Privacy-first photo processing.

1. Image handling

Your browser performs cropping, resizing, rotation, preview watermarking, validation and final compositing locally.

When you request background preparation, the image is sent to the configured processor, which may be PhotoRoom, remove.bg or Cloudflare Images. That provider's processing and retention terms apply. The temporary Cloudflare Images upload path makes a best-effort deletion request after processing.

2. Analytics and attribution

When GA4 is configured, Google can receive page, referrer, campaign, browser and device information plus pseudonymous client or session identifiers, and may use _ga or related browser storage. Plausible, Umami or Cloudflare analytics load only when separately configured.

Photo pixels and face-validation measurements are not sent to analytics. Campaign fields used for checkout attribution are limited and kept in session storage; arbitrary page or referrer query strings are not retained.

3. Payments and follow-up email

Stripe Checkout processes payments and receives the checkout details and email needed for the transaction. We do not see or store card details.

When review follow-ups are enabled, the checkout email is read from Stripe and sent through Resend for one review and support message about 24 hours after a recorded download. Delivery status is stored in Stripe metadata to prevent duplicate sends.

4. Photo draft retention

Immediately before Stripe checkout, the original and prepared photo plus crop settings are saved in IndexedDB on this device so the result can be restored after payment. This browser copy is not uploaded to our application server.

The draft expires after 24 hours and is removed while the site remains open or the next time the site is opened after expiry. Starting another photo removes or replaces it immediately. Closing the tab alone may not erase IndexedDB storage.

5. Cookies and browser storage

If Google Analytics is enabled, it may set analytics cookies such as _ga. The editor may also keep non-sensitive country preferences locally, while checkout attribution is limited to the current browser session.