Privacy and your images

What is stored

Choosing an image, detecting text and preparing changes happen in your browser. The image is sent to our service only when you apply an edit and an editing credit has been reserved. A private session cookie gives this browser access to guest images. After verified sign-in, submitted images are linked to your account and can be opened on another signed-in device until their workspace access expires.

Free trials and visitor cookies

A private visitor cookie remembers your one-time trial on this browser for up to 400 days. We keep server-side credit and claim records, plus a keyed hash of your network address, to limit repeat claims. The trial ledger does not store your raw network address. Clearing cookies does not guarantee another free trial. The signup bonus is available once per mailbox, including its plus aliases, and preserves your remaining guest credits. We check disposable email domains and mail-server names to prevent repeat claims; domain lookups send only the domain to Cloudflare DNS. Privacy forwarding addresses are allowed. These checks do not merge your accounts or purchases.

Text detection in your browser

Text detection runs in your browser after upload. The detection software may be saved on your device to load faster on later visits; this cache does not contain your images. Your browser also saves your current draft so you can continue after refreshing. You can clear this data in your browser’s site-data settings.

What is sent for editing

If you request a translation or spelling suggestion, only the words you enter are sent for that request; your photograph stays in your browser until you apply an edit.

When you apply a change, the selected area and some surrounding image context, together with your editing instructions, are sent to our image-processing provider, currently GPT Image through the Tuzi gateway. Do not submit confidential material unless you are comfortable sharing it with that provider. Deletion here does not control a provider’s retention.

Your account and authentication

We store your email address and verified account identifier to provide private image history and credit activity. Email accounts store a password hash, not your password. If you sign in with Google, Google provides a stable account identifier, verified email and display name; we do not receive your Google password. Verification and password-reset emails are sent through Resend. Their one-time links expire at the time shown in the email. Account sessions expire after 30 days and can be revoked by signing out. Signing in does not extend image retention. Signing out clears local draft references on this device.

Workspace access and deletion

Submitted images and versions are available in your workspace and account history for 24 hours after an edit is first submitted. Clear image or Delete image removes workspace access earlier.

Private processing archives

Private processing archives are retained permanently, including the submitted original, editing instructions, processing inputs and results, for troubleshooting, demand analysis and possible future model-improvement work. Archives are separate from your workspace and are not publicly accessible. Model training is not automatically enabled by retaining an archive. Contact support with requests about your archived data.

Support requests

If you contact support, your reply email, message and optional job or order reference are stored privately for up to 30 days. A confirmation means we have received your request; it does not mean it has been reviewed. Do not include passwords, payment-card details or sensitive documents.

Privacy-friendly analytics

We use Cloudflare Web Analytics to understand page visits and website performance. It does not use analytics cookies or identify you across websites. We also collect first-party page views and interactions, such as selecting an image and opening pricing, alongside service outcomes. A temporary in-memory visit identifier connects steps in the current tab; it expires after 30 minutes of inactivity and is not saved in a tracking cookie or browser storage. Service identifiers can link these steps to a verified signup or purchase. These event records are kept for up to 30 days and do not contain images, filenames, selected text, email addresses, passwords, full referrer URLs or payment-card details. Browser interaction reporting stops when Global Privacy Control or Do Not Track is enabled; operational and financial records still support the service. We do not currently serve advertising or use advertising trackers.