Privacy Policy

Your Images Never Leave Your Device

Every image tool on this site runs entirely inside your browser. When you open a file, it is decoded onto a canvas on your own computer or phone and processed there by JavaScript and WebAssembly. The file is never uploaded to us, never stored on our servers, and never seen by anyone. Close or reload the page and it is gone from memory; there is no image of yours for us to delete, because none ever arrived. This applies to background removal and image enhancement too — both run on your device. This promise covers your images: the usage measurement described further down, and the sign-in that only the feedback form needs, are separate matters with sections of their own.

• Using the tools needs no account: there is no sign-up, no login, and we never ask for your name, email address or payment details to compress, resize or convert anything. Signing in with Google is needed only if you want to send feedback and read our reply, and when you do we store your Google account identifier, email address, display name and profile picture, together with the times of your first and most recent sign-in, so that a feedback thread has an owner. A report itself also carries three technical details: the address of the page you were on when you sent it, the user-agent line your browser attaches to every request, and which language version of the site you were reading. They are there for one reason — without knowing where you hit the problem and in which browser we usually cannot reproduce it, and without the language we cannot reply in yours.
• We do not receive your filenames, your image contents, or anything derived from your image pixels.
• One tool is a genuine exception, and it is worth being precise about it: HTML to Image asks you to type a web address so it can load that page and photograph it. That address — not an image — is sent to our server to make the request, and is not retained afterwards.
• An earlier version of this policy said images might be sent to outside AI providers for background removal or enhancement. That is no longer how these tools work, and this section describes what the site actually does today.

Advertising

This site is free to use and is funded by advertising. We use Google AdSense to display ads. Google is a third-party vendor and uses cookies to serve ads on this site.

• Google's use of advertising cookies — including the DoubleClick cookie — enables Google and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• Third-party vendors and ad networks other than Google may also serve ads on this site and may use their own cookies to do so. We do not control those cookies.
• Advertising is targeted using general signals such as the page you are on, your approximate location and your browsing history — never using the images you process here, which we never receive.
• You can opt out of personalised advertising at any time using the links below. In the European Economic Area, the United Kingdom and Switzerland, the consent banner shown on your first visit refuses advertising cookies outright before any is set.

• Google Ads Settings — turn off personalised ads from Google
• How Google uses information from sites that use its services
• Digital Advertising Alliance — opt out of many ad networks at once
• Network Advertising Initiative — member opt-out page

Analytics

Two systems measure how the site is used. One is Google Analytics 4; the other is our own first-party measurement, which records the same kinds of events on our own infrastructure so that we do not depend on a single vendor. Both are deliberately configured to measure usage, not people, and both obey the same single analytics consent signal — there is no second switch, so accepting or refusing analytics storage turns both on or off together. Beyond the page and tool details listed below, the first-party system also records the country inferred from your IP address, whether you are on a phone, a tablet or a computer, which site sent you here, and how long a page stayed visible. In the European Economic Area, the United Kingdom and Switzerland both stay switched off until you accept, apart from the identifier-free visit count described below; everywhere else they are on by default, and the link below opts you out of Google Analytics specifically.

• What is sent: the page path you viewed, your language version, which tool you used, whether you started, finished or downloaded a result, how many files were in the batch, and their total size in kilobytes. Google Analytics additionally receives, for each ad space on the page, whether an ad loaded, came back empty or was blocked, so we can tell which placements work.
• What is never sent: filenames, image contents, thumbnails, or anything computed from your image pixels.
• Google Analytics 4 does not log or store IP addresses. Our own collection endpoint unavoidably sees your IP address — every server that receives a request does — but it is used once to infer your country and then discarded: it is never written to a log, a database or a measurement record. From neither system can we identify you personally.
• Even if you refuse analytics, we still count the visit. That count carries no identifier of any kind, reads and writes nothing in your browser’s storage, and records only the page path, your language version, the country and how long the page stayed visible — there is nothing in it that could lead back to you or be joined to another visit. It is how we know how many people a page reaches and how long they stay; visitor counts and return rates are the only figures drawn solely from visitors who accepted, because they are the only ones that need a device identifier.

• Google Analytics opt-out browser add-on

Your Consent Choices

What happens on your first visit depends on where you are. In the European Economic Area, the United Kingdom and Switzerland we ask before setting any non-essential cookie, and until you accept, advertising and analytics storage are switched off at the source using Google Consent Mode — Google’s tags are told not to store or read cookies rather than simply being asked politely. Everywhere else that opt-in rule does not apply, so advertising and analytics start enabled and you can switch them off at any time using the opt-out links on this page.

• Choosing "Essential only" leaves advertising and analytics storage denied. The tools all keep working — none of them needs a cookie to function.
• Choosing "Accept all" grants advertising and analytics storage, and personalised advertising becomes possible.
• If you are in the European Economic Area, the United Kingdom or Switzerland, you are shown a Google-certified consent message that records your choice for our advertising partners.
• If you were shown the banner, you can change your mind at any time by clearing this site’s data in your browser settings, which removes the stored choice and brings the banner back. If you were not shown one, the opt-out links in the Advertising and Analytics sections do the same job.

Cookies and Local Storage

Cookies and browser local storage are used for three separate purposes here, and they are worth keeping apart because only two of them need your permission.

