Privacy Policy

What this covers

ImageEnhance is an AI photo tool operated at imageenhance.app from the Hong Kong SAR. This policy explains what we collect, what happens to the photos you upload, and which other companies are involved in processing them.

We have tried to write it so that you can actually tell what happens to your photo. The section below is the part most people care about, so it comes first.

What happens to a photo you upload

We do not store your original photo. When you upload an image, it is sent straight to the AI provider that runs the model you chose, encoded inline in that single request. It is not written to our storage, and it is not kept on our servers after the request finishes.

The result is stored. The enhanced image is saved to Cloudflare R2 so that it stays available in your library and the link keeps working. It stays there until you delete it. Signed-in users can delete any result from Settings → My Library, which removes it from your library immediately.

Your photos are never used to train models. We do not train on your images, and we do not grant anyone the right to. The AI providers we use (listed below) offer API access under terms that do not include training on API inputs. We also do not look through user images except when you explicitly send us one to investigate a problem you reported.

Anonymous use. You can enhance a photo without an account. In that case we store the result and a hashed IP-derived identifier for the free-quota counter, but no account details, because there is no account.

Who else processes your data

Running this service means other companies see some of your data. This is the complete list:

| Provider | What they receive | Where | | -------------------------- | ---------------------------------------------------- | ----- | | fal.ai | The photo you upload, for models run there | USA | | Replicate | The photo you upload, for models run there | USA | | Cloudflare (R2) | The result image, stored | USA | | Cloudflare (Turnstile) | Anti-abuse signals for anonymous requests | USA | | Stripe | Payment details, email, billing address | USA | | Resend | Your email address, to send you mail | USA | | Google (optional) | Your email and name, only if you sign in with Google | USA | | Google Analytics | Pages you visit, referrer, approximate location | USA | | Microsoft Clarity | A recording of your visit — see below | USA | | Vercel | Page load timings, pages you visit | USA |

Analytics is also self-hosted on our own server, which is why not every measurement in that list leaves to a third party.

About the Clarity recording. It captures how you moved through the page — mouse movement, clicks, scrolling and which fields you typed in. What you actually typed is masked before it is sent, and we use it for one purpose: to find where the tool is confusing or broken. If you would rather not be recorded, Microsoft's opt-out at clarity.microsoft.com/terms applies across every site that uses it.

Which AI provider receives a given photo depends on the tool you pick — for example colourisation and background removal run on Replicate, while upscaling and restoration run on fal.ai. Both are used purely as processors: they run the model and return the result.

We never sell your data, and we do not share it for advertising.

What we collect

• Account information — your email address, and your name and profile picture if you sign in with Google. Passwords are stored hashed; we cannot read them.
• Images — as described above: originals pass through, results are stored.
• Usage records — which tool you ran, when, the credit cost, and whether it succeeded. This is what your history and credit balance are built from.
• Payment information — handled entirely by Stripe. We receive the fact of a payment, the amount, and the last four digits of the card. We never see or store full card numbers.
• Technical data — your IP address, browser and device type, and the language your browser asks for. We use it for three things: preventing abuse, running the anonymous free-quota counter, and understanding our own traffic — in particular telling real visitors apart from the automated scanners that hit every new site. We do not use it to build a profile of you, and we do not combine it with data from anywhere else.

We do not use advertising trackers or third-party analytics profiling.

Cookies

We use cookies for two things: keeping you signed in, and remembering interface preferences such as your language and light/dark theme. There are no advertising cookies.

How long we keep things

| Data | Retention | | ------------------- | ------------------------------------------------------- | | Original uploads | Not retained — passed through and discarded | | Result images | Until you delete them, or until you delete your account | | Account and history | For as long as your account exists | | Payment records | 7 years, as tax and accounting law requires | | Anti-abuse records | 30 days | | IP addresses | 90 days, then erased from the record |

Traffic records older than 90 days keep the country and browser type but no longer contain the IP address, which is erased automatically.

When you delete your account, we delete your account data and result images. Payment records are kept for the period above because we are legally required to, and cannot delete them on request.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. If you are in the EU, UK, or another jurisdiction with data protection law — including California — you also have the rights that law grants you, such as objecting to processing or asking for portability.

To exercise any of these, email support@imageenhance.app. We respond within 30 days, and we do not charge for it. You do not have to explain why.

Our legal basis for processing, where the GDPR applies, is: performing the contract (running the tool you asked for, billing you), legitimate interests (preventing abuse of free quota), and consent where you have given it.

International transfers

The service is operated from the Hong Kong SAR, and the providers listed above are in the United States — so using ImageEnhance means your data is transferred to and processed in the US, wherever you are. Where the GDPR applies, these transfers rely on Standard Contractual Clauses with those providers.

Children

The service is not intended for anyone under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.

Security

Traffic is encrypted in transit. Secrets and payment credentials are encrypted at rest. Access to production systems is limited to the operator of the service. No system is perfectly secure, and we will not pretend otherwise — if a breach ever affects your data, we will tell you.

Changes

If we change this policy in a way that materially affects you, we will update the date at the top and notify signed-in users by email. Continuing to use the service after a change means you accept the updated policy.

---

ImageEnhance is operated from the Hong Kong SAR. Privacy questions: support@imageenhance.app.