Privacy

This page is the whole policy. It is short because the service keeps almost nothing.

Your photos

A photo you send is held in memory only for as long as it takes to answer, and is written to no disk. When the answer goes back, the photo is gone. There is no copy to look at later, none to hand to anyone else, and none to train on. The same holds for the questions you ask about a photo and for the answers you get back.

There is one exception, and it happens only when you ask for it: photos you upload on the upload page so that an assistant can work on them. Those are kept in the server’s memory for thirty minutes, or until you delete them on that page, whichever comes first, and are still written to no disk. What is kept is a smaller copy made on arrival — the photo turned the right way up and shrunk, with the information cameras store inside a photo file (such as place, time and device) removed — never the file you sent. Only your account can use them. A restart of the server loses them early.

A second way to hand an assistant many photos is a photo job: the assistant gets a short-lived pass that only sends photos into that one job, and a command that sends the photos in a folder on your computer straight here. Each photo is shrunk and tagged the moment it arrives, like any photo you send, and then dropped — the photo itself is never kept. What the job keeps, in the server’s memory and never on disk, is the answer for each photo: its tags, the numbers used to search and sort photos by meaning, a fingerprint of the file (so the same photo is not counted twice), and the name and folder path the command sent with it (and those of a copy of the same file sent under another name). A job and all of that are deleted 24 hours after the job was started, and earlier if the server restarts. Separately, a one-way fingerprint of each photo sent this way is kept for thirty days, so that sending the same photo again is not charged again; it is described under “What is counted”. Only your account, and links to its results that last fifteen minutes, can read them. Each photo counts against your allowance as one line in the usage record below, under the endpoint “/intake”.

Between your device and that server sits Cloudflare, the network provider that terminates the encrypted connection and hands the request on to us. Your photo crosses Cloudflare on the way in and the answer crosses it on the way out; we have turned on no Cloudflare feature that keeps request bodies, and Cloudflare handles that traffic under its own privacy terms. On the connection between your device and us, it is the only other party.

When you use the service from an assistant such as Claude or ChatGPT, the assistant’s provider is on the path too, under its own terms: the photos you give the assistant and what our tools answer are part of your conversation with it. A photo you attach to a chat in ChatGPT does not come to us from your device: our server downloads it from OpenAI’s file server (an address ending in oaiusercontent.com), using the link ChatGPT hands to our tool, and then treats it like any other photo you send — held in memory only while it is answered, written to no disk, and not kept.

What is counted

So that a key can have a monthly allowance, the service keeps a usage record. A line in it says when a request happened, which key made it, which endpoint it went to, how many images it carried, how large it was, whether it succeeded, and how long the server took to answer it. That is the entire line. The photo is not in it, the question is not in it, the answer is not in it, and neither is a summary of any of them — the part of the service that counts your usage is never handed your content in the first place.

Photo and question requests from the app are counted against your allowance in the app rather than against a key, so they never enter that record. For those requests the service keeps a second, shorter line, so that we can see when it is getting slow or full: when the request happened, which endpoint it went to, how many images it carried, how large it was, whether it succeeded, and how long the server took. There is no key in that line, no account, no installation and no address — it cannot say who asked — and the photo, the question and the answer are not in it either. Both records are deleted after thirteen months.

So that we can see each week which way people reach the service, every request that succeeds outside the app also adds a third line: the day it happened (not the time), which way it came in — this website, a key, a connected app such as Claude or ChatGPT, a photo job, or the upload page — and how many photos and questions it carried. There is no key, account, installation or address in that line, and nothing of the photo, the question or the answer. The same record also gets a line with only the day each time the app is refused because too many new installations came from one address within an hour. It is deleted after three months.

