Privacy

Who is responsible

Pevide Apps is the controller of the data described here. You can reach a person at pevidios@proton.me.

What the camera does

When you enter a plate, the app opens the front camera and uses Apple's face tracking to check three things: that there is a real face in front of the lens with real depth, that it responds to a challenge chosen at random in that moment, and that the response came from facial muscles rather than from moving the phone.

Each frame is read on your phone, used for that check, and released. The app then crops the face region, computes one average colour from it in linear light, and drops the frame. Nothing in the app holds an image after that, and no code path exists that could send one.

The app has no photo library access for reading, no upload endpoint for images, and no analytics that could carry one. If that changes, this policy changes first.

What leaves your phone

Exactly these fields, and nothing else:

A colour

Six hexadecimal digits, for example #7D5240. The average of your face, and the only thing derived from the image that survives.

An app integrity proof

An Apple App Attest assertion, proving the request came from a genuine, unmodified build of this app on a genuine Apple device.

A device token

An Apple DeviceCheck token, used to record that this phone has taken its one pixel.

Your language

The locale your phone is set to, so numbers and dates are formatted correctly.

A country

The region of your phone's own language setting — the one you chose in Settings — and not your location. The app never asks for location permission, and nothing here is derived from your network address.

What becomes public

Your number, your colour, the position it occupies in the plate, your country, and the moment the pixel was claimed, down to the second.

That is the work. It is visible on this site and inside the app, and it is meant to be looked at by strangers.

Nothing in that list identifies you. A colour is not a face, and roughly one person in every twenty thousand on a full plate will share yours.

How your phone is recognised, and how you are not

The rule of the work is one pixel per phone. Enforcing it needs a way to recognise a device that has already been here, and that is done with Apple's DeviceCheck, which stores two bits against the device on Apple's servers, and with a hash of the App Attest key.

That hash is a SHA-256 of the key identifier, salted with a secret held only on the server. The raw identifier is never stored. The hash cannot be reversed into a device, an Apple ID, a phone number, or a person, and it is useless outside this project.

There is no account, no login, no email required to participate, and no advertising identifier is read at any point.

Why one pixel per phone and not one per person

Because verifying that a person is unique would mean storing something that describes their face well enough to compare it against everyone else's — a biometric template. That is special category data under Article 9 of the GDPR, Article 11 of the LGPD, and the Illinois Biometric Information Privacy Act.

The work does not need it, so the work does not collect it. Someone with two iPhones can get two pixels. Nobody can get a thousand. That trade was made deliberately, and it is the reason this policy can be as short as it is.

The liveness check runs entirely on your phone and produces no template, nothing that could be compared to another person, and nothing that is transmitted. Explicit consent is asked for it anyway, on its own screen, before the camera opens — asking is cheaper than being wrong about whether a momentary check counts as special category data.

Age

You must be 16 or older. The app asks for a date of birth before anything else and stops there if the answer is under 16. The date is used for that check on the device and is not transmitted or stored.

Sixteen is above the highest age any EU member state may set under Article 8 of the GDPR, which is why it is a single global number instead of a table of countries.

Your email, if you give one

After you claim a pixel, the app offers to tell you when your plate seals. Giving an address is optional and skipping it changes nothing about your pixel.

If you give one, it is stored against your pixel number and used for that message and for one about the archive of your plate. It is never sold, never shared, and never used for anything else. You can have it deleted at any time by writing to the address at the end of this page.

If you buy the archive

When a plate seals, the high-resolution file of that plate can be bought on this site. Payment is handled by Stripe, which receives your card details directly — they never reach this project's servers. What is stored here is your email address, which plate you bought, and the payment reference.

No purchase is ever offered inside the app.

Who else touches this data

There is no advertising network, no analytics product, no session recorder, and no third-party script on this site. The pages you are reading load no code from anywhere else, by design.

Apple

App Attest and DeviceCheck. Apple confirms the app and device are genuine and is not told what the app is doing.

Supabase

Database, functions and file storage, hosted in the United States.

Vercel

Hosting for this site. Standard request logs, including network addresses, kept briefly.

Resend

Sends the two emails described above, and only to addresses that asked for them.

Stripe

Payment, only if you buy an archive file.

How long it is kept

The pixels are permanent. That is the point of the work: a plate seals and cannot be changed, removed, or reordered again, and you are told that before you consent.

Your email address is kept until you ask for it to be removed, or until the work is finished and the last message has been sent.

The device hash is kept for as long as the rule it enforces matters, which is the life of the project.

Your rights, and what can actually be done

If you are in the European Economic Area or the United Kingdom you have the rights of access, rectification, erasure, restriction, objection, and portability. Brazil's LGPD and California's CCPA give comparable rights. Write to the address below and you will get an answer from a person, not a form.

One of those rights deserves a straight answer rather than boilerplate. Erasure: your email address and the hash tying a pixel to your device can be deleted, and will be, on request. The pixel itself cannot be removed once its plate has sealed, and while a plate is open removing one would leave a hole in a count that ten thousand other people are watching.

What remains after an erasure request is a colour, a country, a timestamp and a number, with nothing left connecting them to a device or a person. At that point there is nothing there that can identify you, which is the outcome the right is for.

The legal basis is your consent for the capture and the colour, given on a screen of its own before the camera opens, and withdrawable by writing to us. The integrity and uniqueness checks rest on the legitimate interest of keeping a work about proving humanity from being filled by machines.

Where the data sits

On servers in the United States. If you are in the EEA or the UK, that is a transfer outside your region, made under the European Commission's standard contractual clauses as offered by the processors named above.

Changes

If this policy changes in a way that affects what is collected, the app will ask for consent again rather than quietly relying on the consent you already gave. The date at the top is the date of the version you are reading.

Contact

Pevide Apps — pevidios@proton.me. Write in English or Portuguese.