Privacy

What we collect

The photographs you upload, and the results produced from them. This is the only thing we ask for, and you can use most tools without an account.

Your email address, if you make an account. Accounts are handled by Clerk, who also hold whatever you used to sign in with, such as a Google account.

Your IP address, for two things. It is stored against a counter of how many jobs it has run today, which is what stops one person running the site up an unpayable bill. It is also recorded against each job you run, as part of the next paragraph.

Where and what you ran it from. When you run a tool we record, against that job: your IP address, the country, region, and city that Cloudflare works out from it, your browser and operating system and whether you are on a phone, your browser's timezone, and its language. We do this to understand who is actually using the site, which tools matter in which countries, and whether the six languages we translated it into are the right six.

Two things about that, because it is the most intrusive thing on this page. It is deleted with the photographs, on the same seven or thirty day schedule, and not kept with your billing history. And it is never used to build a profile of you across visits: there is no identifier tying one job to the next, so two runs a week apart are two rows and not a person we are following.

How the site is used. We count visits with Cloudflare Web Analytics, which records the page, the site that sent you here, and the rough details of your browser and country. It is how we find out which tools people actually want.

It is deliberately the incurious kind. It sets no cookie, stores no identifier in your browser, and does not fingerprint your device, so it cannot tell whether two visits were the same person, and it cannot follow you to any other site. That is also why you are not being asked to agree to it: there is nothing stored on your device to ask about. It never sees a photograph, a result, or a file name, because it is not given them.

We chose it over the better known analytics for exactly that reason, and it is still what counts your visit. It is not the only thing on the site any more, and the two below do set cookies, so read those too rather than taking this paragraph for the whole story.

What you type into the chat, if you open it. The chat in the corner is run for us by ChattyPie, and they hold the conversation. Anything you put in it goes to them, so please do not paste anything there you would not want a support tool to keep. It is not given your photographs.

The chat stores something on your device without asking. When it loads it saves a random identifier called _cp_bid in your browser, which is how a conversation you started yesterday is still there today. It is not a cookie, but it does the same job, and it is the reason this paragraph exists rather than a sentence saying nothing is stored. It carries no name, no email, and nothing about what you did on the site, and it is not used for advertising. Clearing your browser storage removes it, and the conversation with it.

What you tell us about a result, if you answer the question under it. Every finished photograph asks how it went, and the two answers that report something wrong offer a box to say what happened. That answer and anything you type into the box are stored against that job, and kept after the photographs themselves have been deleted: it is how we find out that a tool is producing something it should not, which nothing here can measure on its own. It is read by us and by nobody else, and the box is optional, so please do not put anything in it you would not want kept.

How you use the pages. We use Microsoft Clarity, which records how people move through the site: where you click and scroll, and a replay of the pages as you used them. It is how we find out where a tool is confusing rather than guessing from the numbers.

It sets two cookies, _clck and _clsk, and one entry in your browser's session storage. They are what let it tell one visit from the next.

Your photographs are hidden from it. Every place a photograph appears is marked so that Clarity records a blank shape where the picture is: the preview while you are choosing, the result, the mask editor, and the list on your account page. This matters more than it sounds, because the address of a result is a temporary key to that file, and a recording that captured one would be handing your photograph to anyone who could watch the recording.

Nothing else. There are no advertising trackers and nothing here is sold or shared for marketing. Besides the two above, the cookies are the one that keeps you signed in and one anonymous identifier that lets you see your own results before you have an account.

Who else sees your photographs

A photograph cannot be processed without being sent to the model that processes it. When you run a tool, your photograph is sent to fal.ai, who run the AI models on their own hardware, and it returns as a result. They are a company in the United States, so this involves your photograph leaving Europe.

We do not use your photographs to train anything, and we do not license, sell, or publish them.

The other companies involved in running the service:

• Cloudflare R2 stores the uploads and results. The buckets are created under Cloudflare's European jurisdiction, so the files themselves are held in Europe.
• Neon hosts the database, which holds your account, your credit history, and a record of which tool each job ran. It does not hold your photographs.
• Clerk handles sign in and holds your email address.
• Cloudflare Turnstile may show a challenge to prove you are not a script. It sees your IP address.
• Cloudflare Web Analytics counts visits. It sees the page you are on and the request that fetched it, and it stores nothing on your device.
• ChattyPie runs the chat. It holds the conversation and it is the one thing here that stores an identifier on your device. It is not given your photographs.
• Microsoft Clarity records how people move through the pages. Photographs are masked out of what it sees. It sets two cookies.
• Hetzner hosts the servers that run the site.

How long anything is kept

• Photographs and results: seven days if you ran the tool without an account, and thirty days if you were signed in. Both the upload and the result are deleted automatically from storage. This is not a manual process and there is nothing you need to do.
• The record that a job ran outlives the files: which tool, when, and what it cost in credits. It is kept because it is your billing history. The photograph is gone.
• IP addresses in the abuse counter: fourteen days, then the counter and the address in it are deleted.
• What we recorded about the device and place a job came from: the same seven or thirty days as the photographs, deleted by the same sweep at the same time. The billing record of the job stays; the address, the city, and the browser attached to it do not.
• Video projects: 30 days after the last time you changed one, by default. The files go; the brief, the plan and the conversation stay. There is more about this in the next section.
• Your account is kept until you ask us to delete it.

Video projects

The video studio keeps two different kinds of thing, and they do not last the same length of time.

What is kept as text: the brief, the plan, the transcript and the cut. The cut is a list of what goes where rather than the footage itself, so all four are small and none of them is a picture of anybody. They survive the sweep, which is why a project you come back to still says what it was for and what was decided.

What is stored as files: references, uploads, generated stills and clips, music, voice and every export. These are the megabytes, and these are what the sweep deletes on the schedule above.

Pictures of people. A reference you label as a person is stored with the consent sentence you agreed to and the version of that sentence published on the day, so what was attested to can be produced again later. It is not used to train anything, and it is deleted with the rest of the project's files.

How a project is emptied. The files are deleted first, and only then the rows that point at them, so nothing is ever left in storage with nothing naming it. A project that has been emptied still opens and says so: you can read the brief, the plan and the conversation, and nothing further can be made in it. Deleting a project yourself does the same thing sooner. It leaves your list at once, and its files go with the next sweep rather than waiting out the window above.

There is also a ceiling on how much one account may store at a time, which is a limit on files rather than on projects. When you reach it the studio says so and refuses to store anything new until something has been deleted or swept.

Your rights

If you are in the United Kingdom or the European Economic Area, the UK GDPR and the GDPR give you the right to ask for a copy of what we hold about you, to have it corrected, to have it deleted, and to object to how it is used. Those rights are not conditional on being in those places: ask and we will do it.

The lawful basis for processing your photograph is performing the service you asked for. The lawful basis for keeping IP counters is our legitimate interest in not being bankrupted by abuse. The lawful basis for recording the place and device a job came from is our legitimate interest in understanding who uses the site well enough to run it, which is why that record is kept for days rather than years and is never joined up across visits. If you would rather we did not, write to the address below and we will delete it.

To ask for anything, or to complain about how this is handled, write to us at [email protected].

Children

PhotoTools.ai is not intended for children under 13, and we do not knowingly collect anything from them.

Changes

If this changes in a way that affects what happens to your photographs, the date at the top changes and we will say so on the site rather than quietly editing the page.

Terms of service and acceptable use are separate documents.