Privacy policy

1. Who we are

PixMap ("the App") is provided by Pixelbrahma Design Studio Private Limited. In the language of the DPDP Act we are the Data Fiduciary — the entity that decides why and how your personal data is processed. You are the Data Principal.

Pixelbrahma Design Studio Private Limited
Kasturinagar, Bengaluru 560043, Karnataka, India
Phone: +91 97470 90058
Email: hello@pixelbrahma.com
Web: pixelbrahma.com

We do not sell your personal data. We do not use it for advertising, and we do not build advertising or behavioural profiles of you.

2. What we collect and why

The DPDP Act requires us to tell you, item by item, what personal data we process and the specific purpose of each item. This table is that notice. We collect only what the App needs to work.

2.1 Data you give us

2.2 Data collected automatically

2.3 Optional features you switch on

• Contacts. If you open the Friends tab and grant contacts permission, the App reads your address book on your device and sends only hashed phone numbers to our servers to find which of your contacts already use PixMap. The plaintext contents of your address book never leave your device, and we do not store your contact list.
• Photo library. Read only when you tap "Choose photo", and only for the photo you pick.
• Microphone and speech recognition. Used only when you tap a dictation icon or invoke Siri or Google Assistant. We do not listen in the background.

We do not collect contacts, photos, microphone audio or background location unless you have expressly granted that permission, and you can revoke any of them at any time in your device settings.

3. Consent, and withdrawing it

Where we rely on consent, that consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. We do not use pre-ticked boxes, and we do not treat silence or continued use as consent. You are shown a notice before you are asked to consent, and you can read this policy in full at any time from within the App.

You may withdraw consent at any time, and it must be as easy to withdraw as it was to give. In practice:

• Revoke a device permission (location, contacts, microphone, photos, notifications) in your device settings. The rest of the App keeps working; the feature that needed it stops.
• Delete an individual place, photo or message inside the App.
• Delete your account entirely — Settings → Delete account, or see Delete your account and data.

Withdrawing consent does not make our earlier processing unlawful. After withdrawal we stop the processing that depended on that consent and erase the relevant personal data, unless a law requires us to keep it — see section 9.

4. Processing without consent

The DPDP Act allows a small set of "legitimate uses" that do not need separate consent. We rely on them only for:

• Security and integrity of the service — crash diagnostics, authentication audit logs, and detecting fraud or abuse.
• Compliance with law — where an Indian law, a court order or a lawful direction from a government authority requires us to process or disclose data. We disclose the minimum legally compelled.

5. Children and persons with disability

Under the DPDP Act a child is anyone under 18 years of age. This is stricter than the rule in many other countries, and it applies to PixMap because we are an Indian Data Fiduciary.

• Before we process the personal data of a child, we must obtain and verify the consent of a parent or lawful guardian. We do this by confirming that the consenting adult is identifiable and is an adult, using the means permitted under Rule 10 of the DPDP Rules, 2025 — including details already reliably held by us, or a virtual token issued against a Digital Locker or other authorised identity service.
• The same requirement applies to a person with a disability who has a lawful guardian, in which case we obtain that guardian's consent.
• We do not carry out tracking or behavioural monitoring of children, and we do not serve targeted advertising to children. PixMap serves no advertising to anyone.
• We do not knowingly process a child's data without verified guardian consent. If you believe we have, write to our Grievance Officer and we will investigate and erase the data.

Status note. Verifiable parental consent is a legal requirement we are implementing. Until the in-app flow is live, PixMap should not be used by anyone under 18. This note will be removed when the flow ships.

6. Who we share data with

We share personal data only with Data Processors acting on our instructions under contract, and only to the extent needed to run the App. We do not sell, rent or trade personal data.

We also disclose data where compelled by valid legal process, limited to what is legally required.

Other users. When you deliberately share a place with a friend or make it public, that place — its title, notes, photos, tags and coordinates — becomes visible to those people. A share never exposes your other places or your live location, and you can revoke it.

7. Where your data is stored, and transfers outside India

We run on Google Cloud. Different parts of the service sit in different regions, and you are entitled to know which. This is the current position:

So the database of the places you save is held in India, while the media attached to those places, and the processing that operates on your data, currently take place in the United States. Data may also move between Google regions for backup and disaster recovery.

These transfers are governed by our contracts with Google, which bind Google to process personal data only on our instructions and to apply appropriate security safeguards. The DPDP Act permits transfer of personal data to any country other than those the Central Government restricts by notification. We will cease transferring to any territory that becomes restricted, and will meet any further conditions the Government imposes on making personal data available outside India.

