Security & privacy at PixelPrototypes

• All project data is gated behind authenticated accounts; public pages such as the homepage contain only marketing content and never expose user data.
• Email/password sign-in is provided through our hosting platform's managed authentication.
• Administrative actions are restricted to users with an explicit admin role stored server-side.
• Shared prototype links can optionally require a password and may be set to expire.

• Project data, comments and uploaded screen images are stored in a managed Postgres database and private object storage.
• Row-level security policies restrict every project record to its owner and invited members.
• Uploaded images are served through short-lived signed URLs rather than public links.
• Data is transmitted over HTTPS.

PixelPrototypes relies on a managed backend platform for authentication, database and storage, and on Google Gemini (Google AI) for the optional "Summarize comments" AI feature. Comment text from a screen is sent to Google Gemini only when a user explicitly triggers a summary.

Our hosting platform is responsible for infrastructure-level security of the services we use. The PixelPrototypes team is responsible for application logic, access policies and the content shown in the product. Customers are responsible for safeguarding their account credentials and for the content they upload to their projects.

If you believe you have found a security vulnerability, please contact the project owner through your usual support channel so we can investigate. Please do not share details publicly until the issue has been addressed.