Pixel Buddy Privacy Policy · Iterative Key LLC

This Privacy Policy explains how Iterative Key LLC (“we,” “us,” or “our”) handles information in Pixel Buddy (the “app”), an animated assistant for Android, iPhone and iPad. On Android it appears over any app when you hold the power button. It applies to the app only. Our website is covered by the separate website privacy policy.

Pixel Buddy does not require an account, has no ads and no analytics, and does not connect to any server operated by us. What it sends, and where, depends on the “brain” you choose, as explained below.

The brain you choose

Pixel Buddy answers with one of these, picked in the first run and changed any time in Settings › Brain:

On this phone (an on-device Gemma model). Your conversation is handled entirely on your phone. Nothing you say or type is sent anywhere.
Your own model. A server you connect: one on your own network (such as Ollama, LM Studio or vLLM), or an AI service you have a key for (such as OpenAI, OpenRouter or Google Gemini). Your conversation goes to that server.
Auto. Your own model while the phone is on one of the Wi-Fi networks you marked as trusted, and the on-device brain everywhere else.

Every request the app makes passes one rule in the app, which knows what the request carries and where it goes (this phone, your own network, or the internet), and refuses anything the brain you chose doesn’t allow.

While the on-device brain answers

Nothing you say or type leaves the phone. The conversation, its title and the facts the buddy remembers are all made on the phone.
Replies are read aloud by your phone’s own text-to-speech voice, not by a voice server.
Tools from MCP servers are not used, except a server running on the phone itself.
The weather is looked up with Open-Meteo, unless you turn off Weather lookups (Settings › More, on by default). Only a place name or your area is sent, never what you said. See “Weather” below.
The only download is the on-device model itself (see “The on-device model”).

While your own model answers

Your conversation goes to the server you set up: what you say or type, the conversation so far, the instructions that give the buddy its personality, your name if you told it, what it remembers about you, and the results of tools it used (for example, the time of a timer it set). That server may also be asked to give the conversation a title and to pick out facts worth remembering from your messages.
Replies read aloud go to the voice server you set up, if you chose one in Settings › Voice. Otherwise the phone’s own voice reads them.
Tools from MCP servers you added (Settings › Connections) receive the tool calls the model writes for them.
The weather is looked up with Open-Meteo (see “Weather” below).

The server or service you connect is chosen and controlled by you, not by us. If it is an AI service, what it does with your conversation is governed by that provider’s own terms and privacy policy. We never receive a copy.

Checks you start in settings

“Test connection”, the list of a server’s models or voices, and hearing a sample voice reach the server you are setting up, whichever brain is answering. They send the server’s address and key and, for a voice, a sample line, never your conversation.

Information stored on your phone

To work, the app stores the following in its private storage, which other apps cannot read:

Your conversations and their titles.
What the buddy remembers about you: your name if you told it, and the facts kept in Buddy’s diary. Facts kept while the buddy was reading something from outside (the screen, a tool’s result) are marked “from the screen” in the diary until you confirm them.
Your settings, including the servers you connected, your trusted Wi-Fi networks, and your timers and alarms.
Your lists (shopping, to-do, any you make by voice). They stay on this phone and are not in Android’s backup.
Keys and tokens. The API keys of a remote brain, voice server or search service and the tokens of your MCP servers are saved encrypted (AES-256-GCM) with a key that the Android Keystore makes for Pixel Buddy and never lets out of it.
The buddy itself: its look, its pet needs, your level, unlocked costumes and streaks.
The on-device model, if you downloaded it.

This information is never sent to us.

Your voice

To turn your voice into text, Pixel Buddy uses the speech recognizer on your phone, not a service of ours. It uses the phone’s on-device recognizer first, which keeps your voice on the phone. Google’s speech services may send your voice to Google only when you allow it: turn on Recognize speech online (Settings › Voice, off by default), or answer Use it when the buddy tells you that the phone has no on-device recognizer. Keep voice off leaves the microphone off, and you can type instead.

The microphone is used only while the buddy is listening to you, and, if you turn on the “Hey buddy” wake phrase, by a small keyword detector that runs entirely on the phone. While the wake phrase is on, Android shows its notification and microphone indicator. Nothing it hears is recorded, stored or sent.

While Pixel Buddy is your phone’s assistant, Android makes it the default speech recognizer for other apps. Pixel Buddy then passes their requests on to Google’s recognizer, or to the on-device one when the app asked to stay offline.

