wall Street, Suite 1432, 10005, New York (United States) and contact email hello@opharana.com.

1. Summary

• We do not sell your data or share it with third parties for purposes other than those described here, and we do not send marketing emails.
• You can play without an account. Your progress (solved puzzles, streaks, settings) is saved on your device.
• The account is optional and is there to compete with friends. If you create one, we store your email, a public username you choose and your times for the daily puzzle on Supabase servers located in the European Union (Ireland).
• The app shows Google AdMob ads, as well as our own ads for TuIAgencia, the owner's agency. In Europe we ask for your consent before showing you personalized ads and, on iOS, AdMob only uses the advertising identifier if you grant Apple's tracking permission. You can change your choice at any time in Settings → "Ad privacy options", and the "No ads" purchase removes the banner and full-screen ads (sections 2.4 and 4).
• Payments are processed by Apple or Google; RevenueCat manages the receipts. We never see your payment details.
• You can delete your account from within the app (section 8).

2. Data we process

2.1. Playing without an account: your progress stays on your device

The puzzles come included in the app itself. Everything you generate by playing —the puzzle in progress, the ones you've solved, your times, streaks, settings, the time of the daily reminder, the days you've watched the video of the day and the purchases applied— is saved in your device's local storage. If you don't sign in, that data is not sent to us and we cannot see, copy or restore it: if you clear the app's data, uninstall it or switch devices without a system backup, it is lost.

2.2. Optional account: email, Google or Apple

You only need an account if you want to compete with friends. When you create one we process:

• Email address (and a password, stored encrypted, if you choose to sign in with email), to identify you and so that you can recover access.
• An internal user identifier.
• The username you choose (3 to 16 characters). It is public: your friends see it, so does anyone who searches for you to add you, and it appears in the ranking. You can change it whenever you like from your account.
• If you sign in with Google or Apple, we receive from the provider your email (or Apple's private relay address if you choose "Hide My Email") and the name associated with that account. That real name is stored privately, does not appear in the ranking or in searches, and could only be seen by your accepted friends.
• Your friendships: who you've added, who has added you and pending requests.
• Your results for the daily puzzle: best time (including the mistake penalty) and number of mistakes, sent to the server only if you're signed in, for the ranking among friends; and, on your profile, your best streak and total puzzles solved.

Anti-bot. When you sign up or sign in with email, a Cloudflare Turnstile challenge checks that you're not an automated program. To do so, Cloudflare processes your IP address and technical device data in accordance with its privacy policy.

2.3. Technical data

When the app connects to our servers (Supabase) or to the third-party services described in this policy, they transiently process your IP address and the technical connection data needed to handle the requests and protect the service. This website's hosting does the same when serving you these pages. We use no analytics tools, neither in the app nor on the website, and the website has no advertising or tracking either. The only processing for advertising purposes is Google AdMob's inside the app, explained in the next section.

2.4. Advertising: Google AdMob and our own ads

The app is free and funded by advertising, which comes in three formats:

• A banner on the Home screen and during a game.
• A full-screen ad when you leave a picture you've already solved, never in the middle of a game.
• The video of the day, a rewarded video that only plays if you open it.

Except for our own ads, explained below, these ads are served by Google AdMob, Google's advertising network (Google Ireland Limited). To show and measure them, prevent fraud and, if you consent, personalize them, AdMob may process your device's advertising identifier (on iOS, the IDFA, and only if you grant tracking permission; on Android, the advertising ID), your IP address, technical device data (such as the model, operating system and language) and your interactions with the ads (which ads are shown and which ones you tap). Google processes that data in accordance with its privacy policy and explains how it uses data in advertising.

Your consent. If you are in the European Economic Area, the United Kingdom or Switzerland, before any AdMob ad is loaded the app shows you Google's consent form, a consent management platform compatible with IAB Europe's Transparency and Consent Framework (TCF). You will only see personalized ads, and the advertising identifier will only be used for that purpose, if you give your consent; if you don't, AdMob shows non-personalized ads, chosen based on context (for example, the app they appear in) rather than on your profile. On iOS, the app also asks for Apple's tracking permission (App Tracking Transparency): if you don't grant it, AdMob does not receive the IDFA. Your choices are saved on your device and you can change them at any time (section 4).

Our own ads. The app also shows ads for TuIAgencia, the owner's services agency: when the app is in Spanish, one in three full-screen ads and the banner whenever AdMob has none available; and, in any language, our own video of the day whenever AdMob has no video. These ads use no personal data or advertising identifiers. If you tap one, the tuiagencia.com website opens in your browser.

2.5. In-app purchases

The app offers two optional purchases: "No ads", a one-time (non-consumable) purchase that removes the banner and full-screen ads forever (Google AdMob ones included), and "5 tries for today", a consumable purchase that gives you five retries of the daily puzzle to improve your time. There are no subscriptions or virtual currency. All purchases are processed entirely by Apple (App Store) or Google (Google Play) depending on your platform, in accordance with their own policies.