• Essential storage: your cookie choice, kept in your browser’s local storage. It is not sent to any third party and is not used to track you. It is set regardless of your choice because the site cannot remember your decision otherwise. Signing in adds a cookie of its own, described further down this list.
• Advertising cookies: set by Google and other ad vendors, only after you accept. See the Advertising section above.
• Analytics cookies: set by Google Analytics, only after you accept. See the Analytics section above.
• Every browser lets you block or delete cookies through its settings. Blocking advertising and analytics cookies has no effect on the image tools.
• Analytics storage: only if you accept analytics, three small values are kept in your browser and nowhere else. pico-a-device, in local storage, is a random identifier that lets a return visit be told apart from a first one. pico-a-day, also in local storage, holds nothing but the current date; it is what lets us record one session-start event per device per day rather than one every time you open a page, and it is the only thing keeping our database writes down to a small fraction of what they would otherwise be. pico-a-session, in session storage, holds a random session number that lapses after 30 minutes of inactivity and disappears the moment you close the tab. None of the three holds your name, your email address or anything else about you, none is ever shared with an advertiser, and all three are written only after you accept — refuse analytics and not one of them is ever created, while clearing your site data or withdrawing consent removes them.
• Sign-in cookies, also strictly necessary: only if you sign in with Google — and only then — does the site set a cookie named pico_session, containing a random token and nothing else. It is what keeps you signed in, and without it staying signed in is simply not possible. It carries HttpOnly, so no script on the page can read it; SameSite=Lax, so it is not attached to the background requests other sites make; Secure whenever the connection is HTTPS; and no Domain attribute, which means it stays on this host and our admin subdomain never receives it. It lasts 30 days. A second cookie, __pico_oauth_state, lives for ten minutes during the sign-in round trip so we can check that the reply belongs to the request you started, and it is cleared the moment you come back. Neither is shared with anyone, neither is used to track you, and if you never sign in neither is ever set — signing out deletes the session on our side and clears the cookie on yours.

Third-Party Services

The complete list of outside services that can receive any information about your visit is short, and this is all of it.

• Google AdSense — serves the advertising that funds the site, and sets advertising cookies once you consent.
• Google Analytics 4 — measures usage as described above, once you consent.
• Cloudflare — hosts and delivers the site. As with any website, its servers process the technical details of each request, such as your IP address, browser and the page requested, in order to deliver the page and to block abuse.
• Google Fonts, self-hosted — the site’s typefaces are served from our own domain, so loading a page does not send a request to Google’s font servers.
• Google Sign-In — used only if you choose to sign in, which the feedback form needs and nothing else does. No Google sign-in code runs on the page; it is an ordinary navigation you start, after which Google tells us your account identifier, email address, name and profile picture, and we store those and nothing more.

Data Security

The strongest security measure on this site is architectural rather than procedural: because your images are processed on your own device and never transmitted, there is no store of user images to be breached, leaked or subpoenaed. The site is served exclusively over HTTPS. The third-party services listed above are responsible for the security of the data they collect under their own policies.

How Long Data Is Kept

Different categories are kept for different periods, and most of them are not ours to keep.

• Your images: not retained, because they are never received.
• Analytics data: retained by Google Analytics for 14 months, then deleted automatically.
• Advertising data: governed by Google’s own retention policies, linked in the Advertising section.
• Server request logs: retained briefly by Cloudflare for delivery and abuse prevention.
• Your consent choice: kept in your own browser until you clear your site data.
• Our own analytics data: individual events are kept for three months and then expire automatically; the daily totals computed from them are kept indefinitely, and those totals contain no identifier of any kind.
• Feedback and account data: your Google account identifier, email address, display name and profile picture, together with the subject and text of your tickets, the messages in each conversation, and the page address, browser user-agent line and language version saved with each report, have no automatic expiry. We keep them until you ask us to delete them — email privacy@picoimage.com and the account and its conversations are removed.

Your Rights

Depending on where you live you have rights over personal data held about you, and this section is only useful if it says plainly what we hold. There are two things. If you have ever signed in to send feedback, we hold your Google account identifier, email address, display name and profile picture, along with the messages in that conversation and the page address, browser user-agent line and language version recorded with each report; asking to see or delete any of it is a request we can genuinely act on — write to privacy@picoimage.com. If you accepted analytics, there is also the random device identifier described above; it carries no name and no address, so we can only erase it from our records if you send us the identifier itself, while clearing your site data deletes it from your browser and stops it being used at all. Your images remain the one category where there is truly nothing to retrieve, because none ever arrived. And your rights against Google, which does hold advertising and analytics data, are real and exercisable through the links above.

• If you are in the EEA or the UK, the GDPR gives you the right to access, correct, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time.
• You also have the right to lodge a complaint with your national data protection supervisory authority.
• If you are in California, the CCPA and CPRA give you the right to know what is collected, to have it deleted, and to opt out of the sale or sharing of personal information. We do not sell personal information. Personalised advertising may count as "sharing" under the CPRA, and declining advertising cookies in the consent banner opts you out of it.
• To exercise any of these rights, or to ask what we hold, email privacy@picoimage.com.

Children's Privacy

This site is a general-purpose set of image tools and is not directed at children. We do not knowingly collect personal information from children under 13, or under 16 in jurisdictions where that is the applicable threshold. If you believe a child has provided us with personal information, email privacy@picoimage.com and we will act on it.

Changes to This Policy

When this policy changes, the "Last updated" date at the top changes with it, and the previous wording is replaced rather than quietly amended. If a change materially affects how your data is handled — a new advertising partner, a new category of collection — we will surface a notice on the site rather than relying on you to re-read this page.

Contact Us

Questions about this policy, or about anything on this site, are welcome. Email privacy@picoimage.com for privacy and data protection matters, or support@picoimage.com for everything else. We aim to reply within five working days.