Privacy
The files people put into this are passport photos, signatures and ID scans. That is the most sensitive category of image most people own, so this page says plainly what happens to them rather than reserving the right to do anything.
The short version
- Your photo is stored on this server only long enough to work on it, and is deleted within 30 minutes.
- There are no accounts, no cookies, no analytics and no tracking of any kind.
- Camera and location data is stripped from the file you download, by default.
- Background removal runs on this server. Your photo is never sent to a third party for it.
- Nothing is sent to an AI provider unless you tick the box that says so, and it is off by default.
What is stored, and for how long
When you upload a photo it is written to a temporary directory on the server under a random 32-character identifier.
That identifier is not derived from your filename, your address, or anything else about you, and it is not guessable.
Each file you produce is stored the same way, so the page can show it to you and so you can download it.
A cleanup task deletes every stored file older than 30 minutes, whether or not you are still using the page. After that the link stops working and the bytes are gone. There is no archive, no backup, and no copy kept for "improving the service".
Image contents are never written to the server log. The only thing logged about a file is a failure of the cleanup task itself.
Camera and location data
Photographs from a phone usually carry EXIF metadata — the time it was taken, the camera's serial number, and often the GPS coordinates of where you were standing. Uploading that to a government portal along with your face is rarely what anyone intends.
Remove camera and location data is on by default in the editor and on every ID preset. An automated test asserts that a GPS tag present in the source does not survive into the produced file, so this is a checked behaviour rather than an intention.
You can turn it off if you need the metadata preserved for some reason. The control says what it does either way.
Background replacement runs here
Cutting a subject out of a photo is the kind of feature usually served by a third-party API, which would mean sending your ID photo to another company. It does not work that way here: the segmentation model is a 4.5MB file that runs on this server, and your photo is never handed to anyone else to do it. No background-removal service is involved at any point.
The "Describe it" mode and AI
The manual editor never contacts an AI provider. If you use "Describe it", your request is sent to an AI provider so it can work out which specification you need. What goes with it depends on one checkbox, which is off unless you tick it.
Left off (the default)
- Sent
- Your typed request, and measured properties of the image — its width, height, format, orientation and DPI.
- Not sent
- The image itself. It is never sent to the AI provider.
Ticked on
- Sent
- The above, plus a copy of your photo shrunk to fit 512×512, re-encoded as JPEG, with its EXIF removed first.
- Not sent
- The full-resolution file, its filename, and its original camera or location data.
Whatever is sent leaves this server and is handled under that provider's own terms and retention policy, which this page cannot speak for. That is the reason the image is withheld by default: it is a decision worth making deliberately, not one to inherit from a default.
What the server records about you
No accounts, no cookies, no analytics, no tracking pixels, no third-party scripts. Nothing is stored in your browser between visits, and closing the page ends the session as far as this application is concerned.
One exception worth stating: "Describe it" is rate limited to a few requests a minute, and to do that the server keeps your IP address in memory with a counter that resets after a minute. It is not written to disk, not linked to your files, and disappears when the server restarts.
If you are running this yourself
This is open code you can host. Everything above describes what the code does, not a promise about an operator — if someone else is running the copy you are using, the retention window and the AI provider are theirs to configure, and you would need to ask them. Running it yourself is the version where nobody has to be trusted.