Privacy overview

Information this service handles

If account sign-in is enabled, the service stores your account identifier, email, profile fields supplied by Google, and the session or provider records needed to authenticate you. Resend delivers email sign-in links when configured; each link expires after 15 minutes. Email verification records are retained only as needed to complete sign-in.

To limit email abuse, the service keeps daily HMAC counters scoped to a normalized email address and client IP (up to 3 send attempts per address and 10 per IP each UTC day). Raw IP addresses are used transiently to create these counters and are not stored in the email-attempt table, which is automatically cleaned up after its short retention window.

For anonymous quota enforcement, the browser sends a small set of device signals: browser user agent, language, time zone, screen dimensions, color depth, hardware concurrency, device memory when available, and a canvas-derived hash. The server combines these signals with the requesting IP address and stores HMAC digests for daily limits. Raw IP and signals are used transiently to calculate those digests and are not written to the quota tables.

Images and processing

Image files stay in the browser until you start an upload. The service validates and normalizes supported JPEG, PNG, and WebP files, then removes image metadata. When moderation is configured, a short-lived signed URL for the normalized input and generated output is sent to OpenAI's Moderation API using the image-capable omni-moderation-latest model. The moderation request contains no account email or IP address; signed URLs and raw provider responses are not stored in moderation records. Moderation decisions, policy version, and latency are retained for up to 90 days. OpenAI moderation is a general safety screen, not a dedicated CSAM detector or complete child-safety program. Standard processing uses Replicate Real-ESRGAN; if AI Retouch is enabled and selected, the image is also sent to fal for Nano Banana 2 editing. These providers receive image data to perform the requested safety check or processing. AI Retouch may regenerate fine details, including faces or text.

Service-owned staging uploads expire within one hour. Validated originals and generated results are scheduled for deletion within 24 hours. You can request removal from task history; this immediately hides the task and queues deletion of service-owned files. Previously issued download links can remain usable for up to 60 seconds while cleanup runs. Copies already downloaded to your device cannot be removed. When AI Retouch is active, requests ask fal not to retain request input/output history and set generated CDN files to private with a one-hour expiry; after copying an approved result, the service also requests deletion of the fal request payload. These provider settings require ongoing verification. Other provider-side copies follow each provider’s current retention terms.

EnhanceWizard does not use submitted images in public examples or to train a model of its own. This does not change the terms or data practices of the third-party providers used to process an image.

Quota and cookies

A first-party, HttpOnly visitor cookie helps associate uploads and tasks with the same browser. The anonymous free allowance is limited to one accepted image per device fingerprint and two per IP address per UTC day. Upload-attempt limits separately protect the upload and moderation services. HMAC quota records are retained for a short rolling period and automatically cleaned up.

Account closure and retained records

You can request account closure from Account settings by typing DELETE. Sign-in sessions are revoked immediately and saved results become unavailable. A background worker cancels active subscriptions, removes service-hosted images and results, and deletes the sign-in identity. Processing may be retried if a storage or provider service is unavailable; contact support if cleanup remains pending after 24 hours.

Minimal payment, refund, fraud-prevention, and audit records may be retained where needed for applicable obligations. Daily HMAC quota counters are not linked to the deleted account and expire on their existing short retention schedule so account closure cannot reset daily abuse limits. Account closure does not automatically issue a cash refund or transfer unused credits. Third-party copies follow each provider’s own retention and deletion terms.

Site analytics

Microsoft Clarity and Google Analytics record pages visited, clicks, and general browser or device information to help us understand site usage. They do not receive uploaded images. Either service may set its own cookies; their privacy statements describe how they handle that data.

Payments and choices

Signed-in checkout is handled by Stripe. The service does not store full card numbers. You can avoid sending an image by keeping the preview local and leaving the page before starting processing.