Privacy Policy
What we collect when you use image2img, including billing data, why, how long we keep it, and what you can delete.
Last updated Oct 27, 2026
This policy explains what image2img.net ("we", "us") collects when you use our image to image tool, what we do with it, and the choices you have. We try to keep it short and plain.
image2img.net is operated by an individual based in Hong Kong SAR. You can reach us at support@image2img.net.
What we collect
- Your photos and results. The photo you upload, the images we generate from it, and the text you type to describe the change (your prompt).
- Account details, only if you log in: your email address, your name, and your profile picture if you use Google sign-in. If you sign up with email and a password, we store a salted hash of the password, never the password itself.
- Usage counts. How many images you generated today, so we can apply the daily free limit, and how many credits you have used and have left if you buy a plan.
- Billing records, only if you buy something: the order or subscription ID, the amount and currency, the plan or credit pack, the payment status and the dates. We do not see or store your full card number (see "Payments and billing data" below).
- Technical data. Your browser type, device type and approximate location derived from your IP address, plus error and security logs.
- Device cookie and IP hash. An anonymous device identifier and a hashed form of your IP address, used for daily limits and abuse prevention (see "Device cookie and IP address" below).
- Analytics data: which pages you visit and which buttons you press. Google Analytics collects it only if you accept analytics cookies; Microsoft Clarity collects it without cookies until you accept (see "Analytics" below).
- Messages to us. If you email support, we keep your message and our reply.
We collect this data from you directly, from your browser, and from the services you choose to use with us (for example Google sign-in or our payment partner). We do not collect special categories of data on purpose. If your photo shows a face, we treat it only as part of the image and do not use it to identify anyone.
Why we use it
- To make the image you asked for and show you your versions.
- To apply the daily free limit, count your credits and keep the service available to everyone.
- To process your purchases, give you your plan and credits, handle refunds, and keep the records the law or tax rules require.
- To prevent abuse, fraud and content that breaks our Content Policy.
- To fix bugs and understand which parts of the product are useful.
Your photos and our AI provider
To generate an image, we send your photo and prompt to a third-party AI image provider. The provider keeps what we send for up to 72 hours and then deletes it. We choose providers that process your photo only to produce your result. We do not sell your photos and we do not publish them.
We also run an automatic safety check on uploaded photos and prompts. A blocked request does not use up a free image or a credit.
Payments and billing data
Paid plans and credit packs are paid for on a checkout page hosted by a third-party payment processor. Today that is Stripe (purchases are "sold through Link", Stripe's merchant of record service) or Creem. The partner acts as the merchant of record (the reseller of your purchase) and processes your payment and tax details as a separate controller under its own privacy policy. The checkout page shows which one is handling your payment.
- What the processor gets. Your payment details (such as your card number), your email and your billing details. They handle these under their own privacy policy. We do not store your full card number.
- What we keep. Only the billing record: order or subscription ID, amount and currency, plan or credit pack, payment status, dates, and the customer ID the processor gives us.
- Why. To give you what you bought, manage renewals and cancellations, handle refunds, prevent fraud, and meet our legal and tax obligations.
- How long. Billing records are kept for up to 7 years, as Hong Kong tax rules require, even if you delete your account or your creations. After that we delete them or remove what identifies you.
- Who we share it with. The payment processor, and only what is needed to take payment and handle refunds or disputes. We do not sell billing data.
How long we keep your images
- Without an account: your photo and results are deleted automatically after 2 days.
- With an account: every version you make is kept in My Creations for 30 days, then deleted automatically.
- With an active paid subscription: images you make while your subscription is active are kept for as long as it stays active. After it ends, they are deleted on the same schedule as any other logged-in user's (30 days). Buying a credit pack alone does not change how long images are kept.
- Delete them yourself, any time: open My Creations (
/my) and delete a creation. The original photo and every version are removed from our storage. Copies held by our AI provider expire within 72 hours as described above. Deleting a creation does not give back the free images it used. - Download anything you want to keep for longer. We do not keep backups of deleted images.
Device cookie and IP address
We set a small anonymous device cookie so that we can count your free images for the day, even when you are not logged in. We also keep a hashed version of your IP address (not the address itself) to apply per-network limits and to spot automated abuse. Neither is used to identify you personally or to show you ads. See the Cookie Policy for the full list.
Analytics
We use Google Analytics 4 and Microsoft Clarity to understand how people use the site. Google Analytics loads only if you press Accept on our cookie banner. Microsoft Clarity runs without cookies until you press Accept (each page view is counted separately), and uses cookies to link repeat visits only after you accept. They collect page views, clicks, scrolling, device and browser information. Clarity can record how a page is used (for example heatmaps and session replays); it masks form fields and we do not send your photos or prompts to either tool. You can change your choice at any time with "Cookie settings" in the footer, and you can also block these cookies in your browser or with a content blocker.
