Privacy Policy

• Profile you provide — your display name, chosen avatar, and optionally your Instagram handle when you join an event.
• Event content — events you create or join, RSVPs and plus-ones, polls and votes, who-brings-what items, and games/scores.
• Live location (only when you opt in) — see §3; it is streamed, never stored.
• Technical data — basic device/browser info and logs needed to run and secure the service (e.g. IP address, handled by our hosting provider).
• Instagram data (only if the IG invite feature is used)— if an organizer runs our Instagram comment→invite flow, we process the public comment that triggers it (the commenter's ID and comment text) solely to send the requested invite link. We do not read private messages or group chats.

• Run the event you joined — live map, polls, who-brings-what, games — to perform the service you requested (contract).
• Keep the service secure and prevent abuse — legitimate interests.
• Share your live location with event members — only with your explicit consent (opt-in), withdrawable anytime.

We do not use your data for advertising or profiling, and we do not sell it.

• It is off by default and shared only when you opt in, during an event.
• It is streamed live and never written to our database — there is no location history.
• You can stop anytime (Ghost mode); when you stop or the event ends, it's gone.
• We will never sell, broker, or share your location with advertisers or data brokers.

We keep a sign-in token plus your chosen name and avatar in your browser's local storage so you stay recognized within an event. We do not use third-party advertising or tracking cookies. No passwords.

We don't sell your data. Event content is visible to the other members of that event. We rely on these providers to run PIXIE:

• Supabase — database, auth tokens, and realtime.
• Mapbox — map rendering and geocoding.
• Vercel — application hosting.
• Meta/Instagram — only if the IG invite feature is used.

Your data may be processed on servers outside your country; where required, transfers rely on appropriate safeguards (e.g. standard contractual clauses).

We keep event and profile data while an event is active and for a reasonable period afterward (so recaps work), then delete or anonymize it. Live location is never retained (§3). You can request deletion at any time (§7).

Depending on where you live (e.g. EEA/UK under GDPR, California under CCPA/CPRA), you have rights to:

• Access a copy of your data, correct it, or delete it.
• Restrict or object to processing, and port your data.
• Withdraw consent (e.g. stop location sharing) at any time.
• Not be discriminated against for exercising your rights.

We do notsell or "share" personal information as defined by CCPA/CPRA. To exercise a right, email hello@pixie.events, or ask the event admin to remove you (which deletes your membership and entries). EEA/UK users may also complain to their local data protection authority.

We use signed capability tokens (no passwords), encrypted connections (HTTPS), and server-side access controls, and we minimize what we hold (e.g. not storing location). No system is perfectly secure.

PIXIE is not directed to children under 13 (or the minimum digital-consent age in your country, e.g. 16 in parts of the EEA). We do not knowingly collect their data; if you believe a child has provided it, contact us and we will delete it.

PIXIE uses the Instagram Platform API only for the optional comment→invite feature, in line with Meta's Platform Terms. PIXIE is not affiliated with, endorsed, or sponsored by Instagram or Meta.

We may update this policy; we will change the date above and, for material changes, take reasonable steps to notify you. Continued use means you accept the updated policy.