Privacy Policy

Your photos stay on your device

Every tool runs inside your own browser, or in our iPhone and iPad app. The photos, PDFs and other files you open are processed on your device and are never uploaded to us or to anyone else. We cannot see them, and we keep no copies. Once a tool page has loaded, most tools keep working even if you go offline.

The only pictures we ever keep are ones you choose to save to your account: a signature or initials, or the logo in a brand kit. They're encrypted, and kept only so they work on all your devices (see Accounts).

Blur Faces and Pixelate can find faces for you. That also happens on your device: a small face-finding model is downloaded from this site and runs in your browser. It only marks where faces are so they can be covered. It doesn't recognise who anyone is, and nothing about the faces is sent or kept.

Photo Send

Photo Send moves photos directly from one of your devices to another. The photos travel straight between the two devices, encrypted, and never pass through or stay on our servers.

To introduce the two devices, our server briefly passes a few small connection messages between them. Devices on the same Wi-Fi find each other because they share an internet address. We use that address only while the page is open, to group nearby devices. Other devices only ever see the type of device and a name: if you're signed in, your email partly hidden (like al•••@gmail.com), so you can tell it's yours but others can't read it; if not, a random name like Blue Fox. We don't keep these messages, the names or the address. To stop abuse, we count how many sends each account makes per day, and how many codes are tried from each connection (as a one-way code, not the address itself). Those counts are deleted after 35 days, the same as the daily download counts.

Scan to PDF's “use your phone as the camera” works the same way: the QR code holds a one-time random code, our server only introduces your phone to your computer, and each photo goes straight between them. No account is needed, and the photos are never kept.

Accounts

You can use the site and the app without an account. If you create one, we keep:

• your email address, so you can sign in and receive receipts;
• your first name, if you give one, so the site can say hello (“Good morning, Wendy”). It's also shown on your invite link, if you share one. You can change or remove it on your Account page;
• your password, if you choose to set one, stored only as a salted PBKDF2 hash that cannot be turned back into the password;
• your credit balance, Pro plan, purchases, credit history and favourite tools;
• your saved signatures and initials, if you choose to save them. They're encrypted, kept only so they work on all your devices, and only ever shown to you;
• brand kits, if you have Pro and choose to make one: the name, logo, colours, font and text you add. The logo is encrypted. They're kept while you have Pro, until you change or delete them. If Pro ends, they're kept for 30 more days so you can download them (we email you), then deleted;
• what you mostly use photos for, if you tell us, so we can show you the right tools first;
• your invite code, and who invited you, if you use Invite friends;
• a one-way code made from your device's random number (see Free limits), so invites and free trials are fair;
• sign-in sessions, so you stay signed in on your devices.

Sign-in codes and links are single use and expire quickly. You can sign out of every device at once from your account page.

If you sign in with Google or Apple, we keep only your email address, your first name and a private ID number for your Google or Apple account, so the same account always opens the same My Photo Tools account. We don't keep your profile picture, and we never receive your contacts or password. With Apple, we also keep a key Apple gives us, so we can disconnect your Apple sign-in when you close your account. If you use Apple's Hide My Email, we only ever see the private address Apple gives us.

Payments

On the website, payments are handled by Stripe. Your card details go straight to Stripe and never touch our servers. Stripe tells us what was bought, the amount, and the country of the card, so we can add your credits or Pro, show your receipts and meet our tax obligations.

In the iPhone and iPad app, you pay through Apple, and Apple processes the payment. Apple tells us what was bought, the price and the currency, so we can add your credits or Pro. We never see your payment details.

We keep a record of each purchase, from the website or the App Store, for 7 years (see How long we keep things).

Support messages

When you contact us through the website, the app or at hello@myphototools.com, we keep your message, your email address and our replies so we can help you. A problem report from the app also includes the app version, the iOS version and the device model, so we can look into it. Attachments sent by email aren't kept, so please describe what you see instead. We use all of this only to answer you.

Free limits and abuse protection

To keep the free plan fair, we count free downloads each day. To do this we store a one-way code made from your internet connection's IP address, and one made from a random device number kept in your browser or the app. We never store your IP address itself. We use the same codes to make sure welcome credits and the free Pro trial are given once per person.

Sign-up and contact forms are protected by Cloudflare Turnstile, which checks that you are a person and not a bot. We also block throwaway email addresses from sign-up.

Cookies and storage

We use a small number of cookies and browser storage items, all for running the site:

• mpt_session: keeps you signed in. It cannot be read by page scripts.
• mpt_in: a simple yes or no that tells the page you are signed in. It holds nothing else.
• mpt-device (browser storage): a random number used for the daily free count.
• Small preferences, such as your passport country, remembered in your browser only.
• Google Analytics cookies, on the website only, which tell us which pages are visited, in total. See below.

You can clear all of these at any time in your browser settings.

Services we use

We share only what each service needs to do its job:

• Cloudflare hosts the website and our database, and provides Turnstile.
• Stripe processes payments on the website.
• Apple processes payments in the app.
• Resend sends our emails, such as sign-in codes, receipts and support replies.
• Google and Apple handle sign-in if you choose “Continue with Google” or “Continue with Apple”. We keep only your email address, your first name and a private ID number from them.
• Cloudflare and Google connection helpers (known as STUN) let two devices using Photo Send find a direct route to each other. They see your internet address, and nothing else.
• Google Analytics shows us how the website is used overall: pages visited, device types and rough location. It's used on the website only, never in our app, and it never receives your photos, files, email address or sign-in links.

Some of these services store data outside New Zealand. We choose services that protect personal information to a standard comparable to the New Zealand Privacy Act 2020. We do not sell or rent your information, and we do not show ads.

How long we keep things

• Daily free-download counts, send counts and code tries: deleted after 35 days.
• Your saved signatures (1, or up to 5 with Pro) and initials, if you choose to save them in Sign a PDF or Signature to PNG: kept encrypted on your account so you can use them on any device, and only ever shown to you. Remove them any time on your Account page; they're also deleted if you close your account. Extra signatures saved with Pro are kept for 30 days after Pro ends, then removed.
• Downloading the same result again is free: your browser remembers a short fingerprint (a code, not the file) of what you've paid for, on your device only, for 7 days. Nothing is sent to us.
• Sign-in codes and links: deleted within a day.
• Expired sessions: deleted automatically.
• Support messages: if you have an account, kept until you close it or ask us to delete them. Without an account, deleted 2 years after the last message. Messages marked as spam: deleted after 30 days.
• Welcome credit and free trial records (a one-way fingerprint of your email, with the one-way codes for your connection and device): deleted 1 year after the welcome credits or trial were given.
• Your account: kept until you close it (Account page → Close my account) or ask us to delete it. Closing deletes your email, sign-ins, password, favourites, brand kits, saved signatures, support messages and credit history straight away. We keep a record of what you bought for 7 years, because tax law requires it, and a one-way fingerprint of your email for up to a year, so welcome credits and free trials can't be claimed twice.
• Purchase records, from the website and the App Store: kept for 7 years, as New Zealand tax law requires, even after an account is closed, then deleted.

Your rights

Under the New Zealand Privacy Act 2020 you can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete your account. You can also close your account yourself at any time on your Account page. Email hello@myphototools.com from the address on your account and we will reply within 20 working days. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

The site is not meant for children under 16. If we change this policy, we will update the date at the top of this page. See also our Terms of Use.