To apply and restore purchases we use RevenueCat, which receives the purchase receipt from the store (product identifier, transaction identifier and date) and links it to an anonymous identifier generated on your device; it does not receive your name or your email. Neither we nor RevenueCat see your card, bank or billing details. Refunds and payment claims are handled through Apple or Google.

2.6. Daily reminder

If you turn on the reminder for today's picture, the notification is scheduled locally on your device at the time you choose. We do not send notifications from servers or process push notification identifiers.

2.7. When you write to us

If you write to us at hello@opharana.com we process your email address and whatever you tell us, for the sole purpose of handling your inquiry, your issue or the exercise of your rights.

3. Purposes and legal bases (GDPR)

4. Advertising

• Changing or withdrawing your consent: in the app, go to Settings and tap "Ad privacy options" (it appears wherever the law requires this form, such as in the European Economic Area). Withdrawing it is as easy as giving it and does not affect the lawfulness of any processing carried out beforehand.
• Tracking permission on iOS: you can grant or revoke it at any time in iOS Settings → Privacy & Security → Tracking.
• Advertising ID on Android: you can reset or delete it in Settings → Google → Ads (on some models, Settings → Privacy → Ads).
• The video of the day is voluntary: it is only shown if you open it, and watching it several days in a row gives you an extra try at the puzzle. Which days you've watched it is stored only on your device.
• Removing the ads: the one-time "No ads" purchase removes the banner and full-screen ads forever, both AdMob's and our own. The video of the day remains available if you want to watch it to earn its reward.

5. Data recipients

We do not sell your data or share it with any third parties other than those listed, who act as processors or as independent controllers of their own services:

6. International transfers

The data controller is established in the United States. Your account data is stored on Supabase servers in the European Union (Ireland). Some providers (Cloudflare, Google and its AdMob advertising service, Apple, RevenueCat, Vercel) process data outside the European Economic Area, mainly in the United States; those transfers are covered by the Standard Contractual Clauses approved by the European Commission and/or by adequacy decisions (such as the EU-U.S. Data Privacy Framework).

7. Retention

Your account data (email, username, provider name, friendships and results) is kept for as long as the account exists. When you delete it, the data is removed immediately; technical backups are overwritten within a maximum of 30 days.

Your progress without an account lives only on your device until you clear the app's data or uninstall it. The emails you send us are kept for as long as your inquiry is being handled and, afterward, for the time needed to demonstrate that we addressed it. Purchase receipts are kept for as long as the purchase can be restored. Your advertising consent choices are saved on your device until you change them or uninstall the app, and the data Google AdMob processes is retained in accordance with Google's policies.

8. How to delete your account

You can delete your account within the app, without writing to us: on the Home screen tap "Compete with your friends" (or go to Settings → Your account), sign in if you aren't already and tap "Delete my account"; we'll ask you to confirm.

Deletion is immediate and permanent: your account, your profile (email, username and name from the sign-in provider), your friendships and your results are removed from the server. Your local progress stays on the device until you clear the app's data, and your purchases are not affected, because they are linked to your store account, not to your Pixalea account.

If you can't access the app, write to us from the account's email address at hello@opharana.com with the subject "Delete my account" and we will delete it within a maximum of 30 days.

9. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent by writing to hello@opharana.com. We will respond within one month.

Bear in mind that, without an account, your progress never leaves your device: the only personal data we hold is that of your account, if you've created one, and that of the emails you've sent us. The data Google AdMob processes for advertising is managed by Google: you change your consent from the app (section 4) and you can exercise your other rights directly with Google. You change your username yourself from the app; the rest of the account is deleted as explained in section 8.

You also have the right to lodge a complaint with the supervisory authority; in Spain, the Spanish Data Protection Agency (AEPD, aepd.es).

10. Minors

The app is not directed at children under 14 years old and we do not knowingly collect data from minors. We do not verify age. If you are a parent or guardian and believe a minor has created an account, write to us at hello@opharana.com so that we can delete their data; you can also prevent its use with your device's parental controls (Screen Time on iOS, Family Link or Google Play's controls on Android).

11. Security

The app's and this website's communications are encrypted (TLS). Passwords are stored irreversibly encrypted (hashed). Access to account data is protected by per-user security rules on the server: the app can only read and modify what belongs to the account you're signed in with. Your local progress is saved in the app's private space, which the operating system itself protects.

12. Changes to this policy

If we modify this policy, we will publish the new version at this same URL (https://pixalea.com/en/privacidad) and update the date in the header. Substantial changes will be flagged in the app or in the store listings.

13. Contact

OPHARANA LLC
99 Wall Street, Suite 1432, 10005, New York, United States
hello@opharana.com