Privacy Policy

Effective date: 19 September 2026 Last updated: 19 September 2026

This Privacy Policy explains what personal data we process when you use imagespeckit.com ("ImageSpecKit", the "Site", the "Service"), why we process it, and what rights you have.

It is written to be accurate rather than reassuring. Where our in-browser tools genuinely do not send your images anywhere, we say so and explain how you can verify it yourself. Where processing would happen on our servers, we say that too — including the two situations in which it will, once server-side processing launches.

This policy sits alongside our Terms of Service and our Refund Policy, both linked from the footer of every page. Our paid products — the Pro subscription (monthly or annual), the 7-day pass, credit packs and, once it launches, the Developer API — are referred to in this policy as the "Paid Services", and what each one includes is described on our pricing page. Those documents govern the commercial relationship; this one governs personal data.

1. Who we are and how to contact us

The controller responsible for the personal data described in this policy is:

Note on our name: Chinese business registration records a company's Chinese name only. "JI'AN WANGDONG TECHNOLOGY CO., LTD." is the English translation we use consistently in international dealings; 吉安市旺东科技有限公司 is the registered legal name.

Data Protection Officer. We have not appointed a Data Protection Officer. Our processing does not consist of large-scale regular and systematic monitoring of data subjects, nor of large-scale processing of special-category data, so Article 37 GDPR does not require one. Privacy questions go to support@imagespeckit.com.

EU representative (Article 27 GDPR). We have not yet appointed a representative in the European Union. The appointment is in progress and this section will name the representative — organisation, full postal address and contact email — as soon as it is in place: [EU_REPRESENTATIVE]

UK representative (Article 27 UK GDPR). We have not yet appointed a representative in the United Kingdom. The same applies: [UK_REPRESENTATIVE]

We would rather tell you an appointment is outstanding than name a representative we have not actually engaged.

2. The short version

• When you use an in-browser tool on this website, your image is processed inside your own browser. On that path the file is not uploaded to us, is not stored by us, and does not reach our servers. Section 4.1 tells you how to verify this yourself, and which tools we have verified.
• Your images will reach our servers in exactly two situations: (a) you call our paid Developer API, or (b) you click the separate, clearly labelled "use server-side compression" option in the web app. Neither is live today (Section 3). Nothing falls back to our servers silently — if local processing fails, the tool tells you it failed.
• The files you upload for server-side processing are processed in memory only and are never written to disk or stored. The result files we return are retained for at most one hour so that you can download them, and are then deleted automatically. Neither is backed up or archived.
• We never use your images, or anything else you upload, to train machine-learning models — ours or anyone else's.
• We run no advertising, no third-party analytics and no tracking cookies. The only storage we set ourselves is your language preference.
• We do not sell your personal information and we do not share it for cross-context behavioural advertising.

The sections below give the detail. Section 4 is the one that matters most.

3. Scope, and what is live today

This policy covers the website at imagespeckit.com and its sub-directories (for example /compress, /convert and /pricing), the Developer API, and our support email.

It does not cover third-party websites we may link to, or the separate processing carried out by Paddle when it sells our Paid Services to you (see Section 8).

Current status — please read this before the rest. The Site launched in September 2026. Accounts, the Developer API, server-side image processing and Paid Services generally are planned and not yet live, and our Paddle account has not yet completed Paddle's review. Where a section below describes account, server-side, API or payment processing, it describes how that processing will work when those features launch. Until then, no such data is collected and no payments are processed. We will update the "Last updated" date when that changes.

4. Two processing paths, kept strictly separate

4.1 In-browser tools — processing happens on your device

Our image compression and image format conversion tools run entirely in your browser. When you select a file, the browser reads it locally and the encoder runs on your own machine. On this path the image data is never transmitted to us. We have confirmed this by inspecting the network traffic these tools generate, and you can repeat that check yourself — see below.

The encoders we ship to your browser and run locally are:

These modules are delivered to your browser from Cloudflare's edge network; the largest of them, the AVIF encoder, is stored in Cloudflare R2 object storage and fetched from there. What travels on that path is our code going to you, not your image coming to us.

You can verify this. Open your browser's developer tools, switch to the Network tab, and run a compression or a conversion. You will see the tool's code and encoder binaries being downloaded, and no upload request containing your image. We have tested this ourselves; we encourage you to test it too, and to re-test after updates. The one case in which you will see an upload is the one you asked for: clicking "use server-side compression", described next.

There is no silent fallback. If local processing fails — an unsupported file, an out-of-memory condition, an exotic colour profile — the tool reports the failure. It does not quietly upload your file to us instead. Server-side processing only begins if you deliberately choose it.

