Controller and contact
RIFFSOURCE · Stavros Narlidis. Full provider and contact details are available in the legal notice. Privacy enquiries: support@riffsource.com.
Local project data
Project names, drafts, prompts, references and masks, request parameters, job and resource IDs, API responses and downloaded assets are stored in the local application data directory. The app does not additionally encrypt these project files. Project ZIPs include these contents. Projects can be opened and exported without a connected API key.
Credentials and the PixelLab connection
The API key is held only in the operating system’s secure store: macOS Keychain or Windows Credential Manager. It is excluded from project files, browser storage and project ZIPs, and can be removed from the device in settings.
Connection checks and account/library queries send the key to api.pixellab.ai. Explicit generation or editing requests also transmit prompts, parameters and selected reference or mask images to PixelLab. The status of known active jobs is polled. Network requests inherently include the IP address and a product/version identifier.
Result media is downloaded from API-provided HTTPS servers within allowed PixelLab/Supabase domains. The API key is not forwarded to these asset servers.
Processing by PixelLab
PixelLab may store resources in the user’s PixelLab account. Local project storage does not imply local-only AI processing. The provider’s privacy policy applies to its processing. Requests use the connected personal provider account and may incur charges under the PixelLab plan.
Removing local projects or credentials does not remove PixelLab account resources. This client does not offer general deletion of cloud resources.
No RIFFSOURCE analytics or project synchronisation
The app has no RIFFSOURCE application server, analytics, advertising, remote fonts or automatic cloud synchronisation. Exports go to the location selected in the operating system dialog. Other software may synchronise that folder independently. Help links open the system browser on user action.
Retention and rights
Local projects remain until the user deletes them; credentials remain until removed from device storage. PixelLab retention follows its own policies. Questions about access, correction, deletion and other applicable privacy rights can be sent to the contact above. Visits to this website are also covered by the website privacy information.