Privacy Policy

• Account and profile — your account identifier, sign-in email, display name, chosen avatar or uploaded profile photo, and optionally your Instagram handle when you join an event.
• Event content — events you create or join, RSVPs and plus-ones, polls and votes, bring-list items, games/scores, trip plans and documents you choose to upload.
• Conversations and connections — messages, shared photos or stickers, their authors and times, crew memberships, and connection requests, accepted connections and blocks. Personal chats are available between accepted, unblocked friends. We save your own read position, pinned chats and mute preferences across devices; read positions are not shared as read receipts.
• Optional food preferences — dietary choices and allergy notes you provide. Allergy notes can contain health information. Your response is saved to your profile and carried into events that collect food preferences, where other members can read it. You can edit or clear your response.
• Purchases, shared costs and AI requests — when used, purchase identifiers, products, status, credit balances, shared bills and payment instructions, and requests or saved results associated with your account. AI inputs can include text, images or documents you submit and event context needed for the feature.
• Location (only when you opt in) — foreground sharing and optional timed trip sharing work differently; see §3. Trip reports also store the map pin you choose.
• Technical data — basic device/browser info and logs needed to run and secure the service (e.g. IP address, handled by our hosting provider), push notification registration tokens, and records of product actions, errors and request performance.
• Instagram data (only if the IG invite feature is used) — if an organizer runs our Instagram comment→invite flow, we process the public comment that triggers it (the commenter's ID and comment text) solely to send the requested invite link. We do not read private messages or group chats.

• Run the event you joined — live map, polls, bring list, games — to perform the service you requested (contract).
• Keep the service secure and prevent abuse — legitimate interests. Narrow automated checks review chat text and links before sharing. If you report a message, PIXIE receives a copy and your reason in a restricted operator inbox; the sender and group are not shown the reporter’s identity.
• Deliver messages, notifications and purchases, remember your choices, and measure use and reliability to maintain and improve the service.
• Share your live location with event members — only with your explicit consent (opt-in), withdrawable anytime.

We do not use your data for advertising or profiling, and we do not sell it.

• Location sharing is off by default. You choose when to share and with which event or trip.
• Friends check-ins are optional statements that you are at a selected event. You choose the accepted friends who may see the check-in and when it expires. These use the event venue, not your phone's GPS. Private event details and venue pins are shown only to viewers who already have access to that event. Stopping the check-in, blocking or removing a friend revokes that sharing. A check-in does not verify anyone's physical location.
• Foreground sharing streams your current location while the map is open. These streamed points are not written to our database.
• Timed trip sharing, where available in the iPhone app, requires a separate confirmation and location permission. You can choose 15 minutes, 1 hour or 4 hours. It continues while the screen is locked. Signed-in members of that trip can see your latest point, its accuracy and when it was captured. We store one recent point per sharing session, replacing it as you move; we do not build a location trail.
• A timed point stops being visible after two minutes without a fresh update, or when sharing stops, expires or your trip access is revoked. Expired coordinates are removed by scheduled cleanup. Stop timed sharing, Ghost mode and sign-out stop collection on the device. If the device is offline, its previous point may remain visible for up to two minutes.
• Lock Screen crew progress, where available, is a separate opt-in for up to four hours. It uses positions already shared with your trip to show approximate distance from its meeting point. Following progress does not start sharing your own location. Traveller and place names stay hidden unless you enable them; anyone viewing your Lock Screen can see the information you choose to show. Recent positions expire after two minutes, and being nearby does not confirm arrival. Apple delivers background updates using a temporary Live Activity token. You can stop this view separately from location sharing; sign-out also ends it.
• Native navigation, where available in the iPhone app, uses your current location and selected destination to request a route from Mapbox. Starting guidance continues location use while navigating, including with the phone locked. Stop guidance to end navigation location use. Navigation does not start crew sharing; a separately started sharing session has its own stop control.
• We will never sell, broker, or share your location with advertisers or data brokers.

We keep a sign-in token plus your chosen name and avatar in your browser's local storage so you stay recognized within an event. An essential, signed cookie remembers your 18+ confirmation on this device for up to 90 days. It contains the policy version, confirmation and expiry times, and your account ID when signed in. We do not collect your date of birth or identity documents for this confirmation. We do not use third-party advertising or tracking cookies. PIXIE does not store your Google or Apple account password.

If you prepare a trip for native CarPlay, we save up to 30 exact destinations from that trip in a protected file on your phone for up to 24 hours. This lets you choose a saved destination with your phone locked. The copy contains the trip and stop names and locations, but no tickets, notes or crew positions. Removing the prepared trip, signing out or changing accounts clears that copy. Preparation does not start navigation automatically. The native map software may also cache map data on your device.

