Know where your reference goes.

What happens in this build

In local editing mode, your reference, prompt, settings and up to three approved session results stay in page memory. NSFWJS checks references and local outputs before display or download; its fixed model files load lazily from this app’s own origin. Model downloads are not media uploads. Local editing does not send media or scores to an external provider or save account history. Optional Google sign-in is separate from editing; checkout setup is pending.

Reset clears the reference, prompt, editing settings and session results. Choosing another reference also clears previous results, and leaving the workspace ends the session. These actions do not delete files already downloaded to your device or guarantee immediate erasure from browser or operating-system memory.

Cloudflare also processes website delivery, security and performance information. A Cloudflare performance beacon has been observed on this site. Its complete processing fields, settings and retention have not been independently verified. This processing is separate from the local image editing described above; this notice does not promise that no telemetry is collected.

Google sign-in and minimal account records

The separate sign-in page loads Google Identity Services only after you choose to start. Google processes sign-in under its own terms. On imagetoimage.online, Cloudflare Workers verifies the short-lived Google identity response and stores only a Google subject identifier, a random account ID, activity timestamps and hashed session, challenge, nonce and CSRF records in this site’s Cloudflare D1 database. We do not store your email, name, avatar, raw Google token or raw session cookie.

Production sessions expire after 15 minutes and use Secure, HttpOnly, host-only cookies with SameSite=Strict. Signing out revokes the session. An account inactive for 30 days is denied access and removed by scoped cleanup. Self-service account deletion requires a Google sign-in within the last 5 minutes and revokes all account sessions. Google sign-in does not grant administrator rights, media-processing consent, another user’s results or generation credits.

The separately labelled localhost identity test is different: it uses bounded server memory and local-only HttpOnly cookies under /api/auth, and a restart invalidates its sessions. Localhost cookies do not isolate ports; use a trusted computer. A local test session is never accepted as a production account or paid entitlement.

Contact support and reply addresses

Email support requires a current production sign-in session and a server-verified purchase. Visitors, signed-out accounts and accounts without a verified purchase cannot open the form or send a message. Checkout is not open in this release, so a new account does not yet unlock email support. This restriction is not a promise of a general privacy-request channel or comprehensive legal compliance.

When eligible support is available, the separate form sends your chosen topic, reply address and plain-text question through Cloudflare Email Service to one fixed support inbox. You must agree before submitting. It does not send a verification email or automatic acknowledgement to your address, subscribe you to a mailing list or grant AI access. Do not include images, passwords, verification codes, payment details or other sensitive material.

A reply address entered in this form is unverified. It is not proof of identity or permission to change or delete an account; account deletion still requires recent sign-in. A separate random, Secure, HttpOnly, SameSite=Strict contact cookie expires after 30 minutes. The contact database is separate from account identity records and stores purpose-bound hashes, expiry, request receipts and delivery-attempt metadata, not your raw address or question. Direct-contact receipts become eligible for cleanup after 24 hours; allowance audit records remain. The old, closed verification pilot and its spent allowance are not reset by this form.

When web sending is enabled, the limit is 3 distinct email attempts per IP per UTC day, resetting at 00:00 UTC. Shared networks share this allowance. Accepted and unconfirmed send attempts count; duplicate clicks and idempotent replay do not use another attempt. The application uses the client IP supplied by Cloudflare to calculate a domain- and day-scoped IP hash and stores that pseudonym with a counter, not the raw IP. This is pseudonymous personal data, not anonymous data. Daily counters become eligible for cleanup 48 hours after the UTC day starts, including when sending is disabled; actual removal depends on scheduled cleanup. Genuine automated-traffic signals may be used when available, but their absence is not a human-verification result and complete bot detection is not promised.

A draft stays only in this page’s memory and can be lost on refresh, navigation, account revalidation or loss of account access. Submitted email is processed outside your device. Cloudflare activity previews may retain message bodies and headers for about seven days, and provider metrics may remain for 31 days under its current documentation. The receiving inbox has separate retention, and historical Cloudflare backups can retain prior contact records after application cleanup. Account deletion does not automatically remove support correspondence or provider records, and no immediate or zero-retention guarantee is made. Provider acceptance is not proof of inbox delivery, reading or a support reply.

External processing needs separate consent

A future cloud edit would send data outside your device. Before any submission, the operator must identify the services, information transferred, purpose and retention limits, and obtain your separate informed consent.

Local file selection is not permission to make that future transfer. A moderation request is itself external processing, even before an image is generated.

A future provider may keep a copy

The reviewed SeeAPI contract states that stored input files, task information and review results have no planned automatic expiry. It states that API request records and logs are retained for 60 days. These are provider statements, not independently verified guarantees, and must be rechecked before connection.

An expired source link does not delete a provider copy. Any generation provider would need its own data-handling review; the SeeAPI statement does not cover every other service.

Account deletion and backup limits

Use the account page to request deletion of active production identity records after recent authentication. The request removes that identity and its sessions; a short-lived hashed deletion fence may remain for up to 5 minutes to stop an older in-flight login recreating the deleted account. Cloudflare historical backups may retain prior records for 7–30 days. Deletion does not instantly erase those backups.

Deleting an account does not delete your Google account, device files, independently stored provider media or logs. It also does not promise erasure of financial records a future paid service may legally need to retain. Prices, checkout and billing-retention policies are not configured yet and must be disclosed before any purchase. Authenticated self-service account deletion remains available without a purchase; email support is not an alternative identity check or a media-deletion guarantee.