Privacy Policy

Analytics choices

Analytics is enabled by default when you use PhotoMend. You can turn it off for this browser at any time.

1. Who operates PhotoMend

PhotoMend provides the service available at photomend.app. In this policy, "PhotoMend," "we," "us," and "our" refer to the service operator and parties acting on its behalf.

2. Scope and definitions

This policy applies to the PhotoMend website, the upload and restoration workspace, and the restoration API that supports that workspace. It does not apply to third-party websites or services linked from PhotoMend.

"Photo" means an image file you submit for restoration. "Request information" means the settings and optional facts sent with that photo. "Output" means the image returned after processing.

3. Information you provide

When you start a restoration, PhotoMend processes the following information from your browser:

• The photo file you select and related technical information, such as file name, type, size, dimensions, and any metadata embedded in the file.
• Your selected restoration mode (Faithful or Full), whether you request natural color, and the image orientation.
• Optional facts or instructions you provide about the photograph.
• The restoration output and related request information.
• When you purchase a result, the email address and payment details you enter in Stripe Checkout. PhotoMend receives the checkout email, order status, amount, and transaction reference, but not your full card number.

4. Information processed automatically

When you access the service, we and our service providers may process standard technical and usage information, including network identifiers, browser or device information, approximate region, request times, pages or features used, response status, security events, and diagnostic data.

PhotoMend sets a first-party, randomly generated anonymous identifier cookie named oldphoto_anon. We use it to keep your tasks private and recover them in the same browser. The cookie is not used for advertising, cross-site tracking, or to create a user account.

PhotoMend loads Google Analytics 4 by default when you use the service to measure page views and a limited set of product events, such as selecting a photo, starting or completing a restoration, encountering a categorized error, and downloading a result. Analytics event parameters may include the interface language, broad file type and size buckets, image orientation, selected restoration settings, broad failure category and processing duration.

While analytics is enabled, we also measure purchase-entry views, checkout starts, categorized checkout failures, cancellations, verified purchases, refunds we record for a purchase, and email delivery status. To associate verified payment events with your website visit, your browser passes its Google Analytics client and session identifiers to PhotoMend at checkout. Our server sends Google a separate random analytics transaction reference, currency, purchase amount, tax amount, and fixed product categories. We do not send Stripe session references, photo-task references, checkout email addresses, or payment-card details to Google.

While analytics is enabled, PhotoMend may also keep a private, task-specific record that the result page was displayed, a download was requested, file preparation failed, a prepared file was handed to the browser, or native sharing was handed to the device. The record contains timestamps, a JPG, PNG, or comparison format label, broad own-photo/sample and new/resumed categories, whether the result was free under the earlier offer, locked, paid, awaiting a refund, or refunded, and whether its purchase email is pending, was accepted for delivery, or failed. It does not contain the photo, optional facts, or the email address. Once a record exists, our server keeps its payment and email status current when they change, including after you leave the page. It helps distinguish delivery, payment, and email problems from results that may need quality review. A browser handoff does not prove that a file was saved, and the absence of a record does not prove the result was disliked.

PhotoMend's analytics implementation does not send Google the submitted photo, restoration output, file name, optional facts or instructions, email address, or other free-form text. Google Analytics may process device and browser information, page URL, referring page, approximate region derived from network information, and analytics identifiers. Google may set first-party cookies such as _ga and _ga_<container> while analytics is enabled.

We use Sentry for operational error and performance monitoring, separately from optional Google Analytics. Sentry receives categorized failures, sanitized code stack traces, release versions, operation durations, sampled page performance measurements, broad file and device categories, and random diagnostic references where available. Our integration removes photos, filenames, optional facts, request bodies, cookies, query strings, and user identifiers before sending events. It does not enable session replay, screenshots, profiling, or console-log collection, and does not set analytics cookies. Network information is necessarily processed to deliver monitoring requests. Operational monitoring can still be unavailable when requests are blocked or a device is offline.

