Last updated: June 11, 2026

Privacy Policy

This Privacy Policy explains how personal data is processed when you use the Coloryx app and the website playcoloryx.com. Coloryx is a pixel art puzzle app that lets users select their own images, create pixel puzzles from them, and color those puzzles.

1. Controller

The data controller under the GDPR is:

reimer.media e.K.
Michael Reimer
Detmolder Str. 11
33100 Paderborn
Germany

Email: support@playcoloryx.com
Legal provider information is available in the Legal Notice.

2. Summary

• The app uses Firebase/Google Cloud for sign-in, database, storage, app security, and backend infrastructure.
• Gallery previews and album selection happen locally on your device first. Only when you start generation is the selected image processed and uploaded.
• Custom images are processed temporarily for puzzle generation and are then deleted or removed by automatic deletion rules.
• In-app purchases are handled by Google Play or Apple and validated server-side so credits and Pro features can be credited correctly.
• Coloryx currently does not use advertising SDKs, third-party analytics, or tracking for advertising profiles.

3. Categories of data processed

Account and sign-in

Coloryx may use anonymous guest accounts and optional sign-in with Google or Apple. Depending on the sign-in provider, this may include a Firebase user ID, sign-in provider, display name, email address, and profile image URL.

Photos, image selection, and generation settings

The app accesses photos only with your operating-system permission. Album lists, previews, image IDs, file names, dimensions, and thumbnails are first read locally so you can select an image. Only when you start generation is the selected image sent to Coloryx as a resized or cropped copy. We also process settings such as crop, aspect ratio, pixel size, color count, style, and the Enhance option.

During upload, technical image and upload data may be processed, for example content type, file size, internal image ID, upload path, download URL, and whether the crop was already applied. Coloryx does not request camera access and does not read location data from images.

Generated content and progress

We may process generated pixel puzzles, palettes, cell and color data, puzzle titles, difficulty, progress, colored cells, completion status, timestamps, and related generation job data.

Purchases, credits, and entitlements

For in-app purchases, Coloryx processes product ID, store platform, purchase ID or transaction ID, original transaction ID, hashed purchase tokens, subscription expiry dates, validation status, credit grants, credit ledger entries, Pro status, and revocation or refund information. Coloryx does not process full payment details such as card or bank data; those are handled by the relevant app store.

Technical, security, and usage data

During operation of the app and website, technical data such as IP address, request time, requested URL, HTTP status, user agent, Firebase ID token, App Check signals, request metadata, rate-limit counters, error codes, and server-side logs may be processed. This is used for operation, security, abuse prevention, and error analysis.

Support and privacy requests

If you contact us, we process the data you provide, such as email address, message, app version, device platform, purchase references, and other information needed to handle your request.

4. Purposes and legal bases

• Providing the app, account features, puzzle generation, progress storage, and synchronization: Art. 6(1)(b) GDPR.
• Processing the image you select to create a custom pixel puzzle: Art. 6(1)(b) GDPR. Device photo permission is additionally controlled by your operating system.
• In-app purchases, credit management, store validation, restore flow, and subscription status: Art. 6(1)(b) GDPR; for tax, accounting, or legal obligations Art. 6(1)(c) GDPR.
• Security, App Check, access control, abuse and fraud prevention, rate limits, error analysis, and stability: Art. 6(1)(f) GDPR.
• Support, privacy requests, and account deletion: Art. 6(1)(b), (c), and/or (f) GDPR depending on the request.
• Website operation and delivery of playcoloryx.com: Art. 6(1)(f) GDPR.

5. Image processing in detail

When you create a custom puzzle, the selected image is resized or cropped in the app before upload. The copy is stored in Firebase Storage and used by the backend for generation. For AI-assisted preparation and image transformation, a prepared image copy may be sent to fal.ai. The app does not contact fal.ai directly; the request is made server-side through the Coloryx backend.