As we add tools. Our roadmap includes further tools (ID and visa photo cropping, marketplace and social-media spec batches, batch renaming, product-image background removal, watermarking). Some of these may not be feasible entirely in the browser. For any tool other than compression and format conversion, do not assume the in-browser guarantee above applies to it: where a tool needs server-side processing, we will say so on that tool's own page before you use it, and we will update this policy. We will not quietly move a tool from your device to our servers.

4.2 Server-side processing — only on your Developer API call or your explicit click (not yet live)

Server-side image processing is not yet live. The description in this section is how it will work when it launches, together with the Developer API. Today, nothing on the Site sends your image files to us.

Once live, your image data will reach our servers in only two circumstances:

1. The Developer API (paid, not yet live). You send images to our API endpoint on purpose, as part of your own integration.
2. The explicit "use server-side compression" option. If a file cannot be processed locally, the interface will offer a server-side alternative. That option is a separate, clearly labelled click. Until you make it, nothing is uploaded.

When server-side processing runs, the image will be processed by our Node/Express service using the sharp library and the result will be returned to you. The file you upload will be held in the service's memory only, for the duration of your request — it will never be written to disk or stored — and the result file we return will be kept for at most one hour so that you can download it, then deleted automatically. Neither will be copied into a backup or an archive. Separately, an ordinary request log entry (timestamp, IP address, endpoint, response status, byte counts — not the image content) is retained as described in 5.1.

We do not build a library of your files, we do not index their contents, and we do not offer file hosting or cloud storage of any kind — storing your files is not a service we provide.

When server-side processing launches, it will run on Alibaba Cloud (阿里云) infrastructure located in Singapore. It is not running anywhere today.

4.3 What we never do with your content

We do not use images, files or other content you submit to train, fine-tune, evaluate or improve any machine-learning model, and we do not make that content available to any third party for those purposes. This applies to both the in-browser tools and the Developer API, and it is not subject to an opt-out you have to find — it is simply not something we do.

5. Personal data we process, why, and the legal basis

Under the GDPR and UK GDPR, each purpose needs its own legal basis. Here they are, one by one.

Sources. We collect this data from you directly (the files, parameters and messages you send us), automatically from your device and browser when it connects to the Site, and — once Paid Services are live — from Paddle. We do not buy personal information, and we do not obtain it from data brokers or public records.

Do you have to give us this data? For the in-browser tools, no: you can use them without giving us anything beyond the connection data any website receives. You can also use them without registering — the free tools require no account, and the upload area states the applicable limits (up to 20 images per batch, 5 MB per image) before you drop anything on it. For server-side processing, the Developer API, an account or a purchase, the data listed above is necessary to provide the thing you asked for; without it we cannot provide it.

Special categories of data. We do not seek out or knowingly process special categories of personal data (Article 9 GDPR). Server-side processing will only ever begin because you deliberately started it, and you can always avoid it by using the in-browser tools. To the extent a file you deliberately submit for server-side processing happens to contain special-category data, our condition for processing it is your explicit consent under Article 9(2)(a), given by that deliberate, separately labelled choice; we use it only to carry out the operation you asked for, processing the file you upload in memory without ever writing it to disk, and delete the result files within one hour. We ask you not to submit sensitive material for server-side processing when the in-browser tools will do the job.

6. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. We do not profile you, and we do not build behavioural advertising audiences.

Automated technical controls such as rate limiting and abuse blocking may temporarily restrict requests from a given IP address or API key. These are operational safeguards, not decisions about you as a person. If one affects you in error, contact us and a human will look at it.

7. Cookies, local storage and analytics

As of the effective date of this policy:

• We set no tracking cookies, no advertising cookies and no analytics cookies.
• We run no third-party analytics scripts (no Google Analytics or equivalent).
• We display no advertising, and there are no advertising networks or data brokers involved in this Site.
• The only storage we set ourselves is a localStorage entry recording your language preference (English or Chinese). It stays on your device until you clear your browser data, and it is never transmitted to us.
• Where Cloudflare's protection features are active, Cloudflare may set a strictly necessary security cookie (for example a bot-management cookie) to distinguish automated traffic from human visitors. That is a security measure, not tracking, and it is not used for advertising or analytics.

Because we set no cookies or similar technologies that require consent, this Site does not need — and, as of the effective date, does not show — a cookie consent banner. We consider the absence of one a feature, not an oversight.

Browser signals. Because we do not sell or share personal information, there is no opt-out for a Global Privacy Control signal to exercise; if that ever changed, we would honour a GPC signal as a valid opt-out request. There is no single agreed standard for "Do Not Track" headers, so we do not respond to them — but we also do not run the tracking they are aimed at.

If this changes. If we later introduce analytics, advertising or any other non-essential storage, we will update this policy, state clearly what is being used and why, and obtain your consent through a proper consent mechanism before any such technology is activated, wherever consent is legally required. We will not switch tracking on quietly and update the policy afterwards.

