Privacy Policy

The short version

• Your photos are used for one thing: restoring them for you.
• We never publish your uploads or results, never sell them, and never use them to train AI models.
• Free-plan photos are deleted automatically after 30 days. Paid-plan photos are kept until you delete them or close your account.
• You can delete your photos at any time, or email us and we'll do it for you.
• We don't sell personal data and we don't show ads.

The rest of this page explains the details.

Who we are

gfpgan.io ("we", "us") is an online service that restores and colorizes old photos. We are the data controller for the personal data described here. You can reach us at support@gfpgan.io.

gfpgan.io is an independent service. It is not affiliated with, endorsed by, or operated by Tencent or Tencent ARC Lab, the creators of the open-source GFPGAN model.

What we collect

Photos you upload and the restored results. We store the original photo, the restored image, and the settings you picked (such as output size and any notes you add).

Account details, if you sign up. Your email address, name, and profile picture. If you sign in with Google or GitHub, we receive your name, email, and profile picture from them. We never see your Google or GitHub password.

Payment details, if you buy something. Payments are handled by Stripe. We receive your email, what you bought, the amount, and the payment status. Your card number goes straight to Stripe and never reaches our servers.

Visitor details, if you don't sign up. You can restore photos without an account. To enforce the daily free limit, we set a small cookie with a random ID and store a one-way hash of your IP address. We can't turn that hash back into your IP address.

Technical data. Browser type, device type, pages visited, and error logs. We use this to keep the site working and to understand which pages are useful.

How we use it

• To restore your photos and show you the results.
• To run your account, credits, and purchases.
• To enforce free limits and stop abuse, bots, and fraud.
• To answer your emails and support requests.
• To send important messages about your account, such as receipts or password resets. We don't send marketing emails unless you ask for them.

Our legal bases under the GDPR are: performing our contract with you (restoring photos, running your account), our legitimate interests (security, abuse prevention, basic analytics), your consent where required (for example, optional cookies), and legal obligations (such as keeping tax records).

Who processes your data for us

We share data only with the services we need to run gfpgan.io, and only as much as each one needs:

• Cloudflare hosts the site, stores your photos and results (R2), and blocks bots (Turnstile). It receives your photos, results, and technical data.
• Kie.ai runs the AI model that restores your photo. It receives the photo being restored and the restoration instructions.
• Stripe processes payments. It receives your payment and billing details.
• Google and GitHub handle sign-in, only if you choose them. They receive what's needed to confirm who you are.
• Our email provider sends account emails, such as receipts and password resets. It receives your email address.

Some of these providers are based outside the European Economic Area, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

We may also disclose data if the law requires it, or to protect the rights and safety of our users or our service.

How long we keep it

• Photos and results on the free plan: deleted automatically 30 days after upload.
• Photos and results on a paid plan: kept until you delete them or close your account.
• Account details: kept while your account is open. When you close it, we delete them within 30 days.
• Payment records: kept as long as tax and accounting law requires (usually up to 10 years).
• Anonymous usage records (IP hash and visitor ID): used for daily limits and deleted along with the related photos.

Cookies

We use a small number of cookies:

• Essential cookies keep you signed in, remember your language, and count free restorations for visitors. The site doesn't work properly without them.
• Analytics help us see which pages people use. Where required, we ask for your consent first.

We don't use advertising or cross-site tracking cookies.

Your rights

Wherever you live, you can ask us to:

• Give you a copy of your data.
• Correct data that's wrong.
• Delete your photos, your account, or all your data.
• Stop or limit certain uses of your data.
• Send your data to you in a portable format.

If you're in the EU, UK, or EEA, these are your rights under the GDPR, and you can also complain to your local data protection authority. If you're in California, you have similar rights under the CCPA. We don't sell or share personal information as those laws define it.

To use any of these rights, email support@gfpgan.io from the email address on your account. We reply within 30 days.

Security

Photos and data are sent over encrypted connections (HTTPS). Your history is shown only to the account or browser that created it. Each photo is stored at a long, random link that isn't listed or indexed anywhere, so treat those links like private links: anyone you share one with can open that image. No online service is perfectly secure, but we take reasonable steps to protect your data and will tell you promptly if a breach affects you.

Children

gfpgan.io is not meant for children under 16, and we don't knowingly collect their personal data. If you think a child has given us personal data, email us and we'll delete it.

Restoring family photos that show children is fine. Those photos get the same protection as any other upload.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. For important changes, we'll also tell signed-in users by email or on the site before the change takes effect.

Contact

Questions about privacy or your data? Email support@gfpgan.io.