Who We Are
Vixora AI Photo Editor (“Vixora”, “the app”) is developed and operated by Samet Buldanlıoğlu, an independent developer working under the BuldAI Labs brand name (“we”, “us”, “our”). The Android application is published under the package name com.vixora.aieditor.
Samet Buldanlıoğlu is the data controller for the personal data described in this policy. BuldAI Labs is a brand name, not a registered company.
This policy covers the Vixora mobile app, the processing service it talks to at api.vixoraeditor.com, and this website. If you have a question about anything below, write to us at vixoraeditorai@gmail.com — that address is the contact route for every request, including formal data protection requests.
Information We Collect
Vixora collects only what the features you use actually require. The categories below are the complete set.
| Category | What it includes | Why |
|---|---|---|
| Account | Email address, display name, optional profile picture, sign-in method, account identifier, verification state | To create your account and keep it yours |
| Photos and results | Images you choose to send for AI processing and the results produced from them | To run the specific tool you selected |
| Projects | Project entries, uploaded image records, edited image records, export history | To let you return to earlier work |
| Credits and usage | Plan, credit balances, daily and monthly counters, rewarded-ad counters, per-transaction credit records | To operate the credit system and its limits |
| Purchases | Google Play purchase tokens, product identifiers, subscription state and lifecycle events | To verify and activate what you bought |
| Installation identifier | A random identifier generated on your device | Device-level free-credit limits and abuse prevention |
| Advertising | Handled by Google AdMob on the free plan | To fund the free tier |
| Technical logs | Request, error and job-timing records | To keep the service running and secure |
Vixora does not ask for your phone number, postal address, contact list or payment card details.
If a photo you send for processing carries embedded metadata — for example capture time, or location if your camera saved it — that metadata is part of the file you send. Vixora does not read it to build a profile of you.
Account Information
When you register with an email address we store that address, the display name you enter, an account identifier, the sign-in method you used, and whether your email has been verified. If you set a profile picture, the app stores a reference to it.
Passwords are never stored in readable form. Only a cryptographic hash is kept, which cannot be turned back into your password.
Email verification and password resets use a six-digit one-time code sent to your address. Codes expire and are rate-limited.
Vixora also supports a guest mode. A guest session has no email address attached to it.
Google and Facebook Sign-In
If you sign in with Google or Facebook, that provider authenticates you and returns basic profile information to Vixora — typically your email address, your name and, where available, your profile picture. We record which provider you used so the right sign-in method is offered next time.
We never receive your Google or Facebook password.
In Vixora's build configuration, the Facebook SDK's automatic app-event logging and advertiser-identifier collection are both switched off.
Deleting your Google or Facebook account does not automatically delete your Vixora account, and deleting your Vixora account does not affect your Google or Facebook account.
Photos and User Content
Vixora only opens the photos you explicitly pick from your gallery or capture with the camera. It does not scan or index your gallery.
Editing tools that do not use AI — filters, adjustments, text, stickers, collage, drawing, blur, watermark and the other creative tools — run on your device.
AI tools cannot run on your device. To use one, the image you selected is sent to the Vixora processing service so that tool can produce a result. You choose which image is sent, and when, by starting the tool.
You keep ownership of your photos and of the results Vixora produces from them. We do not sell your content, and we do not use it for advertising.
AI Processing
Each AI operation creates a job record on the processing service. A job record holds the tool name, references to the input and output files, the job's status, how long it took, its queue priority, and a key used to stop a network retry from charging you twice.
AI tools require an internet connection. Results depend on the source photo — Vixora does not guarantee a particular outcome.
Generated Results
The image a tool produces is stored as a file on the processing service so the app can download it back to your device.
Results belonging to a signed-in account are written to a private storage area that is not publicly served; the app must be authenticated to retrieve them.
Jobs that are not tied to a signed-in account — for example free jobs run before you register — are written to a static area addressed by a randomly generated file name, and anonymous callers receive a one-off token that lets them poll only their own job.
Result files are removed by a maintenance routine that deletes files older than a retention window. We do not publish that window as a fixed guarantee, because it is an operational setting rather than a contractual commitment.
Installation and Device Identifiers
On first launch the app generates a random installation identifier and stores it locally. It is sent with API requests so the service can apply free-credit limits per device.
This identifier is randomly generated. It is not derived from your hardware, your advertising ID, your IMEI, or any other device fingerprint, and it is not shared with third parties.
Clearing the app's data or reinstalling the app produces a new identifier.
Abuse and Fraud Prevention
Free credits — the one-time welcome bonus in particular — would be trivially farmable if you could keep creating accounts. To decide whether the bonus is due, we check two identities, each stored only as a one-way keyed hash: your installation identifier and your normalised email address. Each identity records whether the bonus has already been claimed, which is what makes it once per device and once per email address.
Email addresses are normalised before hashing, so variations of the same address (for example dots or +tags in a Gmail address) resolve to one identity.
When an account is deleted we also keep a small marker against the email identity: the time the welcome bonus was consumed, the time the account was deleted, and the date until which daily free credits are withheld. Neither hash can be reversed back into your email address or your installation identifier, and the marker contains no other personal information.