The backend worker is currently configured for the Nano Banana 2 Edit model provided by fal.ai: fal-ai/nano-banana-2/edit. fal.ai receives the prepared image URL, a server-generated controlled prompt/system prompt, and technical parameters such as aspect ratio, output format, resolution, safety setting, and number of images to generate. The app does not send free-form user prompts to fal.ai; the values come from structured generation settings. Web search is disabled in the Coloryx request to fal.ai ( enable_web_search: false).

fal.ai does not create the final numbered pixel puzzle. After the AI-assisted preparation, the Coloryx backend pixelizer creates the final puzzle with target grid, color palette, cell data, and numbers.

Temporary source image files are deleted after successful processing. Additional automatic deletion rules are intended for temporary uploads. For failed generations, source image references may be needed briefly for retry, refund, error analysis, and abuse prevention.

6. Photo and device permissions

On Android, Coloryx uses image/media permissions for selecting images from the gallery. On iOS, Coloryx uses the Photos library permission. You can restrict or revoke access in system settings. Coloryx does not request camera access and does not read location data from images.

7. Website, cookies, and language

The website playcoloryx.com is served as a static website via Vercel. When the website is accessed, technically necessary access data is processed, especially IP address, time, URL, user agent, and technical response data. For language selection, country or language signals such as edge location or browser language may be used so visitors see appropriate English or German pages. Coloryx does not set its own analytics or marketing cookies on this website.

8. Recipients and service providers

• Google Firebase and Google Cloud: authentication, Firestore database, Firebase Storage, App Check, Cloud Run, Cloud Tasks, and backend infrastructure.
• Google Play Billing and Apple App Store: processing, validation, restoration, and status changes for in-app purchases.
• fal.ai: AI-assisted preparation and processing of images for puzzle generation, currently via fal-ai/nano-banana-2/edit.
• Vercel: hosting and delivery of the website.
• Cloudflare R2: optional fallback storage for source image uploads, if technically used.
• Email/support infrastructure: handling support and privacy requests.

Service providers are used only where required for the purposes described above. Where required, processing is based on data processing agreements or comparable privacy arrangements.

9. International transfers

Some providers may process data outside the European Union or the European Economic Area, especially in the United States. Where data is transferred to third countries, this is done based on appropriate safeguards, such as EU Standard Contractual Clauses, adequacy decisions including the EU-US Data Privacy Framework, or other mechanisms permitted under the GDPR.

10. Data security

Coloryx uses technical and organizational measures to protect data against unauthorized access, loss, misuse, and alteration. This includes HTTPS/TLS, Firebase Authentication, Firebase Security Rules, App Check, server-side access controls, rate limits, role-based access to production systems, and storing API keys as server-side secrets instead of inside the app.

11. Retention

• Account data: for as long as your account exists or processing is needed for app functionality, security, records, or legal obligations.
• Source images: generally only short-term for generation, retry, error analysis, and abuse prevention.
• Generated puzzles and progress: until deleted by you or until account/data deletion, unless retention reasons apply.
• Purchase, entitlement, and ledger data: for as long as needed for purchase records, restoration, fraud prevention, support, store rules, and statutory retention obligations. Legal retention periods may regularly be six to ten years.
• Support requests and technical logs: for as long as needed for handling, security, error analysis, and abuse prevention.

12. Your rights

Under the GDPR, you may have rights of access, rectification, deletion, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent with effect for the future.

To exercise your rights, contact support@playcoloryx.com . Account and data deletion instructions are available on the account deletion page .

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. For our registered office, the competent authority is generally the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia:
www.ldi.nrw.de

14. No automated decision-making

Coloryx does not use automated decision-making within the meaning of Art. 22 GDPR that has legal effects concerning you or similarly significantly affects you.

15. Children and teenagers

Coloryx is not directed at children under 13. The app is intended for teenagers and adults. If you cannot validly consent to digital services under applicable law, you may use Coloryx only with parental or guardian consent.

16. Changes to this Privacy Policy

We may update this Privacy Policy if the app, website, service providers, legal requirements, or data processing practices change. The date at the top of this page shows the current version.