Privacy policy

Your images

We never receive them. Reading and stripping happen entirely inside your browser tab using WebAssembly and JavaScript. Your image, its pixels, its metadata, its GPS coordinates and its Content Credentials are read into memory on your device and discarded when you close the tab or dismiss the card.

This is not a policy commitment we ask you to take on faith. There is no route on this server that accepts a file — a test in the codebase asserts that the complete list of endpoints accepting a request body stays what it is. You can also open your browser's network tab and watch nothing leave.

What we store, if you have an account

Using the tool needs no account. If you create one, we hold:

• Your name and email address.
• A hash of your password — never the password itself.
• Your subscription status, held by Stripe and mirrored here.
• Your chosen default preset.
• An activity log: a verb ("inspected", "stripped", "batch"), a count and a timestamp. No filenames, no metadata, no thumbnails. The table has no column that could hold them.
• If you use passkeys or two-factor authentication, the public half of your passkey or an encrypted shared secret. Neither can be used to sign in as you from anywhere else.

Analytics

We count page views. That is a per-day tally of which pages were viewed, kept on our own server. There is no third-party analytics service, no tracking cookie, no device fingerprint, no IP address stored, and no way to link a view to a person or a session.

We also count errors by category — "a file could not be read", "the WebAssembly module failed to start" — so we can tell when something is broken. The counter records the category and nothing else: no message, no stack trace, no filename.

Cookies

One session cookie and one CSRF token, both strictly necessary to keep you signed in and to stop forged form submissions. If you tick "keep me signed in", a remember-me cookie as well. We set no advertising or analytics cookies, so there is no consent banner to dismiss.

Who else is involved

• Stripe handles payments if you subscribe. They receive your email and payment details; we never see your card number. Their privacy policy governs what they do with it.
• Our email provider sends transactional mail — password resets, receipts, address confirmation. Nothing else.

No one else. We do not sell, rent or share your data, and there is very little to share even if we wanted to.

How long we keep it

Account data lasts as long as your account. Delete your account from the account page and your record, presets, passkeys and activity log are removed. Page-view and error counts are aggregate from the moment they are written and are not tied to you, so they survive deletion — there is nothing in them to erase.

Your rights

Depending on where you live you may have the right to access, correct, export or erase your personal data, and to object to processing. Account deletion is available to you directly and takes effect immediately.

Changes

If this policy changes we will update the date at the top. If a change is material — particularly anything touching the promise that files stay on your device — we will say so plainly rather than quietly revising the page.

Questions, or a request about your data: hello@unsigned.app.