Credits and Usage Information
To run the credit system we store your current plan, your credit balances split by source (daily free, one-time welcome bonus, rewarded-ad credits, purchased credits), the counters that enforce daily and monthly limits, and a record of each credit movement.
These records let you see where your credits went, and let us correct a balance if an operation fails.
Google Play Billing
All payments run through Google Play Billing. Vixora never sees or stores your card number, bank details or billing address — those stay with Google.
What we do receive and store is the purchase token, the product identifier, the state of the purchase or subscription and its lifecycle events. We use these to verify the purchase directly with Google and to grant the credits or plan you paid for.
Advertising and Google AdMob
On the free plan Vixora shows ads through Google AdMob: an interstitial ad after saving an edit, and optional rewarded ads you can choose to watch in exchange for extra credits. Rewarded ads are never forced — you decide whether to watch one.
Ads are not shown on the Pro Lite and Pro plans.
AdMob is operated by Google, and Google processes device and advertising information under its own policies when an ad is requested or shown. You can read how Google uses this data at policies.google.com/technologies/partner-sites, and you can reset or delete your advertising identifier in your Android settings.
Technical and Security Logs
The processing service keeps operational records: request and error entries, job states and durations, and the records needed to detect abuse of the credit and billing systems.
These logs exist to keep the service available, correct and secure. They are not used to build advertising or behavioural profiles.
How We Use Information
We use the information described above only to:
- create your account, sign you in and keep the account secure;
- run the specific editing operation you asked for and return the result;
- store your projects so you can come back to them;
- operate credits, plans, daily limits and rewarded ads;
- verify purchases and activate subscriptions and credit packs;
- prevent abuse of free credits and of the billing system;
- keep the service running, diagnose failures and improve reliability;
- send you service email such as verification codes, password resets and account-deletion confirmations;
- comply with legal obligations.
We do not sell your personal information, and we do not share it with data brokers.
Service Providers
Vixora relies on a small set of providers, each for a specific job:
- Google — Google Play Billing for purchases, Google Sign-In for authentication, Google AdMob for advertising on the free plan;
- Meta — Facebook Login for authentication, when you choose it;
- Our hosting provider — the servers that run the processing service and store job files;
- An email delivery provider — to send verification codes and account notifications.
These providers process data on our instructions or, in the case of Google and Meta sign-in and advertising, under their own published policies.
Data Retention
How long something is kept depends on what it is:
- Account, projects and credit records — kept while your account exists, and removed when you delete it.
- Uploaded images and AI results — removed when you delete your account, and otherwise cleared by a maintenance routine that removes older result files.
- Purchase and subscription records — kept while the account exists; some purchase evidence may be retained where financial or legal record-keeping requires it.
- Anti-abuse markers — retained after deletion, in the hashed form described above.
- Technical logs — kept for a limited operational period and then rotated out.
We deliberately do not publish exact retention periods in days. Stating a fixed number we could not guarantee in every case would be misleading. If you need to know the status of a specific piece of data, contact us and we will tell you.
Account and Data Deletion
You can delete your Vixora account from inside the app, without emailing anyone. Open Profile → Settings → Delete My Data, confirm on the warning screen, and the deletion runs immediately.
Deleting your account removes your account record, your projects, the images and results linked to them, your credit profile and credit history, and your subscription and purchase records held by Vixora. The anti-abuse marker described above is kept.
Full step-by-step instructions, including what is and is not removed, are on the User Data Deletion page.
User Rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive a copy in a portable form, and complain to your local data protection authority.
Deletion is available directly in the app. For any other request, email vixoraeditorai@gmail.com from the address associated with your account so we can identify you. We may ask for additional confirmation before acting on a request that would expose or destroy data.
Children's Privacy
Vixora is not directed at children under 13, and we do not knowingly collect personal information from them. Where local law sets a higher age of digital consent, that higher age applies.
If you believe a child has created an account, contact us and we will delete the account and its data.
International Processing
Vixora's processing service runs on servers operated by our hosting provider. Depending on where you are, your information may be processed in a country other than your own, including countries whose data protection rules differ from those where you live.
Google and Meta, as sign-in, billing and advertising providers, operate globally and process data under their own international transfer mechanisms.
Security
Traffic between the app and the processing service is encrypted in transit. Passwords are stored only as cryptographic hashes. Endpoints that touch your account, your credits or your files require a valid authentication token, and files belonging to signed-in accounts are held in a storage area that is not publicly served.
No system is perfectly secure. If we ever become aware of a breach affecting your personal data, we will act on it and notify affected users where the law requires it.
Changes to This Policy
We may update this policy as the app changes. The date at the top of this page always reflects the current version.
For changes that materially affect how your information is handled, we will give notice through the app or by email before the change takes effect where that is practical.
Contact Us
For privacy questions, data requests or anything else in this policy:
- Email: vixoraeditorai@gmail.com
- Data controller: Samet Buldanlıoğlu, operating under the BuldAI Labs brand
- Application: Vixora AI Photo Editor (
com.vixora.aieditor)
Vixora is run by an independent developer with no registered trading address, so email is the only contact channel. Every request sent to the address above reaches the data controller directly.