Realix privacy policy

Last updated: 11.11.2026

Realix tells you whether a photo or a screenshot looks AI-made, whether a text has already been fact-checked as false or true, and whether a link you received looks like a scam. We built it to learn as little as possible about you. Realix informs you and gives recommendations; with today's technology nothing is 100% certain.

Who is responsible

BAIATUL DIGITAL SOLUTION S.R.L. (BDS), CUI 52996493, J2025092166007, Petroșani, România. Contact: lucian@helpix.ro.

What we process and why

• The photo you send, only to analyse it. Our own detector analyses it first. Only if it gives a high AI score is the photo also sent to Sightengine for a second opinion. The photo is not saved: it is analysed in memory and then forgotten.
• The photo's metadata (for example the phone or camera model, the date, the nearest town from the photo's GPS, the lens, the editing software). We read it from the file on our server, only to show you where the photo comes from. We do not keep it: it is read again on every check. Exact GPS coordinates are not shown.
• The text to check, from a screenshot (read on your phone; if the screenshot contains a photo, only that photo, cut out of it, goes to the AI analysis, or the whole screenshot when it cannot be cut out) or pasted by you. Only the text is sent to Google Fact Check Tools to search fact-checks published by journalists. We do not keep the text; for up to 7 days we keep only a fingerprint of it and the fact-check found.
• The photo's digital fingerprint (hash) and the result (verdict, score and detector signals), for up to 30 days, so we do not analyse the same photo twice. The image cannot be rebuilt from the fingerprint.
• A random install code created on your phone. There are no accounts. For the free daily limit we keep the code for 2 days together with the fingerprints of the photos checked that day. To count how many people use the app, we keep the days it was used, for up to 90 days; after 90 days without use the code is deleted. The code does not contain your name, phone number or email.
• Recommending Realix to a friend. If you send the invite link, it carries a short code derived from your install code (not the code itself). When your friend installs Realix from the link, Google Play passes this code to the app, and we link the two install codes to give you the extra checks. The link is kept for 90 days, the extra checks for 30 days. We never learn anyone's name, number or contacts.
• The Realix network. For each checked photo we keep a fingerprint of it (not the image), the country the check came from and the day, for up to one year. This table holds no install code, IP address or other data about you. This lets us show how many times and from where a photo was checked before, i.e. how it circulates. Small numbers stay hidden: a country with a single check is shown only once the photo has at least 5 checks in total.
• The link to check, from a message you share or paste, or from a screenshot (the text is read on your phone). We send the text (at most 4,000 characters) to our server, which takes the link out of it. The rest of the text is read only on our server, to look for typical scam signs (for example "customs fee" or an IBAN), and is not sent to anyone. Our server opens the linked page (from the server's address, not from your phone), follows redirects and looks at what the page asks for (card, CVV, SMS code, BankID, password). We do not keep the link, the message or the page, and we do not write them to logs. For 1 hour we keep only the result (the verdict, the reasons and the site's name, e.g. example.com), under a fingerprint of the text, so the same message is not checked twice, and the domain's age for 24 hours. For the daily limit we count how many links the install code checked, for 36 hours. Note: if the link contains a code unique to you, whoever sent it may learn that the link was opened (but not your IP address or your phone). Do not send login or password-reset links from services you trust for checking.
• On your phone the app keeps a history of your latest checks with a thumbnail or the name of the checked site. It never reaches us and is deleted when you uninstall.

Voice messages: voice analysis is not available yet; we will add it here before it launches. If you send an audio file now, it reaches our server, is not analysed, is not passed on and is not kept.

The Pro subscription is not available yet. When it is, payment will go through Google Play and this policy will be updated before launch.

We do not ask for your name, email or phone number, show no ads and do not track you across other apps. We do not use your photos or texts to train AI models.

Legal basis

We process data to provide the service you requested (Art. 6(1)(b) GDPR) and, for aggregate statistics, the Realix network and abuse protection, on our legitimate interest (Art. 6(1)(f)).

Who receives data

• Cloudflare (server hosting and the private tunnel to our detector). Cloudflare is a US company.
• Our own detector, on a computer in Sweden (EU), connected to the server through a private Cloudflare tunnel: AI analysis of photos. The photo is analysed in memory and not saved.
• Sightengine (France, EU): second AI analysis, only for photos with a high score. It receives the photo without metadata (no GPS, phone model or date).
• Google (Google Fact Check Tools API, USA): fact-check search, text only.
• Google (Google Web Risk, USA): the full link and, if it leads elsewhere, the final address, to see whether the site is on Google's list of dangerous sites. Not the message text.
• The linked site: our server opens the page. The site sees a request from our server (Cloudflare), not your IP address.
• Public sources for the domain's age and reputation, the site's name only (e.g. example.com): the domain's registry (via RDAP), the Swedish Internet Foundation (whois.iis.se, for .se and .nu), crt.sh (public HTTPS certificate logs, for .ro and others; the .ro registry is not queried) and Cloudflare's DNS service (1.1.1.1 and its security filter).
• ANAF (Romanian tax authority): only the tax code (CUI) of the company named on the checked site's page, to see whether the company exists. Swedish organisation numbers and IBANs are only checked mathematically on our server and are not sent anywhere.
• Google ML Kit (reading the text in screenshots, on the phone): the text and image are not sent to Google, but the library sends Google technical diagnostics (phone model, app version, an installation code, errors and performance).

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to complain to your data protection authority (in Romania: ANSPDCP, dataprotection.ro; in Sweden: IMY, imy.se). Because we do not know who you are, the simplest option is to uninstall the app: the install code disappears and related data expires automatically within the periods above. For any request, write to lucian@helpix.ro.

Children

Realix is not intended for children under 16.

Limits of the verdict

Verdicts are automatic and can be wrong. Realix never states that a photo is certainly real: at most that no clear signs of AI were detected ("Likely real"). Use the result as a hint, not as proof.

For links, Realix says "FAKE" only when the site is on a warning list (Google Web Risk or authorities' lists, e.g. Finansinspektionen, Konsumentverket, DNSC, ANPC) or when the page poses as a well-known brand without being its official site and asks for card details, passwords or codes. The result always shows the reason and the source. Otherwise it says "risk signals", "we can't say for sure" or "no signs of fraud found", never that the link is safe. The result is valid for the moment of the check. If you own a site and believe the verdict is wrong, write to lucian@helpix.ro: we check and correct it quickly.

Changes

If we change this policy, we update the date above.

Versiunea în română