Last updated: October 2026
1. Your images
This is the part that matters. When you use any PicToolBox tool, the image you select is read by JavaScript on your own device and processed entirely in your browser's memory using the Canvas API. It is never transmitted to our servers or to any third party. We do not receive it, we cannot view it, and there is no copy of it anywhere except on your own computer. Closing the tab discards it.
2. Information we do collect
We do not require an account, so we do not hold names, email addresses or passwords for ordinary use. If you email us through the contact page, we receive whatever you choose to write, and we keep it only as long as needed to answer you.
Credits are held on our server against an anonymous session id, not a person: no name, no email, no password. To give the three free credits once per network and to stop automated abuse, we store a salted SHA-256 hash of your IP address, never the address itself. The hash cannot be reversed into an IP.
Like most websites, our hosting provider automatically records standard server logs when a page is requested: IP address, browser type, referring page and timestamp. These are used for security and to understand aggregate traffic levels.
3. Cookies and local storage
The tools themselves work without cookies. The site sets exactly one first-party cookie, ptb_uid,
which holds a random id signed with a server secret and is used only to keep your credit balance attached to
this browser. It is HttpOnly, SameSite=Lax, and expires after a year. There are no third-party cookies and no
advertising cookies. The only third-party script on the site is Cloudflare Web Analytics, which our host injects
to count page views; it is cookie-free, records no image or form data, and builds no profile of you. You can
clear the cookie in your browser at any time; doing so gives you a fresh session and leaves any unspent credits
in the old one.
4. Analytics
We use Cloudflare Web Analytics, a cookie-free service that reports aggregate page views and Core Web Vitals. Aggregate statistics only — we do not build profiles of individual visitors and we do not attempt to identify you. Our own event counters (uploads, downloads, errors) are keyed to the anonymous session id, never to an account, and are used to see which tools work and which break.
5. Advertising
This site does not currently serve advertising. The pages contain an empty ad slot that stays empty unless an ad client is configured; no ad script is loaded and no advertising cookie is set. If advertising is introduced later, this section will be updated before any ad loads.
6. Children
This site is not directed at children under 13 and we do not knowingly collect personal information from them.
7. Your rights
We hold a credit balance and a hashed IP for each anonymous session, not a personal profile. You can ask us to delete the balance attached to a session id (the id is shown in the site's session response, and support can look it up from a redeem code) and we will remove that row. If you have emailed us and would like that correspondence removed, ask and we will delete it.
8. Changes
If this policy changes in a way that affects how information is handled, the date at the top of this page will be updated. Continued use of the site after a change constitutes acceptance of the revised policy.
9. Contact
Questions about this policy: see the contact page.