Privacy Policy

1. Information We Process

Depending on how you use PhotoDoIt, we process the photo you upload, the AI-generated results, the selected tool and options, and technical request information such as your IP address for rate limiting and abuse prevention. If you send feedback, we receive the email address you provide (if any), the feedback category, and your message. We do not require an account.

2. Photos and AI Processing

Your browser sends the selected image to our application endpoint to generate the requested result. The application sends the source image to OpenAI for image analysis and generation. Generated images are returned for preview and delivery. The browser uses temporary object URLs for local previews and revokes them when the image is replaced or removed; the application does not use those URLs as persistent browser storage.

When a result pack is generated, including before checkout, the generated full-size image files are written to a private Cloudflare R2 bucket. Cloudflare D1 stores the pack identifier, a hash of a guest access token, product and variant, object keys and content types, status, and creation and expiry timestamps. The application sets a seven-day access expiry and stops serving expired packs through its result endpoints. The current application has no self-service deletion control or automatic R2 object deletion job. Expiry should not be understood as confirmed physical erasure from storage, and we do not promise a deletion date for expired files. Contact support to request deletion; such a request requires manual review and handling under applicable law and operational recordkeeping requirements.

3. Payments and Customer Information

Payments are processed by PayPal. Payment credentials and billing details are entered with and handled by PayPal; PhotoDoIt does not receive or store full card numbers. Our application stores payment and delivery metadata such as PayPal order and capture identifiers, amount, currency, payment status, timestamps, and the associated result-pack identifier. PayPal handles its own payment records under its policies. For feedback sent through the website, the email, category, and message are submitted to Web3Forms so the message can be delivered to us.

4. Cookies and Technical Data

When a result pack is created, the application issues a random guest access token in a Secure, HttpOnly, SameSite=Lax cookie with a 30-day maximum age. The database stores a SHA-256 hash of that token rather than the token itself. The cookie lets the application associate a visitor with their result pack without an account. The application also uses request IP information for in-memory rate limiting and duplicate-request protection.

5. Service Providers

PhotoDoIt uses Cloudflare for application hosting, database and image storage; OpenAI for image analysis and generation; PayPal for payment processing; Web3Forms for feedback delivery; and Meta Pixel for page-view measurement and advertising analytics. These providers receive information needed for their services and process it under their own terms and privacy policies. The site-wide Meta Pixel may receive browser and page-view data when it loads.

6. How We Use Information

We use information to provide image generation, previews, payment verification and downloads; respond to feedback and support requests; protect the service against abuse; and understand site usage. We do not sell uploaded photos.

7. Security

Result images are stored in a private bucket and accessed through application endpoints that check the guest token and payment status. We use reasonable measures intended to protect information, but no online service can guarantee absolute security.

8. Your Choices and Requests

You may avoid submitting a photo or feedback, and you may contact us to ask about access, correction, or deletion of personal information. We will respond as required by applicable law. Some transaction records may need to be retained for payment, accounting, security, or legal purposes. To make a request, email support@photodoit.com.

9. Children and Sensitive Content

PhotoDoIt is not intended for children to use without an adult. Do not upload another person’s photo unless you have their authorization and any other legally required permission. Sexual, explicit, pornographic, or other NSFW content is prohibited, including content involving minors.

10. Acceptable Use

Use of the service is subject to our AI Acceptable Use Policy. It prohibits non-consensual imagery, exploitation, unlawful content, and uses that violate another person’s rights.

11. Changes and Contact

We may update this policy by publishing a revised version here. For privacy questions or requests, contact support@photodoit.com.