PixTribu Privacy Policy

Last updated: October 6, 2026

PixTribu is an app for sharing photos and videos privately with your Tribù: your family and close friends. There is no PixTribu account and no cloud photo library. This policy explains what the app, our server and the Google services we use handle, why, and for how long.

Who is responsible

PixTribu is developed and run by Andrea Zocca, Italy ("we"). We are the data controller for the data described here. Contact: pixtribu@gmail.com.

Photos and videos

Every photo and video is end-to-end encrypted on your device (libsodium crypto_box) before it is sent. Only the sending and receiving devices can read it.
Devices send media to each other directly over the local Wi-Fi network when they can. When they are on different networks, our server at pixtribu.quadraro.net passes the encrypted data along. It cannot read the data and does not store it: it forwards it and discards it.
Received photos and videos are saved on each Tribù member's device, in the Pictures/PixTribu folder. Other apps that can read your photos, such as a gallery or a backup app, can also see that folder.

Your device identity and your Tribù

On first launch, the app creates an encryption key pair on your device. The private key stays on your device. The public key, and a short fingerprint made from it, identify your device to the people you pair with and to our server.
When you pair, by QR code or invite link, the devices exchange their public keys, the name you chose for yourself, and the names of the Tribù and albums you share. This information goes only to the devices you pair with.
An invite link carries its secret part in the link's "#" fragment. Browsers never send that part to a server, so our server never receives it.

Backup with Google (Block Store)

If Google backup is turned on for your phone, the app saves a copy of your device identity (including the private key), your name, your Tribù and their members' names and public keys in Google's Block Store. This lets a reinstall, or a new phone set up from this one, come back as the same Tribù member. When your phone has a screen lock, Google end-to-end encrypts this copy, so Google cannot read it. Photos, videos and album contents are not part of this backup. If Google backup is off, nothing is saved there. You can turn it off in your phone's Google backup settings.

What our server stores

Our server runs on our own hardware in Italy. It keeps only what it needs to connect devices:

Device registration: your device's public key fingerprint and its Firebase Cloud Messaging token, so a Tribù member can wake your app to deliver photos. Kept while the app is in use, and replaced when the token changes.
Delivery waits: which device fingerprints are waiting for which other fingerprints to come online, so delivery can resume when they do. Removed once delivered.
Usage measurements: the dates you open the app (not background sync), the app version, and a pseudonymous identifier derived from your device identity. They contain no photos, names, album titles or location. Daily records are kept for 90 days. The identifier and the date it was first seen are kept to count returning installations, until you ask us to delete them. The app holds unsent records for up to 30 days.
Network logs: like any web server, ours records the IP address, time and requested address of each connection, for security and troubleshooting. These logs are kept for up to 12 months, then deleted.
Diagnostic reports you choose to send: when this option is available in the app and you tap "Send snapshot", the app uploads its local database (Tribù member names, album titles, sync status), its recent technical log and device details. No photos or videos. We keep the last 10 reports per device and delete them when the problem is solved or on request.
Test access requests: if you ask for test access on our website, we keep the email address you enter until we have added you to the test, or until you ask us to delete it.

Google services in the app

The app uses these Google services. Google processes the data under the Google Privacy Policy, and may process it outside the European Union under Google's data transfer safeguards.

Firebase Cloud Messaging: delivers silent wake-up messages so photos arrive while the app is closed. Google receives a messaging token for your device.
Firebase Crashlytics: sends a crash report when the app fails. It includes the device model, Android version, app version, the crash details, recent technical log lines, your device fingerprint (so reports from one device can be grouped), and how many Tribù and members you have. No photos or videos.
Google Analytics for Firebase: only if you allow it, records app interactions such as onboarding, pairing, sharing and download requests, with a random app-instance identifier. It does not use your advertising ID. Events contain no photos, videos, names or album titles.
Firebase Remote Config: downloads feature settings for the app, using a Firebase installation identifier.
Google Play Billing: if you buy PixTribu Premium, Google handles the payment. We receive only whether the purchase is valid, never your payment details.
Google Play Install Referrer: if you install the app from an invite link, the app reads the invite from the Play Store install so you can join without opening the link again.
Google Play In-App Review: may show Google Play's rating card. Your rating goes to Google Play, not to us.

Why we use this data (legal bases)

To provide the app you asked for: transfer, wake-up messages, device registration, delivery waits, Block Store backup and purchases (performance of a contract).
To keep the service secure and working: network logs, crash reports, diagnostic reports and usage measurements (our legitimate interest in running a reliable service).
Google Analytics for Firebase: your consent. The app asks the first time you open it and sends nothing until you allow it. You can withdraw consent at any time with the "Share usage statistics" switch: tap your avatar on the Tribù screen.

App permissions

Camera: only to scan a pairing QR code. No photo is taken or saved.
Photos and videos: to let you choose photos to share and to save photos your Tribù shares with you. On Android 14 and later you can allow only the photos you select.
Notifications: to tell you when new photos arrive.
Background activity and battery optimisation: so photos can arrive while the app is closed.

What PixTribu does not do

No ads, no advertising ID, no ad tracking.
No PixTribu account, and no phone number or email needed to use the app.
No selling or renting of data to anyone.

Your choices and deleting data

Removing a Tribù member, or leaving a shared album, stops future sharing. Photos that member already received stay on their device: we cannot delete them, because we never had them.
Uninstalling the app deletes its data from your device. It does not delete the Block Store backup (turn off Google backup to stop it), records already sent to Google, or the records on our server listed above.
To have your records on our server deleted, write to us. We may ask for details from the app that let us find your records, because we do not know who you are.

Your rights

If you are in the European Union or the United Kingdom, you have the right to access, correct, delete, restrict, object to the use of, and receive a copy of your personal data. Write to pixtribu@gmail.com. You can also complain to your data protection authority. In Italy, this is the Garante per la protezione dei dati personali (garanteprivacy.it).

Children

PixTribu is meant for adults sharing family photos, which can include photos of their children. The app is not directed at children, and we do not knowingly collect data from children under 14.

Changes to this policy

If we change this policy, we update the date at the top of this page. For important changes, we also tell you in the app or in the Play Store release notes.

Contact

Questions or requests: pixtribu@gmail.com.