Privacy Policy

1. Who we are

MagicRemover (magicremover.org) is an AI-powered photo cleanup service. This policy explains what information we collect when you use the site and how we handle it.

2. Information we collect

Images you upload

Photos you upload are sent to our AI processing pipeline solely to perform the removal you request. We do not store your original images beyond the duration of your session. Result images are cached briefly (up to 24 hours) to allow download, then automatically deleted. We do not use your images to train models or share them with third parties.

Account information

If you sign in with Google, we receive your name and email address via Google OAuth. We store this in our database (Upstash Redis) to associate your daily usage quota and credit balance with your account. We do not have access to your Google password or any other Google account data.

Usage data

We store per-device and per-account daily usage counters in Redis to enforce the free tier limits. These counters reset every 24 hours. We also collect aggregate anonymised statistics (daily active user counts, total removes) to understand site usage.

Cookies and local storage

We set a signed HTTP-only device cookie to associate anonymous usage with a device across page loads. This cookie contains a random identifier only — no personal information. We also use localStorage to maintain a client-side usage counter. Authentication sessions are stored in an HTTP-only cookie issued by Auth.js.

3. How we use your information

• To process your image removal requests
• To enforce daily free-tier usage limits
• To manage your credit balance if you purchase credits
• To send transactional emails if you contact us
• To understand aggregate usage patterns (anonymised)

We do not sell your data. We do not use your data for advertising.

4. Third-party services

• ReplicateRuns the AI inpainting model. Your image is sent to Replicate's API for processing and is subject to their privacy policy.
• Upstash RedisStores session data, usage counters, and credit balances. Data is encrypted at rest and in transit.
• Google OAuthHandles sign-in. We receive only your name and email.
• VercelHosts the web application. Vercel may log request metadata (IP, user-agent) per their privacy policy.

5. Data retention

Uploaded images: deleted within 24 hours. Usage counters: reset daily. Account records: retained until you request deletion. Credit transaction logs: retained for 90 days for dispute resolution.

6. Your rights

You may request deletion of your account and any associated data at any time by contacting us at the contact page. We will process deletion requests within 30 days.

7. Children

MagicRemover is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of MagicRemover after a change constitutes acceptance of the updated policy.

9. Contact

Privacy-related questions: contact page.