Privacy Policy

Effective date: May 16, 2026

Pickmix ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, browser extension, web app, AI features, billing, and related services (collectively, the "Service"). We aim to collect and process information only as reasonably needed to provide, secure, measure, support, and improve the Service.

Your content belongs to you. Pickmix stores and processes content you choose to save, upload, generate, or edit so we can provide syncing, search, previews, AI analysis, agent workflows, image generation, and cross-device access. We do not sell your personal information, do not use your private content for advertising profiles, and do not use your private content to train Pickmix foundation models or third-party foundation models.

1. Information We Collect

Account and Billing Information. When you create an account, we collect information such as your name, email address, profile picture, authentication provider details, plan, subscription status, billing status, and related account settings. Payment card details are processed by our payment providers; Pickmix does not intentionally store full payment card numbers.

User Content. We collect and store content you choose to save, upload, generate, edit, or import through the Service. This may include links, notes, PDFs, images, markdown or text files, uploaded files, annotations, tags, Space or workspace structure, chats, prompts, model responses, and other materials you provide or create.

Saved Web and External Content. When you save webpages, media links, YouTube links, or other external sources, Pickmix may store the URL, title, webpage metadata, excerpts, thumbnails, cover images, available transcripts, user notes, AI-generated summaries, analysis results, source chunks, citations, and related indexing data. Pickmix does not download or store the original YouTube video file itself.

Generated and Derived Content. To provide search, previews, AI analysis, agent workflows, and generated media features, we may create and store derived data such as summaries, knowledge atoms, OCR results, transcripts, embeddings, indexes, previews, cached processing results, tool outputs, and AI image generation results.

Limited Usage and Product Analytics Data. When analytics is enabled, we collect limited information about how the Service is used, such as pages visited, buttons clicked, feature usage, event timestamps, referring pages, browser type, operating system, approximate device type, anonymous identifiers, internal user or account identifiers, plan status, and high-level event properties such as content type, source type, counts, duration, status, and error codes.

Reliability, Error, and Performance Data. We collect diagnostic information needed to detect crashes, errors, abuse, slow requests, and service reliability issues. This may include error messages, stack traces, release version, browser, operating system, runtime information, request route, URL path, query parameters after redaction, and IP address where required for security, abuse prevention, or service diagnostics.

Cookies and Similar Technologies. We use cookies, local storage, and similar technologies to maintain your session, remember your preferences (such as theme settings), prevent abuse, measure website and product usage, and remember analytics preferences. You can control cookies through your browser settings and the controls we provide where available.

What We Do Not Collect for Analytics. Analytics events are designed not to include saved content, full URLs, search queries, prompts, AI responses, file contents, file names, payment card numbers, or other sensitive content. This analytics boundary does not mean Pickmix does not store content; it means optional product analytics should not contain the content itself.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Save, sync, index, search, preview, summarize, analyze, generate, retrieve, and organize Your Content across devices;
• Provide AI-powered features such as tagging, summarization, search, agent workflows, content extraction, chat, and image generation;
• Authenticate your identity and manage your account;
• Communicate with you about updates, security alerts, and support;
• Analyze limited usage trends to improve onboarding, reliability, performance, and feature quality;
• Detect, prevent, and address fraud, abuse, or technical issues;
• Comply with legal obligations.

3. Content Ownership, AI Processing, and Model Training

You retain the rights you have in Your Content. By using the Service, you give Pickmix the permissions needed to host, store, process, transform, display, index, transmit, and otherwise use Your Content as reasonably necessary to provide, maintain, secure, support, personalize, and improve the Service.

Some Pickmix features use artificial intelligence to summarize, search, extract, transform, generate, or answer questions about Your Content. To provide these features, relevant content and context may be sent to AI service providers that process the data on our behalf and only for the purpose of completing the request or providing the Service.

Our current primary AI provider is OpenAI. We may add, replace, or remove AI providers as the Service evolves. When we use third-party AI providers, we require them to process user content under appropriate restrictions and not use your private content to train their foundation models. We do not use your private content to train Pickmix foundation models or third-party foundation models.

We may retain limited operational records related to AI requests where reasonably necessary for security, abuse prevention, billing, debugging, service reliability, dispute handling, legal compliance, or to provide user-visible product history.

4. How We Share Your Information

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers. We engage trusted third-party providers who process data on our behalf under contractual obligations, including cloud hosting, storage, authentication, payment processing, AI model providers, product analytics, error monitoring, performance monitoring, email, and support providers.
• AI Providers. We currently use OpenAI as a primary AI provider. We may use additional or replacement AI providers as the Service evolves. Relevant content and context may be shared with these providers only as reasonably necessary to provide requested AI features or operate the Service.
• Product Analytics. We use PostHog to understand limited website and product usage, conversion funnels, and feature adoption. PostHog processes analytics data on our behalf. We configure analytics events to avoid collecting User Content and other sensitive fields listed in this Policy.
• Error and Performance Monitoring. We use Sentry to identify errors, crashes, slow requests, and reliability issues. Sentry processes diagnostic data on our behalf. We configure Sentry to avoid collecting default personal information where possible and to redact sensitive request data such as authentication tokens, private query parameters, headers, and user-generated content.
• Legal Requirements. We may disclose information if required by law, regulation, legal process, or governmental request.
• Safety and Rights. We may disclose information to protect the rights, property, or safety of Pickmix, our users, or the public.
• Business Transfers. In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

Additional information about major service providers and international transfers appears in Section 8. Provider names, countries, and processing details may change as we maintain the Service; when a material change requires notice or consent under applicable law, we will provide it.

