Artwork and local storage
The current editor stores multiple documents and recovery revisions in IndexedDB. Save project backup downloads an editable .pixelwall file. Reference layers remain in native documents; rendered exports omit them by default and offer an explicit Include reference layers option.
Clearing site data, removing an app profile, or browser/OS storage cleanup can remove local work. Download independent backups. PixelWall does not upload documents to a cloud project account.
Your analytics choices
On pixelwall.dev, public pages and both web editors share Privacy preferences. Essential only is the default: it sends only anonymous totals for page visits, first meaningful edits, automation actions and outcomes (including previews, validation and file retrieval), recognized public navigation, downloads, manual or automated export outcomes, checkout starts, and fixed homepage demo actions, with no persistent visitor ID or analytics cookie. Anonymous totals can include a fixed tracing, tileset, animation, or sprite-sheet category when a workflow page leads directly into an editor; that workflow category lives only in tab memory and is cleared on unrelated navigation. Homepage demo totals use only fixed actions such as opened, edited, exported, failed export, and full-editor click. Optional analytics stay off until you choose Usage analytics or Enhanced diagnostics. Do Not Track and Global Privacy Control keep both analytics channels disabled. You can change your choice from Privacy preferences at any time.
Usage analytics shares page categories, recognized navigation and download clicks, feature use, automation edits and operation outcomes, storage and export results, whether an export was manual or automated, Pro interactions, homepage demo interactions, and basic browser/device details with PostHog. For the tracing, tileset, animation, and sprite-sheet workflow pages, the same fixed workflow category can follow the immediate landing page into editor loading, meaningful editing, and generated export. It stores the category in tab memory only; it does not store URLs, search queries, artwork, a workflow-specific tracking ID, or browsing history, and it does not backfill earlier activity. Optional standard pageviews use a canonical page category address rather than a full visited URL; coarse referral categories describe the current page’s immediate source. Optional analytics use a stored browser identifier to recognize repeat visits.
Enhanced diagnostics adds performance measurements and scrubbed error reports. No privacy level records sessions, replays, or automatically captures page text and clicks. Artwork, imported files, document and layer names, license and purchase identifiers, scripts, error messages, and full URLs are excluded from analytics.
Optional activity before permission is discarded rather than collected later. Earlier Required only refusals continue to keep all analytics off until you save a new choice. Withdrawing optional permission stops optional collection immediately and synchronizes the preference across tabs. If a preference cannot be saved, all analytics stay disabled for that visit.
Desktop apps do not use site analytics. From version 0.6.4, packaged desktop apps report bounded anonymous app-health and agent-operation categories by default; health reporting can occur on launch or update without opening MCP. Help → Share anonymous app and MCP usage controls this reporting and preserves an existing off preference. The first MCP connection also explains the reporting choice. Reports include operation and result categories, app version, operating system, processor type, approximate duration, export format, whether a file was saved, and whether this is the first or a returning reporting day. `first` means the first reporting day observed by that installation, not proof of first install. Packaged CLI downloads also report anonymous usage by default and explain this on the first command. Use --no-telemetry for one command, telemetry disable for a saved preference, or set PIXELWALL_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1. Reports never include artwork, scripts, filenames, paths, command arguments, agent names, email addresses or persistent identifiers. Turning desktop reporting off also cancels pending requests. Offline activity is never queued or backfilled. Daily counts are approximate and do not identify unique users or measure retention. Unreadable preferences keep reporting off. Packaged CLI reporting and default-on desktop MCP reporting began in 0.6.2. Older desktop releases may offer opt-in MCP reporting; earlier activity is never backfilled. The standalone browser bundle, local development and private previews remain outside this reporting path. Desktop update checks request release information separately.
Payments and offline licenses
Stripe handles checkout and payment data. Online verification checks purchase-related records. The hosted store uses private cookies; the app stores a signed PW2 license locally for offline verification. The license includes a purchase identifier and must be kept private.
An existing PW1 recovery code can be sent to the explicitly configured storefront to exchange it for an offline license. Offline PW2 verification does not need to send the license or artwork to a server.
Website hosting processes requests needed to deliver pages and downloads. A downloaded standalone app serves its own editor assets locally. A retained license does not imply cloud project sync.