Effective
Pinklemon8 Inc provides the PXM app, pxm.sh, and the account and licensing service at accounts.getpxm.com. This notice explains how information moves through those products. If we add another app to the shared account service, its own notice will describe any additional processing.
Your local workspace
PXM reads and stores the project configuration, local paths, runtime information, service settings, connection details and development output needed for the features you use. Depending on your work, local output can include database contents, logs, captured development mail, dumps, request details and profiling data. Those records can contain personal information or secrets supplied by your projects.
Discovery of existing local databases reads installation, process and connection metadata to help you choose a server. A connection test uses the credentials you provide. If you connect PXM's command-line or coding-agent tools to another application, that application can receive the project information and tool results you authorize it to access; its own data handling also applies.
PXM does not upload your project source, local database contents, development mail or debugging captures to the PXM account service as part of normal licensing. Those records remain in your local workspace. This does not prevent your own projects, installed tools, package managers or a sharing feature you choose from making network requests.
License activation credentials are stored in the Mac's Keychain. If you choose to remember an existing database password, PXM stores it in Keychain too. Other project and service configuration is stored locally. Cloudflare account certificates and tunnel credentials are stored in restricted local files. Do not assume that every local configuration file, project file or database is encrypted by PXM.
Accounts and Pro license validation
Free use does not require an account or send a device identifier for license validation. When you request a sign-in link, we store your email address and an internal account identifier. We send a single-use link by email and record information needed to deliver it and prevent abuse. A sign-in link expires after 15 minutes. An account session uses a secure, HTTP-only cookie and can remain valid for up to 30 days; signing out ends that session.
When you open Pro checkout, our account service uses a secure, HTTP-only checkout cookie to recognize retries and avoid creating duplicate checkout sessions for the same plan. This cookie does not sign you in, grant a license, or charge you. Stripe's hosted pages use their own browser storage and privacy controls.
When you activate PXM Pro, the app sends the license key, a product-specific device identifier, the Mac's computer name and its platform to our licensing service. The identifier is a hash derived from a hardware identifier, with a locally stored random identifier as a fallback. The raw hardware identifier is not sent by this license flow. The device hash is still linked to your account and is not anonymous. Your computer name can itself identify you.
We keep Pro license and activation records, including the plan, status, allowed number of devices, activation dates and last successful validation time. Later validation requests identify the activation and device and prove possession of its activation credential. These records let us enforce the two-computer limit, provide access, remove devices, recover an activation and reconcile billing. The app normally refreshes online about once a day and uses a signed authorization lasting no more than seven days between successful validations.
Payments and purchase records
Stripe hosts Checkout and the billing portal. For checkout without sign-in, we send Stripe the selected product and plan and a purchase reference; you enter your email directly in Stripe Checkout. After Stripe confirms payment, we use that email to create or find your account and deliver a license sign-in link. For checkout from a signed-in account, we also send its email and account reference. Stripe collects payment details and the billing address; it can also collect tax identification details where the checkout offers that option.
Our service receives purchase and payment-status information from Stripe, such as customer, checkout, invoice, subscription and payment references, amounts, tax information, billing details contained in transaction events, refunds and disputes. We use it to issue licenses, maintain paid access, provide invoices, process refunds and meet billing and legal obligations. PXM's account database does not store full card numbers or card security codes. Stripe's handling of payment information is described in Stripe's privacy policy.
Website requests, downloads and support
Our websites and infrastructure receive the usual information needed to answer a network request, such as an IP address, time, requested resource and browser or app request headers. Server access and error logs can retain this information for operation, security and troubleshooting. The account API also uses hashed identifiers derived from IP addresses, email addresses and account references to limit repeated requests. Hashing does not make all of this information anonymous.