8. Recipients and service providers

We keep the list of third parties who touch data from this Service deliberately short. As of the effective date it consists of:

We do not currently use any other analytics, advertising, CRM, email-marketing, customer-support or cloud-storage vendor for this Service. If we add one, we will update this section before or at the point of adoption.

We may also disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims — for example in response to a legally binding request from a competent authority. We will not hand over data on the basis of an informal or voluntary request, and we will seek to narrow or challenge a request that appears overbroad or unlawful, to the extent the law applicable to us permits. Section 9 is honest about the limits of that commitment.

9. International transfers — the honest version

We do not want to bury this. Here is the actual geography:

• We are a Chinese company. Our team accesses administrative systems, server logs and support correspondence from the People's Republic of China. The European Commission has not issued an adequacy decision for China.
• The Site is served from Cloudflare's global edge network, with the larger encoder binaries stored in Cloudflare R2. Content is delivered from whichever edge location is closest to you, which means connection data may be processed in a range of countries, including the United States.
• Server-side image processing is not live yet. When it launches, it will run on Alibaba Cloud infrastructure in Singapore.
• Payments, once Paid Services launch, will be handled by Paddle, which processes payment data through its own infrastructure and its own group entities.

What this means in practice:

1. For the in-browser tools, the question is largely moot for your images. Because your image files never leave your device on that path, they are not transferred anywhere at all — not to China, not to Cloudflare, not to any other country. The data that does travel is the ordinary connection data in 5.1.
2. Where we collect personal data directly from you as a non-EEA controller (for example, when you email support), the European Data Protection Board's guidance treats that as direct collection rather than a "restricted transfer" under Chapter V GDPR. The GDPR still applies to us in full under Article 3(2), and the rights in Section 11 still apply.
3. Where personal data is transferred to processors or to other countries, the mechanism we rely on — or will rely on before any such transfer takes place — is the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum for UK data), incorporated through data processing agreements with our providers, together with the supplementary technical measures below. The current status of those executed agreements is: [DPA_SCC_STATUS].
4. Supplementary measures. All traffic to and from the Site is encrypted in transit with TLS. Server-side processing, once live, will be ephemeral: the files you upload will be processed in memory only and never written to disk or stored, and the result files will be deleted within one hour, with no backup copies. We minimise what we collect in the first place: no analytics profile, no advertising identifiers, no content retention.
5. Government access. We should be straightforward about the other side of being a Chinese company. We are subject to PRC law, which in defined circumstances allows state authorities to compel disclosure of data held by a company, and the avenues for challenging such a demand are narrower than in the EEA or the UK. We cannot promise you otherwise, and we will not pretend the risk is zero. What we can tell you is how little there is to compel: images processed in your browser never reach us at all; images processed on our servers, once that path exists, will be handled in memory only and never written to disk, so that the only things written to disk at all are the result files we return and a small processing record alongside them — for at most an hour, and never archived; we hold no analytics profiles, no advertising identifiers and no content library. We will respond only to a request that is legally binding on us, never to an informal one, and we will seek to narrow or challenge an overbroad or unlawful request to the extent we lawfully can.

You may request a copy of the relevant transfer safeguards by writing to support@imagespeckit.com.

10. How long we keep things

Paddle applies its own retention periods to the payment data it holds as merchant of record.

11. Your rights

11.1 If the GDPR or UK GDPR applies to you

You have the right to:

• Access the personal data we hold about you, and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), where the conditions in Article 17 are met;
• Restrict processing in the circumstances set out in Article 18;
• Data portability — receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• Object to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21). If you object, we stop unless we can demonstrate compelling legitimate grounds that override your interests;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with a supervisory authority — in the EU, the data protection authority of your habitual residence, place of work or the place of the alleged infringement; in the UK, the Information Commissioner's Office (ico.org.uk). Once we have appointed an Article 27 representative you will also be able to contact them directly; the appointment status is stated in Section 1 and we will update it there as soon as it is in place.

How to exercise them. Email support@imagespeckit.com with "Privacy request" in the subject line and tell us what you want. We answer within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive.

We may ask for information to verify your identity — we will ask only for what is genuinely needed to establish that the request is yours, and we will not use it for anything else.

A practical note. Because the in-browser tools do not send us your images, we normally hold very little that identifies you. If you have only used the in-browser tools, the realistic scope of an access request is the connection log data in 5.1, which we may not be able to link to you without an identifier such as an IP address and a time window.

11.2 If you are a California resident (CCPA/CPRA)

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We have not done so at any point since the Service launched, including with respect to anyone we know to be under 16. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link; there is nothing to opt out of.

