Privacy policy

This policy explains what data stateofpixel ("we", "us") collects when you use stateofpixel.com, the GitHub App and the stateofpixel CLI, and what we do with it. Questions go to hello@stateofpixel.com.

What we collect

When you sign in with GitHub:

• Your email address, name and avatar URL, if the provider shares them.
• The time you last used the app.

When you connect your GitHub account:

• Your GitHub user ID and login.
• A GitHub access token and the refresh token that renews it, stored encrypted and used to check which repositories you can read, review or administer.
• Your permission on each repository and your role in each account, as GitHub reports them, to decide what you can see and do.

When you install the GitHub App:

• The login and ID of the GitHub account or organization.
• For each repository you select: its ID, owner, name, visibility and default branch.

When your CI uploads a build:

• The PNG screenshots, their names and SHA-256 hashes, and the diff results your runner computed.
• Git metadata: commit SHA, commit message, branch, base branch, pull request number and recent ancestor commits.
• The CI provider and the URL of the CI run.
• Metadata your tests attach to snapshots in .meta.json files.

When you buy a paid plan:

• The customer and subscription IDs from our payment provider, the plan, the billing period and when it ends. Card details go to the payment provider and never reach us.

We never receive or run your source code. Screenshots show whatever your pages or components render, so do not capture pages that show data you are not allowed to share with us.

When you review a build:

• Each approve, reject and undo, and who made it.
• Each comment you leave on a snapshot, and who left it.

Cookies and browser storage

Signing in sets two cookies, nf_jwt and nf_refresh, that keep you signed in. The site also keeps your session, your theme choice and the page to return to after sign-in in your browser's storage. If you allow cookies in the cookie banner, Google Ads sets cookies such as _gcl_au that link a sign-up to the ad you clicked. If you decline, it sets none. We keep your choice in your browser's storage.

Change your cookie choice

Analytics

We use Umami, which we host ourselves, to count page views and clicks on some buttons, such as sign in, copy code and approve. Umami does not use cookies. It records the page, the page you came from, your browser, operating system, device type, screen size, language, country and page load times. Before anything is sent, we replace account names, repository names, build numbers and snapshot names in page addresses with placeholders. We keep search parameters on public pages and leave them out on pages behind sign-in.

Advertising

We use Google Ads to measure which of our ads bring sign-ups. When you open a public page, such as the home page, the docs or a comparison, the site tells Google Ads which page it was. When you sign up, it tells Google Ads that a sign-up happened. We do not send your name, email address or GitHub account, and pages behind sign-in are not reported. If you decline cookies, Google still learns about these visits and sign-ups, without cookies.

How we use it

• To run the service: store baselines, compare builds and show them.
• To set commit statuses on your commits in GitHub.
• To check that you are allowed to see or review a project.
• To reply when you contact us.

We do not sell your data. Apart from the sign-up measurement above, we do not use it for advertising.

Who processes it

We use these providers to run stateofpixel:

• GitHub, for sign-in, the GitHub App and commit statuses.
• Google, for sign-in and Google Ads.
• Dodo Payments, to take payments for paid plans.
• Netlify, to host the website, run sign-in and the database, and store screenshots.

These providers may process data in other countries.

How long we keep it

• Builds of pull requests and other branches are deleted after the retention period set in the project settings, 60 days by default, counted from when the pull request closes or the branch gets no new builds.
• Screenshots and diffs that no build uses any more are deleted.
• Deleting a project in its settings deletes its builds, and the images that no other project uses.
• Uninstalling the GitHub App archives your projects. Their data stays until an account owner deletes it on the Usage page, or you ask us to.
• GitHub webhook delivery records are deleted after 7 days.

Your choices

You can ask for a copy of your data, a correction or its deletion by writing to hello@stateofpixel.com. We will delete your user and account data on request, including your sign-in record. You can also revoke the app's access at any time in your GitHub settings.

Security

Data moves over HTTPS. Project tokens are stored as hashes, so we cannot show them again after you create them. GitHub tokens are stored encrypted. Access to a project follows your permissions on its GitHub repository.

Children

stateofpixel is not meant for anyone under 18, and we do not knowingly collect their data.

Changes

When we change this policy, we update the date at the top of this page. For changes that affect how we use your data, we will also tell you by email or on the site before they apply. See also the terms and the refund policy.