5. Analytics, Consent, and Controls

Some analytics is optional. Where required by law or where our product controls make it available, you can decline or disable product analytics. If analytics is disabled, we will stop sending new optional behavior analytics events from your browser or app, while still processing strictly necessary information for account security, payments, fraud prevention, service operation, and reliability.

We do not currently use session replay recordings to watch how users interact with Pickmix. If we introduce session replay or similar recording technology, we will update this Policy, provide appropriate notice or consent where required, and configure masking and redaction controls to protect sensitive content.

You may also contact us at [email protected] to request deletion of analytics data associated with your account where technically feasible and legally required.

6. Data Retention

We retain account information, User Content, generated content, derived content, indexes, and operational records for as long as reasonably necessary to provide the Service, maintain security and reliability, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and support billing or audit needs.

When you delete individual content, we remove it from active product systems within a reasonable period and stop using it to provide product features, except where retention is necessary for security, abuse prevention, billing, legal compliance, dispute handling, or backup integrity.

When you delete your account, we delete or anonymize associated business data in active systems within 30 days, unless retention is required for legal, security, billing, audit, dispute-resolution, or fraud-prevention purposes. Backups and logs may retain deleted data for up to 90 days before they expire through our normal retention cycles.

7. Data Security

We use industry-standard safeguards designed to protect data in transit and at rest. These safeguards may include encryption, access controls, logging, monitoring, least-privilege access, vendor security controls, and operational review. Security controls may evolve as our infrastructure and service providers change. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. International Data Transfers and Service Providers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. Where required, we use Standard Contractual Clauses (SCCs) approved by the European Commission, data processing agreements, vendor security commitments, transfer impact review, or other appropriate safeguards to protect your data.

The following table summarizes important categories of international processing. It is intended to improve transparency and does not limit the service provider categories described above.

International transfers may occur when you use the Service, save or process content, request an AI feature, sign in, pay for a subscription, contact support, or when background systems sync, secure, monitor, or back up the Service. Where applicable law gives you the right to refuse an international transfer, you may contact us at [email protected]; refusing a transfer may prevent us from providing some or all of the Service.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate or incomplete data.
• Deletion. Request deletion of your personal data, subject to legal retention requirements.
• Portability. Request a machine-readable copy of your data.
• Restriction. Request that we restrict processing of your data in certain circumstances.
• Objection. Object to processing of your data for certain purposes, including direct marketing.
• Withdrawal of Consent. Where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law).

10. Korean Users (PIPA)

If you are located in the Republic of Korea, the Personal Information Protection Act (PIPA) and related rules may apply to our processing of your personal information. You may request access, correction, deletion, suspension of processing, withdrawal of consent where processing is based on consent, and other rights available under applicable Korean law by contacting [email protected].

Pickmix processes personal information for the purposes described in this Policy, including account operation, content storage and retrieval, AI processing, service security, billing, analytics where permitted, support, legal compliance, and dispute handling. We retain personal information for the periods described in Section 6 unless a longer period is required or permitted for legal, accounting, security, fraud-prevention, dispute, backup, or audit purposes.

For Korean users, the international transfer and service provider summary in Section 8 is intended to describe the categories of recipients, countries, transferred items, transfer purposes, transfer timing and method, and retention practices. If a specific transfer or outsourcing arrangement requires separate notice, consent, or an opt-out opportunity under Korean law, we will provide it in the manner required by law. We do not knowingly collect personal information from children under 14 in Korea without the consent of a legal representative.

11. European Economic Area, UK, and Swiss Users (GDPR)

If you are located in the EEA, UK, or Switzerland, our legal bases for processing your personal data are: (a) performance of our contract with you (providing the Service); (b) our legitimate interests (security, fraud prevention, service reliability, and improvement of the Service); (c) your consent for optional analytics, cookies, or similar technologies where required; and (d) compliance with legal obligations. You may withdraw consent where processing is based on consent, and you have the right to lodge a complaint with your local data protection authority.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; opt out of the sale or sharing of personal information (we do not sell personal information); and not be discriminated against for exercising your rights. To submit a request, contact us at [email protected].

13. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13, or from children under 14 in Korea without the consent of a legal representative. If we become aware that we have collected such data without required consent, we will take steps to delete it promptly. If you believe a child has provided us with personal information in violation of this Policy, please contact us at [email protected].

14. Third-Party Services and External Content

The Service may contain links to or integrate with third-party services (e.g., YouTube, Google Authentication, OpenAI, PostHog, Sentry, payment providers, and hosting or storage providers). This Privacy Policy does not apply to third-party services when you access them directly. We encourage you to review the privacy policies of any third-party services you access through Pickmix.

You are responsible for the content you save, upload, process, generate, or share through Pickmix and for ensuring that you have the rights or permissions necessary to use that content. Pickmix provides tools for personal knowledge management, search, organization, and AI-assisted analysis. You should not use Pickmix to store, process, generate, or distribute content in a way that violates applicable law or third-party rights.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective date" above. For significant changes, we will provide additional notice (such as email notification). Where applicable law requires separate consent or a different notice method for a material change, we will follow that requirement. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy where permitted by law.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Pickmix
Email: [email protected]