Privacy policy

What we collect

The photo you upload, the document type you select, and the alignment data needed to generate your photo. To stop abuse we also keep a per-day counter of free generations, keyed by a one-way hash of your IP address — the address itself is never stored. Purchased credits are stored against your order, not against your browser, so clearing cookies does not delete what you paid for. If you buy something, the payment provider gives us the email address on the receipt and we keep it with the order, so that we can refund it or let you re-open the purchase on another device.

How long we keep it

Uploaded photos and generated outputs are deleted within 24 hours. We do not keep archives of your photos. Order records (what you bought and how many credits are left) are kept for as long as your credits are valid, so that a refund can be applied and so that you can re-open your purchase on another device.

Who processes your photo

Your photo never touches our own disk: it is held in memory for the length of one request and handed straight back to you. A few outside services handle parts of the job, and we name all of them:

• Background removal

  Replicate (birefnet model), United States

  Receives the cropped photo to remove the background. It is deleted from their side when the prediction finishes.

• Orders, credits and the daily counter

  Upstash Redis

  Holds what you bought, how many credits are left, and the hashed address behind the daily free counter. No photos.

• The human check on free generations

  Cloudflare Turnstile

  Sees the request that carries the check, never your photo.

• Hosting and payments

  Vercel, and Creem as the merchant of record for card details

  Runs the site and takes the payment. Card numbers never reach us.

What we never do

We never use your photos to train AI models, never sell them, and never share them with advertisers. The only external service that may process your photo is the background-removal provider strictly needed to generate the result.

Your rights

If you are in the EU/EEA (GDPR) or California (CCPA), you may request access to or deletion of your data at any time by contacting [email protected]. Since photos are deleted within 24 hours, requests beyond that window are already fulfilled.

Cookies and local storage

One cookie is strictly necessary: the session id (idphoto_sid) that stops abuse, counts your free generations, and ties a purchase to you. It is HttpOnly, expires after a year, and it is set as part of the core service — which is the legal basis for it, because the service cannot run without it. Clearing it costs you a session, not your purchase: purchases are keyed to your order and can be re-opened from the receipt link on any device. We place no third-party advertising or cross-site tracking cookies. The only other storage on the site is one value in your browser's local storage (__va_attribution) written by Vercel's analytics, which records which channel brought you here; it is not used for advertising. If that ever changes, we will ask for your consent before placing anything new.

Children

Baby and infant passport photos are a core use case. Photos of children are handled exactly like all other uploads: processed for generation, then deleted within 24 hours.

Transfers outside the UK and EU

Some of the services above run in the United States, so a photo uploaded from the UK or the EU is processed there. Where that happens it is covered by the provider’s standard contractual clauses and, where it applies, an adequacy decision. If you would rather your photo never left your region, email us and we will explain what is possible.