ChocoPix privacy policy

Version of November 5, 2026, for the beta of the Android app.

In short

ChocoPix is a photo editor that works on your phone. Your photos and edits stay on your phone: they are never sent. There is no account and no advertising. The app talks to our server to receive content (packs, settings) and to give a code to the statuses you share; if you agree, it also sends us anonymous statistics. When the app runs into an error, it may send us a crash report, without your photos and without anything that identifies you; you can turn this off.

What the app uses, and why

• The photos you choose: your phone’s picker only gives the app the photos you tap. ChocoPix keeps a copy in its private storage so it can edit them without ever changing the original.
• The camera: to take a photo from the app. The camera image is only saved when you press the shutter. The microphone is never used.
• Saving to the gallery: when you tap “Gallery”, the image is saved in the “ChocoPix” album. A photo keeps the shooting information of the original (device, date), without the GPS location; a status keeps none.
• Sharing: when you tap “Share”, your phone shows the apps you can send the image to. You choose; the chosen app then applies its own rules.
• Your WhatsApp sticker pack: when you tap “Add to WhatsApp”, WhatsApp reads the stickers in your pack on your phone. Only WhatsApp can read them; ChocoPix doesn’t send them anywhere.

What is analyzed, and where

• “Make it shine” and the “For this photo” row analyze your photo on your phone (light, colors, presence of a face or a sky). Nothing is sent.
• “AI cutout” uses ML Kit, a Google tool provided by Google Play services. The image is analyzed on your phone and is never sent. The cut-out model is downloaded by Google Play services the first time.
• ML Kit sends technical diagnostic data to Google: phone model and version, app version, device and installation identifiers, performance measurements, error codes. According to Google, this data is used for ML Kit diagnostics and usage analytics, is encrypted in transit and is not shared with third parties. It does not contain your images.

What the app sends, and what it does not

Our server, chocopix.app, is hosted by DigitalOcean in Amsterdam (Netherlands, European Union). It does not keep your IP address: it only uses it, for one hour at most, to limit how much a single device can send. Here is what the app sends to it:

• Content: the app asks for the list of packs, the packs you install and its settings (features turned on, home trends), at most every 6 hours. It only sends the country of its content.
• “Redo this status”: when you share a status, or save it with the watermark, its layout goes to our server to get a code (CPX-…): the template, its texts, the stickers, the preset and the style. Never the photo or its adjustments. The template’s fill-in texts (such as [Prénom]) and its dates are not sent: whoever redoes the status writes their own. Anyone who has the code can redo this status with their own photo and see these texts: do not write anything private in them.
• Anonymous statistics, only if you agree (the app asks you once; you can change your mind in Profile → Privacy → “Anonymous statistics”). Once a day, the app sends the summary of one day: number of app openings, photos opened, stickers and texts placed, shares (and whether they go to WhatsApp), saves to the gallery, the packs used, start-up time and time to a first share, in ranges; with the install day, the system (Android or iOS), the app version, the content country and the language. No identifier, neither yours nor your phone’s.

When the app runs into an error, it may send us a crash report so we can fix it: the error message and where in the code it happened, the app version, your phone model, its Android or iOS version, its memory and its language. This report contains neither your photos, nor your name, nor your phone’s name, nor any identifier of your phone or your installation, and your IP address is not recorded. It goes through Sentry, an error tracking service acting on our behalf, with servers in the European Union. You can turn these reports off at any time: Profile → Privacy → “Crash reports”.

Apart from that, ChocoPix sends nothing over the Internet by itself: no account, no online backup, no advertising. Your posters are made on your phone: their description and photos are not sent. Android’s automatic backup is turned off for ChocoPix: your photos are not sent to your Google Drive.

How long

Everything you create stays in the app until you delete it, or uninstall the app, which erases everything. Files prepared for sharing are deleted after one hour. Photos saved to your gallery stay in your gallery.

On our server, the layout of a shared status is kept as long as its code can be used, or until you ask us to delete it. Anonymous statistics are deleted after 25 months. The server’s backup copies keep this data for 4 more weeks at most. Crash reports are deleted after 90 days at most.

Age

ChocoPix is meant for people aged 16 and over.

Your rights

Your photos and creations are on your phone, and you can delete them at any time. To have the layout of a shared status deleted, send us its code. Statistics and crash reports contain nothing that tells us they come from you: we therefore cannot find them for you, but you can turn them off at any time. For any question about this policy, write to us: contact@chocopix.app.

We comply with the applicable personal data protection laws, including Côte d’Ivoire’s law no. 2013-450 of June 19, 2013 and, for people in the European Union, the GDPR.

Changes

If a future version adds an account, online backup, advertising or online artificial intelligence, this policy will be updated beforehand, and the app will tell you.