Security
How Pixo keeps your pictures and files safe
Your photos, scans and documents are some of the most private things on your Mac. This page says, in plain words, what leaves your Mac, how your files are handled and what has to be true before the app updates itself.
What leaves your Mac
Five destinations, and none of them gets your pictures
Pixo has no server that receives pictures or PDFs. This is everything the app talks to over the network.
| To | What is sent |
|---|---|
| Apple Maps | A map request for the area, when the inspector shows a photo's location. The photo is not sent. It can be turned off in Settings. |
| Apple, through macOS | Only when you choose Translate or Reimagine: Apple Translation may download a language once, and Image Playground works as in Apple's apps. |
| Our payment provider | Your licence key and a label for this Mac, to check a Pro licence. Nothing about your pictures or files. |
| cdn.pixoviewer.com | Nothing is sent. The app downloads one small file to see whether a newer version exists. |
| pixoviewer.com | The app's name, version and build channel, to ask for announcements. No licence key, account or device id. |
The full wording, with when each connection happens, is on the privacy page.
Pictures and PDFs stay on the Mac
Viewing, every tool, Vision and Apple Intelligence run on your Mac. Nothing is uploaded to be processed.
- No Pixo account and no cloud library
- No analytics of what you open
- Folders are read where they are, never imported
Originals are never changed
Tools save new files next to the originals, and PDF edits are saved as a copy.
- Convert, compress and crop write a new file
- Rename asks before it renames
- Move to Trash can be undone with ⌘Z
Removing metadata is checked
After Remove Metadata, Pixo reads the new file back. If a location or camera detail is still in it, the picture is saved again without it.
- The location alone, or every detail
- Done without re-compressing where the format allows
- Redact removes the text from a PDF, not just covers it
The licence key lives in the Keychain
Your Pro licence key is stored in the macOS Keychain, the same place Safari keeps passwords.
- Never written to a settings file
- Never printed to a log
- Never sent to us
Our website cannot control the app
The one thing pixoviewer.com can do is show a notice in the app. The app decides what it will accept.
- Plain text only, with a length limit
- Links only to pixoviewer.com, over https
- An answer that does not fit shows nothing
The licence check fails safe
If the licence server cannot be reached, your plan stays as it was. Only a definite "no" changes it.
- No network never locks you out
- A lapsed plan locks Pro features, never your pictures
- The viewer works with no plan at all
Updates
Four checks before a new version is installed
An app that updates itself is a way in, so the update has to prove where it came from. If any check fails, nothing is installed and the version you have keeps running.
- 1
The list of versions came from our own download server and names a higher version than the one you have.
- 2
The download carries a signature made with a key that never leaves our release Mac, and it matches the public half built into the app.
- 3
The unpacked app has a valid Apple code signature, from our Apple developer team, for Pixo itself.
- 4
The new app says it is the version that was promised.
Reporting
Found a security problem?
Write to [email protected] with what you found and how to see it. Please give us time to fix it before you publish it. The machine-readable version of this is at /.well-known/security.txt.
Stop squinting in Preview.
Open it in Pixo.
Free to view, for good. Pro adds batches and more Apple Intelligence. macOS 26 or later on Apple Silicon or Intel.