What’s on your screen

When you call the buddy, Android may share the text of the app you were using (and, if you allow it in Android’s assistant settings, a screenshot), as it does with any phone assistant. Pixel Buddy uses it only when you ask about the screen, with the Summarize screen or Point at text buttons: then that text, or the screenshot when there is no text, goes to the brain you chose, like anything else you ask. You can turn this off in Android’s settings (Digital assistant › “Use text from screen” and “Use screenshot”).

The Google Play version does not use Android’s Accessibility service and never reads or controls other apps on its own. When you ask it to send a message, it opens the chat with the message written, and you press Send yourself.

Weather

The weather comes from Open-Meteo. Only a place name (the one you asked about, or the location of a calendar event) or your approximate coordinates are sent, never what you said. Like any internet connection, the request reveals your phone’s IP address to Open-Meteo. Your coordinates are used only when you ask about the weather without naming a place and you allowed approximate location; otherwise the buddy asks which city.

Web search

Web search is off unless you set it up (Settings › Web search). Off, a search opens in your browser and the buddy doesn’t see the results. Set up, the buddy sends only the words of the search to the service you picked (your own SearXNG server, or Brave Search or Tavily with your own key) and reads the top results; when you ask it to, it also opens a page from them, or a link you shared, and reads its text. Like any internet connection, these requests reveal your phone’s IP address to the service or website. While the on-device brain is answering, nothing is searched unless you also turn on Also with the on-device brain; your conversation still stays on the phone. What the search service does with your searches is governed by its own privacy policy.

The on-device model

The on-device brain is a Gemma model made by Google and published on Hugging Face. When you choose to download it, the app fetches the file from Hugging Face over an encrypted connection, without an account, and checks it on the phone. Like any download, this reveals your phone’s IP address to Hugging Face. On mobile data, the app asks before it starts.

Other features

Camera. The lens (“Show me something”) takes a photo when you tap the shutter and sends it, with your question, to the brain you chose. The photo is not saved. The QR scanner reads codes on the phone.
Calendar. If you turn on Time to leave, the app reads your calendar on the phone to warn you before events that have a place, and looks up the weather there. If you ask what’s on your calendar, it asks for calendar access the first time, and gives that day’s events to the brain you chose.
Notifications. If you turn on the Evening paper and give it notification access, the app keeps the day’s personal notifications on the phone (at most 40 a day, and never notifications that stay on screen, such as a music player’s), and the brain you chose writes a short summary from them in the evening. Each paper and its notifications are kept on the phone for 7 days, then deleted. With it on, you can also ask “what did I miss?”: the day’s notifications go to the brain you chose.
Sharing to the buddy. Text or a link you share to Pixel Buddy from another app goes to the brain you chose, to be summed up.
Contacts. To send a message, you pick the person each time, in Android’s contact picker (or, for Telegram, in Telegram’s own chat picker). The app does not have access to your contacts, and the number you pick is used only to open the chat.
Opening other apps. Web searches, directions, music, calls and messages open the app that does them (your browser, maps, music app, phone or messaging app) with what you asked for. What happens there is governed by that app’s privacy policy.
Reporting a reply. You can report an AI reply that seems wrong or offensive. The app opens an email to [email protected] in your own mail app, with the reply, the name of the model that wrote it and the app’s version. Nothing is sent unless you send that email.

Crash reports

Crash reports are off by default. If you turn on Send crash reports (in the first run or in Settings › More), the app sends a report through Firebase Crashlytics, a service provided by Google LLC, when it crashes. A report includes:

technical details of the error, such as the stack trace and the time it happened;
information about your phone and the app, such as the device model, Android version, app version, and available memory and storage;
random identifiers created for your app installation (a Crashlytics installation identifier and a Firebase installation identifier), which are not linked to your name, email address, phone number or Google account.

Reports never include your conversations, what you said, or anything the buddy remembers. The release version of the app writes none of that to the phone’s system log either. Like any internet connection, sending a report reveals your phone’s IP address to Google. Crashlytics keeps reports for 90 days, after which they are deleted. Google processes this data on our behalf as a service provider. Turning the switch off deletes reports not yet sent.

Permissions the app uses

Each one is asked for when a feature first needs it, with a line on why, and the app keeps working if you say no.

