Privacy

The files people put into this are passport photos, signatures and ID scans. That is the most sensitive category of image most people own, so this page says plainly what happens to them rather than reserving the right to do anything.

The short version

Your photo is stored on this server only long enough to work on it, and is deleted within 30 minutes.
Two Google scripts run on this site: reCAPTCHA, which checks that uploads come from a person, and Analytics, which counts visits. Neither is shown your photo. There is no advertising and nothing is sold.
A cookie counts how many photos you have made, so the free allowance can be enforced. Signing in is optional.
Camera and location data is stripped from the file you download, by default.
Background removal runs on this server. Your photo is never sent to a third party for it.
Nothing is sent to an AI provider unless you tick the box that says so, and it is off by default.

What is stored, and for how long

When you upload a photo it is written to a temporary directory on the server under a random 32-character identifier.

That identifier is not derived from your filename, your address, or anything else about you, and it is not guessable.

Each file you produce is stored the same way, so the page can show it to you and so you can download it.

A cleanup task deletes every stored file older than 30 minutes, whether or not you are still using the page. After that the link stops working and the bytes are gone. There is no archive, no backup, and no copy kept for "improving the service".

Image contents are never written to the server log. The only thing logged about a file is a failure of the cleanup task itself.

Camera and location data

Photographs from a phone usually carry EXIF metadata — the time it was taken, the camera's serial number, and often the GPS coordinates of where you were standing. Uploading that to a government portal along with your face is rarely what anyone intends.

Remove camera and location data is on by default in the editor and on every ID preset. An automated test asserts that a GPS tag present in the source does not survive into the produced file, so this is a checked behaviour rather than an intention.

You can turn it off if you need the metadata preserved for some reason. The control says what it does either way.

Background replacement runs here

Cutting a subject out of a photo is the kind of feature usually served by a third-party API, which would mean sending your ID photo to another company. It does not work that way here: the segmentation model is a 4.5MB file that runs on this server, and your photo is never handed to anyone else to do it. No background-removal service is involved at any point.

The "Describe it" mode and AI

The manual editor never contacts an AI provider. If you use "Describe it", your request is sent to an AI provider so it can work out which specification you need. What goes with it depends on one checkbox, which is off unless you tick it.

Left off (the default)

Sent: Your typed request, and measured properties of the image — its width, height, format, orientation and DPI.
Not sent: The image itself. It is never sent to the AI provider.

Ticked on

Sent: The above, plus a copy of your photo shrunk to fit 512×512, re-encoded as JPEG, with its EXIF removed first.
Not sent: The full-resolution file, its filename, and its original camera or location data.

Whatever is sent leaves this server and is handled under that provider's own terms and retention policy, which this page cannot speak for. That is the reason the image is withheld by default: it is a decision worth making deliberately, not one to inherit from a default.

What the server records about you

No advertising identifiers, and nothing here is sold or shared with a data broker. What this server keeps is the minimum needed to run a free allowance and, if you buy one, a subscription. The Google scripts listed below keep their own records under Google's terms, which this page cannot speak for.

A cookie naming this browser

Held: Thirty-two random characters, set for a year, readable only by this server.
Why: It is what a free photo is counted against. It is not linked to an advertising network, is not readable by any other site, and says nothing about you.

A count of photos you have made

Held: One row per photo: the random identifier of the upload, which allowance it came from, and when.
Why: The free allowance is a total rather than a monthly figure, so it has to be remembered. This row holds nothing measured from the picture and never the picture itself.

Your Google account, only if you sign in

Held: Your email address, your name and the URL of your profile picture, as Google supplies them, plus Google's own identifier for you.
Why: So the allowance follows you between browsers, and so a subscription has an account to belong to. Signing in is optional; the app works without it.

Your subscription, only if you buy one

Held: Razorpay's subscription identifier, its status, and the date it is paid up to.
Why: To know whether the paid allowance applies. Card details are handled by Razorpay and never reach this server.

Your IP address, briefly

Held: A counter against your address, for rate limiting, and a daily count of free photos from your network.
Why: To stop one caller exhausting a shared server, and to make clearing cookies in a loop unrewarding. Neither counter is kept beyond a few days.

A note of each upload

Held: The time, your IP address, your browser's user-agent string, and the size, format and dimensions of the file — the same details the server sends straight back to your browser when it accepts a photo. Not the file name, and not the image.
Why: It is how this is kept working: whether it is used at all, and what is failing for people. A format that keeps arriving and cannot be read is a fault nothing else would reveal. Deleted after thirty days, and the photo it refers to is gone on the schedule above long before that.

Nothing above is the picture, and nothing above outlives it in any useful sense: each row refers to a photo only by the random identifier it was stored under, and the picture behind that identifier is deleted within 30 minutes. The allowance ledger holds nothing measured from the image at all; the upload note holds its size and dimensions, which your browser was told anyway, and never its file name.

The free allowance is deliberately not defended by browser fingerprinting. Clearing your cookies does reset it, and that is a trade accepted on purpose: building a durable identifier out of your device's fonts, canvas and hardware — the technique that would close the gap — is not something worth doing to you in order to protect a free trial.

What Google is shown

Two Google scripts run on the page. Neither of them is ever shown your photo — it is uploaded to this server directly and never passes through them — but both set cookies of their own and both are covered by Google's privacy policy rather than this one.

Google reCAPTCHA, on upload and on AI requests

Held: Google sets its own cookies and observes how you interact with the page, then returns a score saying how likely you are to be a person. That happens under Google's terms, not this page's.
Why: So that automated traffic cannot mint fresh free allowances by clearing cookies in a loop. It runs invisibly — there is nothing to click — and it is never shown your photo, only the fact that an upload was attempted.

Google Analytics

Held: Which pages were viewed, roughly where in the world from, and what kind of device — with your IP address anonymised. Google sets its own cookies for this.
Why: To know which parts of the app are used and on what screens. It is not shown your photo, your filename, anything typed into the AI box, or your account. No advertising identifiers, and nothing is sold.

If you are running this yourself

This is open code you can host. Everything above describes what the code does, not a promise about an operator — if someone else is running the copy you are using, the retention window and the AI provider are theirs to configure, and you would need to ask them. Running it yourself is the version where nobody has to be trusted.

Resize a photo