Privacy

Session recording is on by default

Editing runs on your own device, but Session recording & diagnostics is on by default for every new editor page. It starts as soon as the editor loads, before you choose anything, and sends data about your session to PhotoFresco to help us improve the product. Cloud drive, AI tools, external agents and hosted workflows stay off until you allow them.

Exception: windows opened by the PhotoFresco connector. When an AI agent opens the editor through the PhotoFresco connector (the photofresco MCP server or command line tool), that window starts with session recording & diagnostics off (allowing the agent there turns on only External agents), so PhotoFresco receives no recording, diagnostics, "How you found us" events or copies of the files the agent opens there. The editor recognizes that window by the private channel only the connector can set up; a link or another website cannot turn recording off for you this way. You can turn recording on in that window in Data & privacy; it then works as described here.

What the connector itself runs, stores and sends, and how to set it up, is described in Use PhotoFresco with AI agents.

Recording collects clicks, pointer movement, keyboard events, tool choices, editing commands, text entered into unmasked fields, file names, errors and timing. Recordings can include copies of the images you open: up to six successfully opened files per recording session, each up to 16 MiB. Files that cannot be decoded are not uploaded. We can reconstruct recordings as videos and view the image content. Password and email fields are masked; other typed or image content can contain personal information. Do not open confidential or sensitive images while recording is on.

Recording also collects diagnostics: feature use, performance, browser and device details, screen size, language, time zone, referring site and approximate location derived from network information. Random browser and session identifiers help connect events. They are not guaranteed to identify a person across devices.

How you found us

With the same setting on, the editor also records which kind of link or tool brought you here. This might be a directory listing, a PhotoFresco integration or extension, the assistant, a search engine, or a direct visit. It also records whether you then opened, edited, exported, came back on a later day or bought credits or a plan. Each of these events contains only fixed category names, a random event ID and how many whole days have passed since your first visit. They never include file or document names, prompts, the address or search terms of the page you came from, tokens or account details, and they are not linked to your account. Your browser keeps the first category it saw locally, so a later visit can be counted as a return. We delete these events after 395 days. Turning off Session recording & diagnostics stops them as well.

Turn recording off

The Data: recording on button in the editor's menu row opens Data & privacy. To stop recording, either choose Use local-only, which turns off every service, or untick Session recording & diagnostics and choose Allow selected services. With nothing allowed the button reads Data: local-only, and PhotoFresco sends no image bytes, derived previews, prompts, document names or document details through recording, diagnostics, AI or cloud drive. Local My Documents, device exports and crash recovery still work.

Choices apply to every document tab in that editor page, but they are not saved: opening a new page or reloading turns recording back on (except in a window the PhotoFresco connector opened, which starts with it off again), so turn it off again in each new page. These controls govern document content; loading app assets, signing in, network security logs and advertising can still use the network.

Turning recording off drops queued recording data and aborts active uploads where possible. It cannot recall bytes already delivered, including images uploaded before you turned it off. Turning a service back on does not resume canceled transfers or upload files opened while recording was off.

Ads and advertising choices

Ads fund the free editor. We are connecting Google AdSense to serve ads and report impressions, visibility, clicks and estimated earnings. Google and its advertising partners may use cookies, local storage, IP addresses and device information to serve and measure ads, including personalized ads where permitted. See how Google uses information from partner sites and Google's advertising controls.

Where available, the Google consent message lets you accept, reject or manage advertising choices. Those choices do not turn our session recording on or off; use Data & privacy for that. We do not send replay files, image pixels or editing text as advertising targeting fields. An ad-free plan removes ad placements. Recording and diagnostics stay on by default on every plan until you turn them off in Data & privacy.

Accounts, AI and cloud storage

Signing in sends account information to PhotoFresco. It does not enable document sharing.

Allow AI tools before using them. Generation sends prompts and attached reference images to PhotoFresco's gateway and its model providers; background removal and layer splitting send the selected layer pixels. The model and cost are shown in the relevant tool. Consent does not bypass account checks or authorize extra spending.

Allow Cloud drive to send document names and complete editable files to PhotoFresco cloud storage. For eligible subscribers, local saves may also sync to cloud, and already-linked documents may sync after background autosaves. Local-only stops both explicit cloud transfers and background sync. Local browser saves remain available. Cloud downloads also require cloud disclosure consent, but do not require an active subscription.

Allowing External agents does not connect anything by itself, and a connected agent starts with no permissions. It can ask, and you choose in its Permissions dialog what it may do: read your open documents and previews, edit them, export files, send document data to PhotoFresco services, and spend AI credits up to a budget you set. What you allow it to read it handles under its own provider's policy. A connected agent is shown above the canvas with its permissions, Pause, Resume and Stop; your own edits pause it, unchecking a permission or Stop ends requests that use it, and revoking the choice or reloading the page disconnects it. Stop prevents new paid requests, but credits for AI work already sent are still charged. Hosted workflows are a separate planned surface: allowing them does not upload a job or grant permission to spend, and they must request their own scoped authorization when available.

The connection code, the Permissions dialog, credit budgets and the agent bar are explained step by step in Use PhotoFresco with AI agents.

Storage, access and deletion

Replay events are stored on our server, replay image files in Cloudflare R2, and rendered replay videos on our server. Replay access is restricted to administrators. Hosting and service providers process information needed to operate these services. There is currently no automatic deletion schedule for replay data; it remains stored until manually deleted. Closing the tab or clearing browser storage does not delete copies already uploaded.

For privacy questions, access or deletion requests, contact [email protected]. Include the approximate visit time and any account email you used so we can try to locate the relevant records. Do not email us your passwords or sensitive source images.

The rules for using PhotoFresco, including accounts, paid plans and AI agents, are in the Terms of Service.