Privacy & Image Processing

Local editing and submitted processing are different

Selecting a photo, decoding orientation, painting a mask, moving the preview and cropping happen in your browser. Uploading into the editor alone does not send an AI request. The crop tool does not upload files for processing.

Clicking Remove sends the working image, mask and task mode through our server to a configured third-party image provider. The original source is not included unless it is also the working image. AI processing is subject to daily limits and service availability.

No public result library

This version does not create accounts, a public gallery or permanent result URLs. The backend streams a validated result back to your browser. We do not intentionally log photo bytes, masks, source filenames, raw prompts, keys or provider result URLs.

This does not mean that a hosting platform or third-party provider has no infrastructure metadata or retention. Provider retention, deletion and commercial-processing terms remain unverified; a confirmed policy is a launch requirement. Do not submit sensitive images based on an assumed deletion window.

Latest-edit recovery on your device

After a successful edit, the browser may store only the latest original photo, working image, selection, mode and generated result in IndexedDB. The expiry is fixed at 24 hours after that success. Editing the selection or reading the record does not extend it. Expired records are removed at the next tool access; a closed browser does not run scheduled deletion.

Choosing a new valid photo or Start over clears that saved record. Clearing site data also removes it. Storage may be unavailable or evicted. A storage failure does not intentionally invalidate the current in-memory download, but refreshing can lose unsaved work. Recovery never uploads or regenerates an image.

Abuse protection

The independent site budget ledger uses a server-secret HMAC of the trusted network IP, daily and short-term counters, request fingerprints and concurrency leases. It does not store raw IP addresses, images or masks. Daily counters reset at 00:00 UTC and expired entries are cleaned on the next guard operation. Aggregate usage, sanitized error counters and unique-task records persist to prevent duplicate generation or silently renewed budgets.

A network identifier is approximate: people behind the same IP can share the daily allowance, and changing networks can evade it. File hashes are used only for task identity; they are not published or used as gallery URLs.

Analytics and ads

No analytics, tracking pixels, real advertisements or scheduled external monitoring are connected in this version. The advertisement space is a local layout placeholder, not a third-party script.

Operator contact details and applicable jurisdiction are still awaiting confirmation. See Contact. This draft must be reviewed with actual hosting and provider policies before launch.