The Site launched in September 2026, so the twelve-month look-back period required by California law covers the whole life of the Service to date. In that period we have collected the categories of personal information described in Section 5, namely: identifiers (IP address, email address) and internet or network activity information (request logs). Visual information contained in images — which we would receive only in the server-side cases described in 4.2, and then only in memory for the duration of the request, with the result files we return kept for up to one hour — has not been collected at all, because server-side processing is not yet live. Commercial information (transaction records from Paddle) will be collected once Paid Services launch; none has been collected so far. We collect these categories for the business purposes set out in Section 5.

Sources. Directly from you, automatically from your browser when it connects to the Site, and (once live) from Paddle. We do not buy personal information and do not obtain it from data brokers.

Disclosure. We disclose personal information for business purposes only to the service providers listed in Section 8, and to authorities where legally required as described there.

Retention. We keep each category for the periods set out in Section 10, or for as long as needed for the purpose it was collected for, whichever is shorter, unless a longer period is required by accounting, tax or other law.

Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it for purposes beyond those permitted under the CPRA regulations, so we do not offer a "Limit the Use of My Sensitive Personal Information" control.

California residents have the right to know, to delete, to correct, to opt out of sale/sharing (not applicable here), to limit sensitive-information use (not applicable here), and not to be discriminated against for exercising any of these rights. We do not offer financial incentives in exchange for personal information. Exercise your rights at support@imagespeckit.com. You may use an authorised agent, in which case we will ask for proof of their authority.

11.3 Other US state privacy laws

Residents of other US states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas and others as they come into force — have comparable rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling. We do not engage in targeted advertising, sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects. Use the same contact route above.

Appeals. If we refuse a rights request, you may appeal by replying to our decision email with "Appeal" in the subject line, or by writing to support@imagespeckit.com. We will respond to an appeal within 45 days (60 days in Colorado) with a written explanation of our decision. If we deny the appeal, we will give you a method to contact your state Attorney General to submit a complaint.

11.4 If you are in mainland China (PIPL)

We are established in the People's Republic of China, so our own processing is also governed by the Personal Information Protection Law. If you are in mainland China, you have the rights to know about and decide over the processing of your personal information, and the rights to access, copy, port, correct, supplement, delete and restrict it, to ask us to explain our processing rules, and to withdraw a consent you gave. The processing described in Section 5 is carried out either to conclude or perform a contract with you, or because it is necessary to provide and secure the service you requested. Use the same contact route in Section 16.

12. Security

• All traffic to and from imagespeckit.com is encrypted in transit using TLS.
• The single most effective security measure we take is architectural: on the in-browser path your images are never transmitted, so there is no copy of them on our infrastructure to breach. The exception will be the server-side path in Section 4.2 — and even there, the file you upload is processed in memory only and never written to disk, while the result file exists briefly and is deleted within one hour.
• Server-side processing is short-lived by design: uploaded files are held in memory only and never stored on disk, result files are deleted automatically within one hour, and there are no backup copies.
• We never hold payment card data; Paddle does.
• Access to production systems is limited to personnel who need it.

If something goes wrong. If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as Article 33 GDPR requires. Where the breach is likely to result in a high risk to you, we will notify you directly and without undue delay, describing what happened, what data was involved, and what you can do about it. Where US state law imposes its own notification duties and timelines, we will comply with those as well.

No system is perfectly secure, and we do not claim otherwise or hold any security certification. If you believe you have found a vulnerability, please tell us at support@imagespeckit.com before disclosing it publicly, and we will work with you.

13. Children

This Service is not intended for children under 13, and children under 13 may not use it. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact support@imagespeckit.com and we will delete it.

In jurisdictions where a higher age applies to certain processing — for example the digital-consent age under Article 8 GDPR, which is between 13 and 16 depending on the Member State — users below that age should use the Service only with the involvement of a parent or guardian.

14. Changes to this policy

We may update this policy as the Service develops — for example when accounts, server-side processing and the Developer API launch, when an Article 27 representative is appointed, when a new service provider is added, or if we ever add analytics.

When we do, we will change the "Last updated" date at the top and keep the current version at this URL. For material changes — a new category of data, a new purpose, a new recipient, a tool moving from your device to our servers, or any introduction of tracking technologies — we will give prominent notice on the Site before the change takes effect, and where the change requires your consent we will ask for it first rather than relying on your continued use.

15. Language

This Privacy Policy is drafted in English. We may provide a Chinese translation for convenience. In the event of any inconsistency or conflict between versions, the English version governs — except where the mandatory law of your place of residence requires a version in another language to prevail, in which case that version prevails for you.

16. Contact and complaints

Reports of illegal or infringing content go to abuse@imagespeckit.com, under the voluntary notice-and-action mechanism described in our Terms of Service.

Our Terms of Service, this Privacy Policy, our Refund Policy and our pricing page are linked from the footer of every page.

If you are unhappy with how we have handled your data or your request, you are entitled to complain to your local supervisory authority. We would appreciate the chance to address it first, but that is your choice, not a precondition.