What stays, and for how long

FixPhotoQuality repairs photos. The service is operated by Mohamed Laghbar, an individual in Morocco. Questions about this notice go to [email protected]. To run a repair we have to hold the picture, the account it belongs to, and enough billing state to know which plan is active. This page says what that means in practice.

Account

A magic link or Google sign-in stores your email, an optional name and profile image from Google, and a session in the database. The free tool sets an httpOnly cookie so a daily credit limit can be enforced without an account. The theme choice lives in local storage on your device.

Photos

Originals and results are written to object storage, either a private directory on the machine running the app or an S3-compatible bucket such as Cloudflare R2. Twenty-four hours after the job is created, a sweep deletes the original object and the result object. Signed preview and download URLs stop working on that clock. We do not use your uploads to train a model, and we do not keep a gallery of them.

When the live provider is on, the file is also sent to Replicate so a hosted model can run. Replicate’s own terms cover that processing. If no token is configured outside production, a local preview runs on the server with sharp and the file does not leave for a model host.

Payments

Paddle is the merchant of record. Checkout and the customer portal happen on Paddle. We store a Paddle customer id, subscription id, price id, status, period end, and the credit balance we grant from webhooks. We do not store card numbers. The Paddle privacy notice covers the card payment.

Limits and logs

Create requests are rate limited by IP address in a short window. The server log may include an error from a failed model call. It should not include the image itself.

Your requests

To close an account or ask what is stored under an email, write from that address to the contact you publish with the deployment. Deleting the user removes sessions and linked provider accounts. Job rows can remain until their expiry without the user id.