PXM checks for app and runtime updates and downloads the software you choose to install. Download hosts receive request and connection metadata and the requested file or version. PXM's app-update feed and prebuilt PHP packages use Cloudflare infrastructure. Some catalogs, runtimes, extensions and project dependencies come from upstream providers such as GitHub, Node.js, Composer/Packagist and WordPress. Your choice of packages can cause their tools to contact other registries or services. You can adjust app and runtime update checks in PXM's settings. Pro license validation is a separate requirement; it does not apply to Free use.
The current PXM website and account pages do not include advertising pixels or a third-party behavioral analytics script. The app updater has system profiling disabled. These facts do not mean that network requests or operational logs are absent.
If you contact support, we receive the message, contact information and attachments you send. PXM can export a local service-diagnostics file; exporting it does not automatically send it to us. Review any file before attaching it, and leave out passwords, license keys and private project records that are not needed for the question.
Optional public sharing
Cloudflare tunnels connect a selected local site to a public link or a domain you authorize. When you use sharing, Cloudflare processes tunnel connection information and the site's traffic, including the content and request information passing through that connection. People who can reach the shared application can receive the information it exposes. Sharing is not a cloud backup of the whole workspace, but it can expose sensitive project content if the application serves it.
For a custom domain, PXM uses the authorization you grant through Cloudflare to identify that domain and manage the selected tunnel routes. You can stop a sharing session in PXM and manage Cloudflare permissions in your Cloudflare account. See Cloudflare's privacy policy.
Service providers and processing locations
We use service providers to run the product:
- Stripe: payment processing, billing, tax information and refunds.
- Resend: delivery of account sign-in email. It receives the recipient address, sender, subject and email content, including the sign-in link. See Resend's privacy policy.
- Cloudflare: app/runtime download delivery and, when you choose it, tunnel sharing.
- Infrastructure and hosting providers: the server infrastructure that runs our websites, database and operational logs.
Providers may process information outside Canada, where it can be subject to the laws and lawful access processes of those countries. We do not represent that all PXM data is stored or processed only in Canada. We remain responsible for the information handled on our behalf and for choosing appropriate safeguards. Providers may also have their own legal obligations and privacy terms.
Retention and protection
We retain account, activation, billing and audit records as needed to provide licensing, support payments and refunds, meet legal obligations, prevent abuse and resolve disputes. Deactivating a computer releases its activation slot; it does not erase the account or its purchase history. Cancelling a subscription does not automatically delete these records. We do not promise a fixed deletion period for all records or backups.
Sign-in and session credentials expire. Our service stores their verification hashes rather than the raw sign-in or session tokens. Queued sign-in message content is encrypted and cleared from the active outbox after a successful send. Delivery metadata, service-provider copies, operational logs and billing records have separate purposes and retention needs.
We use HTTPS for the account service, protected credentials, signed license authorizations and restricted access to server and local data. No storage or communication system can guarantee perfect security. Keep your email account and Mac secure, and do not share sign-in links or license credentials.
Your choices and privacy requests
You can sign out, remove a device activation, cancel annual renewal, stop public sharing and manage local project data. Removing the app does not automatically remove its stored data or cancel billing. Your Mac's backup and sync settings may also retain copies of local files independently of PXM.
Email hello@getpxm.com to ask about the information we hold about you, request access or correction, request deletion, withdraw consent where applicable, or raise a privacy concern. We may ask for enough information to verify the request. We will explain any information we need to retain for licensing, billing, legal obligations or disputes, and any effect a request has on your account or licensed access. Account deletion and data export requests currently require contacting us; there is no automatic account-deletion button.
You can also contact the privacy regulator responsible for your location. Canadian privacy information and complaint guidance are available from the Office of the Privacy Commissioner of Canada.
Contact and notice changes
For privacy questions, contact Pinklemon8 Inc, with “Privacy” in the subject:
hello@getpxm.com
556 De La Seigneurie Boulevard, Apartment 309
Winnipeg, Manitoba R3X 0W4, Canada
Telephone: +1 (650) 733-2077
We will identify the effective date of the published notice and explain material changes. If a new use of personal information requires additional consent, we will seek it before that use.