We are working to move media storage and server-side processing into the India region. We will update this section, and the date at the top of this policy, when that is complete.

8. How long we keep data

We keep each category of personal data only as long as it serves the purpose you gave it for, and then we erase it.

9. Erasure

We erase your personal data, and instruct our Data Processors to erase it, when you withdraw consent or delete your account, or when the retention period above expires — whichever is earlier — unless retention is required by law.

Two things survive erasure and you should know about them: encrypted backups until they are overwritten on the cycle above, and content another user already holds — if you shared a place and a friend saved their own copy, that copy is theirs.

10. Security safeguards

We take reasonable security safeguards to prevent a personal data breach, including:

• encryption of all data in transit using TLS 1.2 or higher, and encryption at rest by Google Cloud;
• hashing of contact phone numbers on your device before they are ever transmitted;
• database security rules that restrict each account's reads and writes to its own data;
• authentication handled entirely by Firebase Auth — we never see your OTP;
• access controls and logging so that access to personal data can be detected and investigated;
• contractual security obligations on every Data Processor we use.

11. If there is a data breach

If a personal data breach occurs, we will:

• notify you, without delay, in the App or by email — describing the nature and extent of the breach, when it occurred, the likely consequences, what we have done about it, and what you can do to protect yourself;
• notify the Data Protection Board of India without delay, and give the Board the detailed report required within 72 hours of becoming aware (or such longer period as the Board allows on request).

12. Your rights

As a Data Principal you have these rights, and exercising them is free of charge unless a request is manifestly excessive or repetitive.

• Right to access information (s.11) — a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Processors with whom we have shared it.
• Right to correction, completion, updating and erasure (s.12) — most fields are directly editable in the App; for anything else, ask us. You can erase your account and data yourself from Settings.
• Right to grievance redressal (s.13) — raise a grievance with our Grievance Officer, who must resolve it within 90 days. You must use this route before approaching the Board.
• Right to nominate (s.14) — nominate another individual to exercise these rights on your behalf if you die or become incapacitated. Write to us to record a nomination.
• Right to withdraw consent — at any time, as easily as it was given. See section 3.

How to exercise them. Email hareesh@pixelbrahma.com from the account you wish to act on, or with the phone number registered to it. We may ask you to verify that the account is yours before we act — this protects you from someone else exercising your rights. We respond within 30 days, and to grievances within 90 days.

13. Your duties

The DPDP Act also places duties on Data Principals. When dealing with us you must not:

• impersonate another person when providing personal data;
• suppress material information when providing personal data for any document or identifier issued by the State;
• register a false or frivolous grievance or complaint;
• furnish anything other than verifiably authentic information when exercising the right to correction or erasure.

Breaching these duties can attract a penalty of up to ₹10,000 under the Act.

14. Grievance Officer

If you are unhappy with how we handle your personal data or your rights request, contact our Grievance Officer. This is the point of contact required by section 13 of the DPDP Act.

Hareesh M H — Grievance Officer
Pixelbrahma Design Studio Private Limited
Kasturinagar, Bengaluru 560043, Karnataka, India
Phone: +91 97470 90058
Email: hareesh@pixelbrahma.com
We acknowledge grievances promptly and resolve them within 90 days.

15. Complaining to the Board

If we do not resolve your grievance, or you are not satisfied with the outcome, you may complain to the Data Protection Board of India. You are expected to have exhausted our grievance process first. The Board's contact and complaint procedure are published by the Ministry of Electronics and Information Technology, Government of India.

16. If you are outside India

PixMap is operated from India and this policy is written to Indian law. If you are in the EU/EEA or the United Kingdom you also retain the rights given to you by the GDPR and UK GDPR respectively, including the right to complain to your local supervisory authority. Write to us and we will honour those rights.

17. Changes to this policy

We may update this policy. We will change the "Last updated" date above and, where a change is material, tell you in the App or by email before it takes effect. We keep prior versions and can supply one on request.

18. Contact

Pixelbrahma Design Studio Private Limited
Kasturinagar, Bengaluru 560043, Karnataka, India
Phone: +91 97470 90058
Grievance Officer: Hareesh M H
Email: hello@pixelbrahma.com
Web: pixelbrahma.com

This policy is available in English. If you would like it in another language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide one.

---

Related: Terms of service · Delete your account and data · Support