Privacy

Last updated 2026-09-18

The short version

Your pet photos never leave your computer. Every part of the image pipeline — decoding, background removal, cropping, resizing, the room previews and ZIP packaging — runs inside your browser. There is no upload step because there is no server to upload to.

What we do not have

• No copies of your photos, at any point, ever.
• No user accounts, passwords or profiles.
• No database of users, purchases or file history.
• No advertising trackers, no social pixels, no ad retargeting.
• No fonts or stylesheets loaded from anyone else’s domain.

What we do have

Page analytics

We count page views to know which guides are worth writing more of. This runs on Google Analytics, which sets a cookie in your browser and records the usual request metadata — page URL, referrer, approximate location from your IP address, and browser type. It is the only third-party script on the site, and it does not load until you move, tap, scroll or click, so a page you open and close reaches Google not at all.

Nothing you put into the tool is measured. No photo, filename, file size or result is ever sent to Google or to us — the analytics see the page, never the work.

Your browser’s own storage

Three things are stored locally, on your machine: the background removal model, cached in IndexedDB so returning visits download nothing; if you buy Pro, your license key and the timestamp of its last validation; and if you buy a single-photo pass, a note of which photo it covers and the Stripe checkout it came from. Clearing your browser data removes all three — which costs you only the re-download for the model, but does lose a pass.

Payment details, held by Stripe

If you buy a Pro license, Stripe processes the payment and holds your email address and card details under their own privacy policy. We never see your card number. We use your email only to send the license key and, if you ask us something, to reply.

Server contact, once in a while

Two things reach a server of ours, and neither carries your photo. The first is license validation: a Pro key is checked against Stripe when you enter it and roughly once a day thereafter, and that request contains the license key and nothing else — no photo data, no filenames, no image dimensions.

The second is the single-photo pass. Because a pass covers one photo rather than one person, buying and checking one sends a fingerprint of that photo — a short hash computed from the file’s bytes on your machine — along with the Stripe checkout reference. A hash is one-way: it identifies the same file again if you load it, and it cannot be turned back into the photo or tell us anything about what the photo shows. The image itself is never part of the request, and we keep no record of the hash beyond the Stripe checkout it is attached to.

Where the large files come from

The background removal model and the WebAssembly runtime are served from a content delivery network on a subdomain we control. Fetching them tells the CDN your IP address, as any file download would. It tells it nothing about the photo you are working on, because the photo is never part of the request.

Changes

If this policy changes in a way that affects what happens to your data, the date at the top changes and the change is described here rather than quietly folded in.