So that a request you send again is not charged twice — your connection dropped before the answer arrived and the client tried again, or a photo job was lost when the server restarted and its photos were sent again — the service keeps one more short record for each request that came in with a key, a connected app or a photo job, was charged and succeeded: the time, and a fingerprint of the request. The fingerprint is a one-way code worked out from the account, the endpoint and exactly what was sent (the photo file, or the request with its photo and settings), using a secret that is not stored with it. It is not the photo, the question or the answer, it cannot be turned back into any of them, and there is no name, email address, key or address beside it. If the same request arrives again within thirty days, it is answered again and not charged. Each fingerprint is deleted thirty days after it was made, and a restart does not clear them.

Logs

Apart from those three records, the part that answers your request writes no log at all. The layer in front of it, the one your browser actually connects to, keeps an ordinary web access log: the time, the address the request came from, which page or endpoint was asked for, and the result. It also keeps the ordinary headers your browser sends along with every request, such as which browser and language it says it is. Your key is stripped out of that log before it is written, and so is the one-time code in a link we emailed you; no photo, question or answer is ever in it — request bodies are not logged. Those files are rotated, and the old ones are thrown away. Cloudflare keeps its own connection logs for the traffic it forwards, under its own terms; we do not receive them.

Cookies and other sites

Analytics cookies are optional. Signing in sets one separate cookie: a small signed cookie that says you are signed in. It holds your email address, the id of your account here and an expiry date, nothing else. Your browser will not hand it to any other site, no script can read it, it is sent only over a secure connection, and it lasts a week or until you sign out, whichever comes first. Signing out deletes it. While you are on the sign-in page, and for the few seconds a sign-in is in progress, there is a second, temporary cookie that exists only to make sure the form you sent came from the page we gave you. It is deleted the moment you are signed in, and if you never finish signing in it expires by itself within the hour.

When analytics is enabled on this site, public pages offer a short consent bar and an “Analytics settings” control in the footer. Google Analytics loads only after you choose “Allow”. It uses cookies to count visits and returning browsers, and receives page addresses, the referring site, and browser and device information. We remove query strings and fragments from the page addresses we send. We do not send your photos, questions, answers, email address or API key as analytics data, and analytics is not installed on sign-in or account pages. Advertising features are disabled. Google handles analytics data under its privacy policy.

Your analytics choice is remembered in this browser’s local storage. Analytics cookies expire after six months unless renewed by another visit. You can choose “Decline” in “Analytics settings” at any time to stop further measurement and delete these analytics cookies. Declining does not affect the photo tools or signing in. Other page assets are served by this site or included in the page.

Signing in with Google

Signed out, the tool page allows each address a few free tries a day. To count them, the service keeps your address and how many tries it has used in memory, for that day only; it is never written to disk, and a restart forgets it. In the usage record those tries are one line each under the name “web-trial”, with no address in it. Signed in, the page's requests are counted on your account's key like any other.

Signing in is optional — the tool works without it for a few tries a day, and it exists so you can use your own allowance and look after your own key. If you sign in with Google, we ask Google for two things: your email address and the account id that identifies you to us. We do not ask for, and are not given, your contacts, your calendar, your files, your profile or your password. We never see your Google password: you type it to Google, not to us. What we keep afterwards is your email address, that account id, and which key belongs to it.

Signing up with an email address

You can also make an account with an email address and a password instead. Your password is never stored. What is kept is a scrambled form of it that cannot be turned back into the password — when you sign in, the same scrambling is done again and the two are compared. Nobody here can read your password, tell you what it was, or hand it to anyone; if you forget it, you set a new one rather than recover the old one. Each account is scrambled separately, so two people who chose the same password do not look alike in our files. Change your password and the old scrambled form is replaced.

An email address and a password are the whole account. What we keep is that address, whether it has been confirmed, the scrambled password, which key belongs to it, which ways you can sign in with it — a password, Google, or both, and for Google the account id it gave us — and when each of those things happened. One address is one account: if you sign in with Google using the same address you signed up with, it is the same account and the same key, not a second one.