We don't sell your data. Event content is visible to the other members of that event. We rely on these providers to run PIXIE:

• Supabase — database, auth tokens, and realtime.
• Mapbox — map rendering, geocoding, route or traffic estimates, and native navigation where available. Web route estimates send the selected stop coordinates. Native navigation also uses your current location for routing and guidance. Requests include technical information needed to deliver and account for the service.
• Vercel — application hosting.
• Apple — iPhone purchase processing and push notification delivery when you use those features. Stripe processes supported web purchases. PIXIE retains purchase records needed to deliver, restore and reconcile your entitlements.
• Resend or Brevo — account and event email delivery, when email is enabled.
• PostHog — server-side product and error analytics when configured. PIXIE also stores product activity in its own database and hosting logs. We do not use browser session replay.
• Google Gemini — when an available AI feature is used, the request and relevant context are sent for processing. Depending on the feature, this can include submitted text, images, itinerary documents or food preferences and allergy notes shared with the event for meal planning.
• Meta/Instagram — only if the IG invite feature is used.

Native navigation’s optional Mapbox analytics setting is off by default. You can change it on the phone before opening a route or preparing CarPlay. Optional telemetry can include location and usage information to improve Mapbox services. Turning it off does not stop the requests needed for maps, routing, service diagnostics or billing associated with features you choose to use.

Your data may be processed on servers outside your country; where required, transfers rely on appropriate safeguards (e.g. standard contractual clauses).

When signed in, unsent text drafts and personal-message retry identifiers are saved on this device for recovery for up to 24 hours; expired copies are discarded when PIXIE next opens or saves a draft. They are not chat history and are not sent automatically while offline. Signing out or changing accounts clears these local drafts.

We keep event and profile data to provide your plans and recaps. Retention depends on the type of content and the controls described below. Foreground location streams are not stored; timed trip points follow the short visibility and cleanup rules in §3. You can request deletion at any time (§7).

Profile food preferences remain available across events until changed or cleared. Messages, connections, saved AI results and purchase records remain linked to their relevant account, crew or event while needed to provide those features. Account deletion removes your sign-in, profile, PIXIE ID and account-authored messages, photos and other content. Shared expense amounts can remain under “Deleted account” so other participants’ balances stay accurate. Storage cleanup retries failed removals. Restricted evidence in an open safety investigation, and purchase, security or legal records, may need to remain after an account closes. Deleting an account does not cancel a subscription managed by Apple or another payment provider.

Uploaded profile photos are visible on your profile and wherever your avatar appears. We store a resized, cropped image without embedded location metadata; the original selected file stays on your device. Ordinary profile uploads are not used for AI sticker generation. Replaced or removed uploads are deleted from storage, with retries for failed cleanup. Cached copies may remain briefly, and we cannot remove copies saved by others.

Trip reports, proposed stops, votes, notes and photos are private to current signed-in trip members. Reports expire within the time you select, up to 24 hours. Expired or removed reports and their photos are deleted through scheduled cleanup, with retries when storage is unavailable. Photo uploads are resized and stripped of embedded metadata. Private photo links last no more than 60 seconds; recipients may still save a copy. If a host explicitly adds report details to the itinerary, that saved itinerary follows ordinary event-content retention.

Depending on where you live (e.g. EEA/UK under GDPR, California under CCPA/CPRA), you have rights to:

• Access a copy of your data, correct it, or delete it.
• Restrict or object to processing, and port your data.
• Withdraw consent (e.g. stop location sharing) at any time.
• Not be discriminated against for exercising your rights.

We do not sell or "share" personal information as defined by CCPA/CPRA. To exercise a right, email hello@pixie.events, or ask the event admin to remove you (which deletes your membership and entries). EEA/UK users may also complain to their local data protection authority.

To delete your PIXIE account, open Settings → Account → Delete account. You can also change or clear your food preferences in your profile. Subscription cancellation remains available through the store or payment provider that manages it.

We use signed capability tokens (no passwords), encrypted connections (HTTPS), and server-side access controls, and we minimize what we hold (e.g. limiting location retention). No system is perfectly secure.

PIXIE is for adults aged 18 and over. People under 18 must not create an account or use the service. We do not knowingly collect their data; if you believe someone under 18 has provided it, contact us and we will delete it.

PIXIE uses the Instagram Platform API only for the optional comment→invite feature, in line with Meta's Platform Terms. PIXIE is not affiliated with, endorsed, or sponsored by Instagram or Meta.

We may update this policy; we will change the date above and, for material changes, take reasonable steps to notify you. Continued use means you accept the updated policy.