Privacy Policy

1. Information We Collect

We may process the images or text you submit, file name, file size, file type, IP address, limited device information and service usage data. Video analysis is not active yet.

Running an AI analysis requires a registered, signed-in account. Browsing informational and marketing pages does not require an account.

2. How We Use Information

We use information to provide image analysis, generate probabilistic reports, prevent abuse, protect the service and improve our products. Video analysis is in development.

We do not sell uploaded media, submitted text or analysis-related information to third parties.

PhotoProof Labs uses infrastructure and third-party service providers that may be located in different countries, including outside the European Economic Area. We have not limited processing to a single region, and this policy does not claim that all processing and storage occurs exclusively within the European Union.

3. Uploaded images

Uploaded images are processed temporarily for AI-content analysis. Video analysis is not available yet.

PhotoProof Labs does not permanently store original uploaded images. The original image may be stored privately on our servers for a limited retention window (ordinarily up to approximately 1 hour, or up to approximately 24 hours depending on which feature reserved it) to support the analysis and image source search, and is marked for removal once that window ends or the processing it supports has finished. Removal is carried out through scheduled or triggered cleanup processing rather than instantly at the exact expiry moment, so a file may remain for a limited additional period until that cleanup runs. Raw submitted text is not stored. In some cases, selected files may also be stored temporarily in your browser so that the current selection can be restored during the analysis or payment flow.

You are responsible for ensuring that you have the necessary rights, permissions or lawful basis to upload and analyze any image, video or text, including content containing other people or third-party material.

PhotoProof Labs is not intended for special categories of personal data or highly sensitive information. Users should avoid uploading or pasting sensitive personal information unless they have a lawful basis to do so.

When you create a shared report, we store the report data and, for image reports, a reduced-size preview. Raw text and original videos are not stored in shared reports.

Saved analysis reports, including any image preview, remain associated with your account until you delete that report, delete your account, or applicable retention rules remove them.

Temporary original images and cleanup

When the analysis or source search requires the original image data, a private copy of the original file may be kept for the limited retention window described above, in a private storage location that is never public and is separate from the storage location used for shared-report previews.

Removal of an expired original happens through our cleanup processing, which may run on a schedule or be triggered manually rather than continuously. A file that has passed its intended retention window is marked as eligible for deletion and is ordinarily removed promptly, but we do not guarantee removal at the exact expiry timestamp if cleanup processing is delayed or needs to be retried.

Video and text analysis privacy

Video analysis is not currently available. PhotoProof Labs does not accept, process or store uploaded video files at this time; any request to analyze a video is rejected before any file is processed. This section will be updated if and when video analysis becomes an active feature.

Text analysis is not currently offered through the product interface. PhotoProof Labs does not currently expose any way to submit text for analysis; any previously generated text-analysis report remains subject to the same retention and reporting rules described in this Privacy Policy. This section will be updated if and when text analysis is reintroduced as an active feature.

Automated text-detection results are probabilistic and should not be used as the only basis for disciplinary, legal, employment or similarly significant decisions.

Technical metadata and forensic indicators

Uploaded images may be automatically processed to inspect technical metadata such as EXIF data, camera information, timestamps, editing software tags, compression characteristics and other forensic indicators.

If location metadata is present in an uploaded image, it may be processed only for image analysis and is not used for user tracking or profiling. We may also compute a cryptographic fingerprint (a SHA-256 hash) of an original uploaded image for internal integrity checks and duplicate-detection purposes; this fingerprint is not displayed in your report.

Local browser storage

A short list of your most recent analyses may be stored locally in your browser using localStorage, so you can quickly reopen them on the same device and browser.

This local information remains on your device and is not used as server-side permanent image storage.

Shared reports

When you choose to share an analysis, we create a public read-only link for that report.

The shared report may include the analysis result, file name and a reduced-size image preview. Anyone with the link can view it.

We do not index shared report pages and we can delete shared reports when required by policy, retention rules or a valid request.

Shared report links are currently set to expire approximately 30 days after they are created or last re-shared. Deleting the underlying report, deleting your account, or clearing your analysis history also ends access through that report's shared link, even before the 30-day period elapses.

AI, deepfake and authenticity scoring

AI probability, deepfake probability, origin detection, metadata checks and authenticity scores are probabilistic estimates and may be inaccurate.

Automated analysis results are probabilistic and should be interpreted as informational signals, not as definitive proof.

Payments and credits

When you buy analysis credits, payment is processed by whichever payment provider handles your chosen checkout method — Paddle or PayPal. PhotoProof Labs receives payment status, order identifiers, purchased package information, amount, currency and related technical metadata needed to add credits and prevent fraud. For a transaction processed through Paddle, Paddle acts as the Merchant of Record (or authorized reseller) for that transaction; for a transaction processed through PayPal, PayPal processes that payment through PayPal's own payment flow.

We do not store full card numbers, Paddle or PayPal login credentials, or other full payment method details on our servers — those are collected and handled directly by the applicable payment provider.

4. Third-Party Services

• Sightengine — used for AI image analysis. Video analysis is not active until the dedicated feature is launched.
• Resend — used to process email delivery events, such as bounce and complaint notifications, related to account confirmation emails.
• Vercel — may be used for hosting and application infrastructure.
• Google Analytics — may be used for privacy-conscious analytics after enabling the service and, where required, obtaining user consent.
• PayPal — used for secure payment processing when you buy analysis credits using PayPal as your payment method.
• Supabase — used for database storage and private storage of shared report previews.
• Google Gemini API — used for semantic image analysis when enabled; receives the uploaded image content necessary to perform that analysis.
• SerpApi — used to perform reverse-image source searches as part of the analysis; receives a temporary, signed link to the uploaded image, not a permanent copy, that is required to run that search.
• Paddle — used as Merchant of Record / authorized reseller for secure payment processing when you buy analysis credits using Paddle as your payment method.

5. Cookies and Similar Technologies

We may use essential cookies or similar technologies required for service functionality, security and abuse prevention. For anonymous, non-signed-in usage, this includes a browser fingerprint signal used only to help enforce the free-analysis limit and reduce repeat abuse; it is not used to identify you personally or to uniquely identify your device.

Optional analytics cookies or similar technologies, including Google Analytics, are used only after you give consent where such consent is required under applicable law. You can reject optional analytics cookies.

6. Security

We implement reasonable technical and organizational measures to protect the service and processed information, but no online service can guarantee absolute security.

7. Your Rights

Depending on your location, you may have rights to request access to, correction of, deletion of, or restriction of processing of your personal information. Please contact us regarding such requests.

12. Account deletion

Registered users can request account deletion from the profile page. When an account is deleted, PhotoProof Labs deletes the user profile, credit balance, credit transaction records, saved analysis reports, any temporarily retained original images, and image previews stored for those reports, and disables related public report links. Deletion completes once every stored file has been confirmed removed; if that cannot be confirmed immediately, the request can be safely retried.

Some limited technical logs may remain for security, fraud prevention, legal compliance, debugging or backup purposes for the minimum period reasonably necessary.

An account that never confirms its email address and whose confirmation email permanently fails to deliver may be scheduled for deletion after a grace period of at least 48 hours, so that a delayed but valid confirmation can still be recognized before anything is removed.

If a new account is created under conditions where registration is currently restricted, that account and any associated data may be automatically deleted shortly after creation.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the service after changes become effective constitutes acceptance of the updated version.

9. Contact

contact@photoproof.co