Privacy Policy
Last updated: November 4, 2026
Overview
ImageKitTools is a privacy-first online image toolkit. The core principle is simple: by default, your images are processed entirely inside your browser and are never uploaded to our servers. Cloud features exist, but they are strictly opt-in and only ever act when you explicitly choose to save a file.
Local-first image processing
When you use any image tool, the file you select is read by your browser and processed using the browser's Canvas and ImageBitmap APIs. The image bytes do not leave your device. The result you download is generated directly from your browser. There is no server-side copy of images processed with the local tools.
Optional cloud storage
If you create an account and choose to save an original or processed image to your cloud, that single file is uploaded directly to private object storage using a short-lived presigned URL. The upload goes straight from your browser to storage; it is not relayed through the application server. Storage keys are generated by the server and never client-controlled. Cloud files are private and accessible only by you, and you can view, download, or delete them at any time from your account. Nothing is uploaded unless you take that explicit action.
Account and authentication
To use cloud storage you can register with an email address and password. Passwords are hashed with the Argon2 algorithm before storage; we never store or see your plain password. When you sign in, we set an essential session cookie containing an opaque, random token; only the SHA-256 hash of that token is stored server-side, so a database leak would not expose valid sessions. Email-verification and password-reset tokens are random, single-use, and short-lived (24 hours for verification, 1 hour for resets).
Cookies
We use only essential cookies by default: a session cookie (so you stay signed in) and a locale cookie (to remember your language choice). These are necessary for the service to function and are not used for tracking. If analytics are enabled, a measurement cookie may also be set, as described in the Cookie Policy. We do not set advertising cookies.
Analytics and monitoring
This site runs third-party analytics (Google Analytics 4) and error monitoring (Sentry) only when the operator has configured them. When enabled, these services may set their own cookies and collect usage data such as page views and errors. No personal image content is ever sent to analytics or monitoring providers. We do not sell or share data with advertisers, and no advertising network is integrated in the current version.
Data retention
Cloud files are kept until you delete them. Sessions expire after 30 days of inactivity and are removed when you sign out. Verification and reset tokens expire automatically and are deleted after use. Diagnostic logs, if any, are retained only for the period needed to investigate errors.
Your rights
You can review, download, and delete your cloud files at any time from the Cloud files section of your account. You can sign out to end your session immediately. To delete your account and all associated data, contact us using the details on the Contact page.
Security
The site is served over HTTPS. Object storage buckets are private with no public read or write access, and all downloads are authorized and issued short-lived URLs. Authentication tokens are hashed at rest. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.
Children's privacy
ImageKitTools is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has registered an account, please contact us so we can remove it.
Changes to this policy
We may update this policy as the service evolves. Changes will be posted on this page with an updated date. Material changes will be highlighted in the app where practical.
Contact
Questions about this policy or your data can be sent to the address listed on the Contact page.