Privacy policy

Tidykit is the service responsible for the processing described here. For privacy requests, contact hello@tidykit.io.

The short version

• The image you upload is processed in memory to make your result. We do not keep the upload itself.
• Results (previews, the free small download and the full-size files) are stored privately for 24 hours, then deleted automatically.
• Tools without an AI badge run on Tidykit's own image code. They do not send your image to an AI model, and the upload is not stored.
• A tool that uses AI is marked with an AI badge and says which provider processes your image before you run it.
• We do not sell personal data, and we never publish your images.

Data we use

• Images and results: the file you upload, the results we make from it, and the options you chose (size, crop, colours).
• Account: your name, email, sign-in method (Google or email) and preferences, if you create an account. You can use previews and the free small download without one.
• Credits and orders: credit balance, credit use per download, order records and receipts. We never see or store full card details.
• Support: messages, replies and attachments you send us.
• Security: limited request data (for example daily preview counts and abuse signals) to keep the service working for everyone.

Essential cookies keep you signed in, remember your language, and link previews made in your browser to you before you sign in.

Why we use it

To make and deliver the result you asked for, keep your downloads available for 24 hours, run credits and payments, secure accounts and answer support requests. Account emails (verification, password reset, receipts) relate to your own activity. You can change optional emails in your email preferences.

Processing providers

• Cloudflare: hosts the site, database, private file storage, security checks and transactional email.
• Google: handles Google sign-in when you choose it.
• Waffo: our payment partner and merchant of record. It handles payment data, taxes and receipts. Earlier orders placed through another partner stay with that partner for refunds.
• AI tools only: when you run a tool marked AI, the image is sent to a third-party AI image service for processing. We send only the image and a fixed instruction, never your account details. We keep the upload privately only until the AI step finishes, then delete it. The provider's own retention rules apply to its copy. Tools without the AI badge never send your image to these providers.

Data may be processed outside your country.

Storage and your choices

• Uploads to tools without the AI badge are not stored. For AI tools, the upload is kept privately until the AI step finishes (at most about 10 minutes), then deleted. Results are deleted 24 hours after they are made.
• Account, credit and order records stay while your account is open, and payment and accounting records may be kept longer where the law requires.
• To access, correct, export or delete your data, or to close your account, email hello@tidykit.io from your account email. We verify ownership before acting.

We protect data with access checks, encrypted connections and restricted credentials; no online service can guarantee absolute security. We update the date above when this policy changes and give notice of material changes where appropriate.

Buying before you sign in

When checkout without an account is offered, you can enter your email and pay first. The credits are held privately against that email. They do not create a login; to use them, sign in with the same email (Google or an emailed link). A short-lived, HttpOnly receipt cookie shows the payment status in that browser for up to seven days; it never unlocks files on its own.

Anonymous visit counting

When a browser first opens a public page, we record the time, the country derived by Cloudflare from the connection, the source category (for example ChatGPT, Google search, social or direct), the referring site's domain name when the browser provides one (for example reddit.com, without the page address) and the landing page. We use no cookie or device storage for this, and we do not store the IP address, full referring URL, search query or an advertising identifier. A random visit ID kept only in that tab's memory (and carried in the return address of a sign-in or email-verification link, then removed from the address bar) lets us link the visit to your account if you sign in, register, or start a download or checkout from that visit, so we can see which channels lead to real use and purchases; the first linked visit is kept with the account. We rely on our legitimate interest in understanding and improving the service. Unlinked visits are deleted after 400 days. Browsers sending Global Privacy Control or Do Not Track are not counted. To have the link to your account removed, email hello@tidykit.io.

No analytics or advertising cookies

Tidykit does not use Google Analytics, advertising, or any other tracking cookie, so there is no cookie banner. The only cookies are the ones the service needs to work: your sign-in session, your language choice, a short-lived security cookie during sign-in, the browser ID that keeps your free previews and results yours, and the payment receipt cookie described above. Cloudflare also provides basic aggregate site analytics without cookies.