Privacy Policy

Last updated 14 November 2026

Draft: this text describes how the service works today but has not yet been reviewed by a lawyer. Items in [square brackets] are still to be filled in.

This policy explains how PFPDrip (pfpdrip.com), operated by [Operator legal name], [Registered address] (“we”), handles personal data. Contact: [contact email].

The short version

• The editor, background remover, circle crop, resizer and avatar creator run in your browser. Your photos are not uploaded when you use them.
• AI generation does send your photo to an AI provider. We keep uploads and results for 24 hours, then delete them, and we do not use your photos to train models.
• The free gallery avatars are ready-made files made from our own descriptions. Downloading one does not send us any personal data beyond a normal web request.
• An account stores your email and a hashed password. We do not sell personal data and do not run ads.

What we collect

Without an account

• Photos you edit in the browser tools: processed on your device only.
• Saved avatars: stored in your browser's local storage on your device, not on our servers. Clearing site data removes them.
• AI images without an account: the first time you generate an image we create a temporary guest record linked to your browser by a cookie. It contains no email or name. The cookie is set when you first generate an image, and it is essential for that feature. To enforce the daily free limit the record also holds a short one-way tag derived from your network address (the address itself is not stored). Guest records and tags are not used for anything else.
• Text you type on the home page: if you describe an avatar in the box on the home page and press Generate, that text is placed in the address of the AI generator page. It can therefore appear in your browser history and in our and our host's server logs. Nothing is generated until you press Generate again on the AI page. Do not put personal details in a description.
• Technical data: our host and software may log your IP address, browser type and the pages you request, for security, abuse prevention (rate limiting) and keeping the site running.

With an account

• Account data: email address, optional name, and a password stored only as a one-way hash. A sign-in cookie identifies your session.
• Credits and activity: your credit balance and history, and a record of each AI generation (style, status, time, any error). Site administrators can see this to run the service and help you.
• Photos for AI generation: the photo you upload and the image we generate, stored temporarily as described below.
• Text for AI generation: if you describe an image in words, that text is sent to the AI provider and kept with your generation record while your account exists. Identical descriptions can reuse a stored result for up to 24 hours, which means another user who types exactly the same description and style may be shown that image. Do not put personal details in a description.

How we use it

To provide the features you ask for, keep accounts and credits accurate, prevent abuse, fix problems and keep the Service secure. If we use analytics in future we will ask for consent where the law requires it; analytics are currently switched off.

AI generation and retention

When you generate an image, we send your photo and the chosen style to our AI provider (Cloudflare Workers AI, with Pollinations as a backup) to create the result. Your uploaded photo and the generated image are deleted about 24 hours after upload. Deletion runs on a schedule, so it can be slightly later. We do not use your photos to train models and do not ask the provider to; the provider's own terms and privacy policy also apply to its processing. Credit and job records (without the images) are kept for as long as your account exists so your balance and history stay correct.

Who else handles data

• Hosting and storage providers that run the site, database and file storage, including storage for the gallery images.
• The AI provider named above, only for AI generation.
• A content delivery network that serves the background-removal model to your browser the first time you use that tool, so that provider can see your IP address and that request.

We do not sell your data. We may disclose it if the law requires, or to protect the Service and its users.

Cookies and local storage

We use essential cookies only: one keeps you signed in, and the same kind of cookie links a guest record to your browser when you first generate an AI image without an account. We also use local storage for avatars you choose to save. We do not use advertising or cross-site tracking cookies.

Security

Passwords are hashed, sessions are stored as hashes, connections should use HTTPS, and access to administration is restricted. No system is perfectly secure, so please use a strong, unique password.

Your choices and rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to complain to your data protection authority. To use these rights, or to have your account and its records deleted, email [contact email]. There is not yet a self-service delete button, so requests are handled by email. You can remove saved avatars at any time by deleting them in the avatar creator or clearing your browser's site data.

Children

The Service is not meant for children under 13, and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards. [Describe the safeguards once the hosting and AI providers are chosen.]

Changes

We will update this page when our practices change; the date above shows the latest version. See also our Terms of Use.