Who else handles your data
We use a small number of service providers to run image2img, and share data with them only as needed to provide the service. They may only use it for that purpose. We do not sell your data.
- AI image provider (APIMart). Receives your photo and prompt to generate your result. Keeps them for up to 72 hours.
- Cloudflare. Turnstile checks that a request comes from a person and not a bot. Cloudflare R2 stores your uploaded photos and generated images.
- Hosting provider. Runs our servers and database, and holds your account and usage records.
- Resend. Sends sign-in, verification and password reset emails (your email address and the message).
- Stripe (including Link) and Creem. Take payment as merchant of record (see "Payments and billing data" above).
- Google. Handles "Continue with Google" sign-in if you choose it. Also provides Google Analytics 4, but only if you accept analytics cookies.
- Microsoft Clarity. Shows us how pages are used. Until you accept analytics cookies it runs without cookies and counts each page view separately.
We may also disclose information if the law requires it, to protect our rights or other people's safety, or if the Service is sold or handed to another operator (in which case this policy would carry over, and we would tell you about any major change).
Where your data goes
We are based in Hong Kong SAR, and our providers run servers in other places, such as the United States and other regions. This means your data may be processed outside the country where you live. We pick providers that use reasonable safeguards, such as encryption, access controls and contracts that limit how they use data. Where the law requires a transfer mechanism (for example, for data from the EEA or the UK), we rely on one that fits, such as standard contractual clauses or the provider's own certified transfer framework. If you want more detail, email us.
How long we keep other data
- Images: as set out in the section above.
- Copies at our AI provider: up to 72 hours.
- Account details: until you delete your account.
- Billing records: up to 7 years (see "Payments and billing data").
- Usage counts and credit balance: while your account exists (or, for anonymous use, only as long as needed to apply the daily limit).
- Device cookie (
anon_id): 12 months, and you can clear it in your browser at any time. Hashed IP: only as long as needed to apply limits and spot abuse. - Cookie choice (
i2i_consent): 12 months. - Logs: error and security logs are kept only as long as needed to keep the service running and safe.
- Support emails: for as long as needed to answer you and to keep a record of the request.
When the time is up, we delete the data or remove what identifies you. We may keep data longer if the law requires it or if we need it to deal with a dispute or fraud.
Your choices and rights
You can delete your creations at any time, and delete your account in Settings. You can also ask us to see, correct or delete the personal data we hold about you, ask for a copy of it, or object to how we use it. If we rely on your consent (for example for analytics cookies), you can withdraw it at any time with "Cookie settings" in the footer.
Email us at support@image2img.net from the address on your account. We may ask you to confirm it is you. We will reply within 30 days, or sooner where the law requires it. If a request is complex, we may need longer where the law allows, and we will tell you. There is no charge unless a request is clearly unfounded or excessive. We may have to keep some billing records, as explained above, even after you ask us to delete your account.
We handle personal data in line with Hong Kong's Personal Data (Privacy) Ordinance. If you are in the EEA or the UK, we rely on these legal bases: performing our contract with you (making your images, running your account and purchases), our legitimate interests (keeping the service safe and fair and improving it, including cookie-free usage measurement with Microsoft Clarity), your consent (analytics cookies, where required), and legal obligations (tax and billing records). You also have the right to restrict how we use your data, to ask for it in a portable format, and to complain to your local data protection authority.
California residents
If you live in California, you have the right to know what personal information we collect and why, to ask for access, correction or deletion, and to be treated equally if you use these rights. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising. We do not use or disclose sensitive personal information to infer characteristics about you. Over the last 12 months we collected the categories listed under "What we collect", and disclosed them to the providers listed above for the purposes described. To use your rights, email us as above. You can have an authorised agent make a request for you, and we may ask for proof that they are allowed to.
Children
image2img is not meant for children under 13 (or under the age set by your local law, if higher). Our Content Policy does not allow photos of minors, and we do not knowingly collect data from children. If you think a child has given us personal data, email us and we will delete it.
Security
We use encrypted connections (HTTPS), private storage, hashed passwords, and limit access to the people and systems that need it. No online service is perfectly secure, and we cannot guarantee that your data will never be accessed or lost. Please keep your login details safe. If a breach affects your personal data, we will tell you and the authorities as the law requires.
Links to other sites
Our site may link to other websites, such as our payment partner's pages. We do not control them and this policy does not cover them.
Changes to this policy
If we change this policy, we will update the date at the top of this page. For significant changes we will also tell logged-in users by email or on the site.
Contact us
Questions about this policy or a request about your data? Write to support@image2img.net. We aim to reply within 30 days. image2img.net is operated by an individual based in Hong Kong SAR.