Email we send you

From the website, three messages exist, and you will normally see only the first two: one to confirm the address when you sign up, one with a link to set a new password when you say you have forgotten it, and one line telling you that your address is already taken here — that last one goes out when somebody tries to sign up with your address, so that you hear about it rather than they do. Each is written as plain text: one link, written out as an address rather than a button, plus a sentence or two saying how long the link lasts. The mail service may still wrap it in a simple HTML version on the way out; we ask it not to record when a message is opened or which link is followed. A link stops working after a day, or an hour for a password link, and the password one stops working as soon as it has been used.

From the EyeSay app, when you create an account or reset a password with your email address, the message carries a six-digit code instead of a link; the code works for ten minutes and only once. If that address cannot do what was asked — it has no account to reset, or it already has one — the message carries no code, only a sentence pointing you back to signing in, creating an account or resetting the password in the app.

Nothing else is ever sent to that address: no newsletter, no product mail, no reminders. The messages are handed for delivery to Brevo, a mail company based in France, in the European Union, the mail service that carries them for us. To deliver them it sees what any mail carrier sees: the address, the message itself (link or code included) and the delivery record — when it was sent, and whether it arrived or bounced. Nobody else is given the address or the message. Replies to these messages are not read: write to the address at the end of this page instead.

Keys and email

An API key is stored only as a one-way hash, so the key itself cannot be read back out of our files — if you lose it, we issue a new one rather than look up the old one. The account page can show you the first and last few characters of your key, because those few characters are kept alongside the hash so you can tell one key from another; they are not enough to use the key. If you email to ask for a key, that email is kept so we can answer it and reach you about the key afterwards.

Apps you connect

You can connect an app, such as an AI assistant, to your account so that it can use this service for you. You choose to do that on a page here, signed in, and you can disconnect it from your account page at any time; disconnecting ends its access at once. For each connected app we keep the name it gave itself, the address it asked to send you back to, which account connected it and when, and one-way hashes of the passes it was given — the passes themselves cannot be read back out of our files. A pass lasts an hour, and the one it uses to get a new pass lasts thirty days. Setting a new password or deleting your account ends every connection.

What a connected app sends counts against your account’s monthly allowance and appears in the usage record described above under your account’s key, like anything else you send. The photos and answers themselves are handled exactly as above. When you attach a photo in such an app instead of uploading it here, the app gives us a short-lived link and we download the photo from the app’s own file storage; from then on it is handled exactly like a photo you send us, and nothing of it is kept. What the app does with the answers it gets back is up to the app and its own privacy terms.

Buying photos

Photo packs are sold by Lemon Squeezy, which acts as the seller: it takes the payment, handles tax and sends the receipt, under its own privacy terms. We never see your card or bank details. From each order we receive and keep which account it is for, which pack, the order’s identifier and whether it was refunded, so that the photos can be added to your account and taken back if the order is refunded.

Changes

If this policy changes, the version on this page is the one that applies.

Contact

PhotoTagger accounts and purchases

The iOS app can be used without signing in. A random installation identifier is hashed for usage limits. When you sign in, installation usage is linked to your account and shared across your devices. The app stores its session in the device Keychain; the server stores only a hash, with a 30-day expiry. Signing out revokes that session. Your email and password are handled by the same account system described above.

Apple processes membership payments. We verify Apple's signed subscription transactions and keep the account association, transaction identifier, expiry and revocation status needed to provide or restore membership. We do not receive or store your payment-card details. Monthly counters and request/input digests prevent duplicate charges; they contain no photos, questions, answers, tags or search vectors. This billing metadata is linked to your account when signed in. Existing results remain on your device after a subscription ends. You can permanently delete your account in the app's Account settings after confirming your identity. This removes the profile, password, linked Apple identity, API keys, native sessions and membership association. Signing in with Apple uses a one-time code verified directly with Apple; deletion of an Apple-linked account also revokes Apple's authorization. Verification emails use short-lived, single-use codes. Limited one-way session revocation records prevent old sessions from returning, and installation counters retain free usage without an account association. Photos and results already saved on your device remain there. Cancelling an Apple subscription must also be done in your Apple account; account deletion can proceed without waiting for cancellation.

Questions, a request to delete the email you sent us, or a request to close your account and the key on it: support@eyesay.app.