Microphone: to hear you, and for the “Hey buddy” wake phrase if you turn it on.
Notifications: for timers and alarms, the model download, “Keep in memory” and heads-ups.
Alarms and reminders (exact alarms): to ring timers and alarms on time. Without it they may ring a little late.
Approximate location: for the weather where you are.
Precise location: only for Auto, because Android shares the name of the Wi-Fi network only with it. The network name is read on the phone and not sent anywhere.
Camera: for the lens and the QR scanner.
Calendar: for Time to leave.
Nearby devices on your local network (Android 17 and newer): to reach a server on your own network.
Foreground services: for the “Hey buddy” wake phrase and “Keep in memory”, each only after you turn it on.
Notification access (turned on in Android’s settings): for the Evening paper.
Run at startup, wake lock, turn screen on, vibration, internet and network state: to bring timers back after a restart, ring them, and connect to the brain and the services above.

Backup and moving to a new phone

On Android, Android’s backup (to your Google account, or to a new phone) copies only the buddy’s look and options, its pet needs, and your level, unlocked costumes and streaks. Your conversations, settings, keys and tokens, server addresses, your name, timers and alarms, the evening paper’s notifications and the on-device model are never backed up. On a new phone, the buddy looks the same, but you set up its brain and voice again.

On iPhone and iPad

The iPhone and iPad app does less than the Android one, because iOS doesn’t let an app do some of it. Everything above applies to it, with these differences:

Not in the iOS app: the overlay and the power button, reading what’s on your screen, the “Hey buddy” wake phrase, the Evening paper and notification access, Auto and trusted Wi-Fi networks, and crash reports. The iOS app has no Firebase or any other analytics or crash reporting service, so nothing about how you use it, or how it fails, reaches us.
Your voice. Pixel Buddy uses Apple’s speech recognizer. It recognizes speech on the device when your device supports that for your language. Only if you turn on Recognize speech online (Settings › Voice, off by default) may Apple’s speech service receive your voice, under Apple’s privacy policy. Replies are read aloud by the device’s own voices.
Keys and tokens you enter for your own model are kept in the app’s storage on the device, which iOS encrypts while the device is locked. The app doesn’t add its own layer of encryption on iOS yet, as it does on Android.
Permissions, each asked only when a feature first needs it: microphone and speech recognition (to hear you), location while using the app (the weather where you are), calendar, add events only (to draft an event you save yourself), camera (to scan a buddy’s QR code), and alarms (timers and alarms that ring like the Clock app’s, with a countdown on the Lock Screen and in the Dynamic Island). Siri and Shortcuts can start a conversation or set a timer.
Backups. Like other apps, Pixel Buddy’s data on the device, including your conversations and the keys and tokens you saved, is part of your iPhone or iPad backup (iCloud or a computer), which Apple encrypts and we never see. The on-device model is left out of backups; it is downloaded again.
Links and web searches open in Safari, under Safari’s settings; the app has no browser of its own.

We do not receive your conversations or anything stored in the app. The only information that reaches us is crash reports, if you turn them on, which we use only to find and fix bugs, and emails you choose to send us. We do not sell, rent or trade your information, and we do not share it for advertising. Information you send to a server or AI service you connected goes there because you set it up; it does not pass through us. We may disclose information if required to do so by law, or to protect the rights, safety or property of our users, ourselves or others. If Iterative Key LLC is involved in a merger, acquisition or sale of assets, this policy will continue to apply to any information transferred.

Security

Information on your phone is protected by Android’s app sandbox and your phone’s storage encryption, and keys and tokens are also encrypted by the app. The app connects to servers on the internet only over encrypted connections (https://). It accepts an unencrypted (http://) address only for a server on your own network: the phone itself, a private or link-local address, or a local name. It trusts only the phone’s built-in certificate authorities.

Your choices and rights

Switch the brain, the voice, the weather lookups, crash reports and every optional feature on or off in Settings at any time.
Delete a conversation in the chat history, and make the buddy forget one fact or everything in Buddy’s diary.
Delete everything the app has stored by clearing its storage in your phone’s Settings, or by uninstalling it.
For data held by a server or AI service you connected, use that provider’s tools.

Depending on where you live, you may have rights to access, correct, delete or object to the processing of your personal information. Because crash reports are not linked to your identity, we usually cannot match a report to a specific person. To make a request or ask a question, write to [email protected].

Children’s privacy

The app is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, please contact us and we will take appropriate steps.

Changes to this policy

If we change how the app handles information, we will update this policy on this page and change the effective date above. If the changes are significant, we will also let you know in the app or in its store listing.

Contact

Questions about this policy? Email us at [email protected].