PhotoMend does not require a user account. Stripe handles checkout and Cloudflare Email Service delivers purchased JPG files as email attachments. We do not use advertising cookies or analytics data for advertising personalization or cross-site advertising. Infrastructure, analytics, and security providers may maintain technical logs under their own terms and operational practices.

5. Browser and session information

Your browser may hold the selected photo, restoration output, and session information while the restoration workspace is open. Closing or refreshing the page may clear the active session, although your browser, device, network, or service providers may retain cached or technical copies outside our direct control.

The anonymous identifier cookie may remain in your browser for up to one year to protect access to your restoration tasks. It is HttpOnly, SameSite=Lax, and sent only to PhotoMend. Clearing the cookie removes that browser identifier and may prevent reopening tasks in the same browser.

Analytics is enabled by default. Any change to your analytics choice is stored locally in your browser. Google Analytics cookies may remain for up to two years unless you disable analytics, clear browser storage, or applicable settings shorten that period. The Analytics choices link in the website footer opens the setting on this Privacy Policy page; turning it off disables further analytics events from the page and attempts to remove PhotoMend's Google Analytics cookies.

The current MVP does not provide a user-facing permanent restoration library or account history.

6. How we use information

We use the information described above to:

• Receive, validate, and process the photo you ask us to restore.
• Apply the mode, color, orientation, and owner-provided context you select.
• Show a watermarked preview, then deliver watermark-free downloads after payment.
• Process purchases, send the purchased JPG as an email attachment to the Stripe Checkout address, and handle delivery and support requests.
• While analytics is enabled, understand the restoration funnel, feature usage, broad failure categories, and aggregate product performance so we can improve the service.
• Prevent abuse, protect the service, diagnose failures, and maintain service operations.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.

7. Automated processing and service providers

PhotoMend uses third-party hosting, security, delivery, and AI-processing services to operate the product. To complete a restoration, your submitted photo, selected settings, and optional facts are transmitted to service providers that process the request and return an output.

HEIC and HEIF photos are converted to JPEG on your device before submission. In that case, the converted JPEG is the submitted photo used for processing and temporary storage; the original file on your device is not changed.

PhotoMend uses a private Cloudflare R2 bucket to store the submitted photo and, when restoration succeeds, the completed output under a randomly generated diagnostic reference. Original and restored files are stored as separate objects. The bucket is not configured as a public gallery or user-accessible photo library.

Stripe processes payment information and supplies the checkout email and payment status for an order. Cloudflare Email Service processes the purchased JPG attachment and checkout email for delivery. An incorrectly entered checkout email may send the photo to the wrong recipient; review it before paying.

While analytics is enabled, Google acts as an analytics service provider for the limited usage data described above. Advertising personalization and Google signals are disabled in PhotoMend's Google Analytics configuration.

These providers may process information in multiple jurisdictions and may maintain request data, generated content, or technical logs under their own terms and policies. We do not control every aspect of an independent provider's systems or retention practices. Do not submit material that you are not comfortable having processed by third-party service providers.

8. When information may be shared

We may disclose information in the following limited situations:

• To vendors, contractors, affiliates, and service providers when reasonably necessary to host, secure, support, analyze, or provide the service.
• To professional advisers, regulators, courts, law-enforcement authorities, or other recipients when required by law or reasonably necessary to protect rights, safety, security, or the service.
• In connection with a future merger, acquisition, financing, reorganization, or sale of the service, subject to applicable law.
• With your direction or consent.

9. Retention and deletion

Submitted photos and completed restoration outputs are stored privately in Cloudflare R2 for result delivery and troubleshooting. An automatic lifecycle rule expires objects 30 days after creation. Cloudflare may complete physical removal shortly after an object reaches its expiration time. Failed requests may retain the submitted photo and diagnostic metadata, but do not contain a completed output.

The diagnostic metadata contains a random request reference, timestamps, processing state, file type and byte count, selected mode, color and orientation settings, whether optional facts were supplied, broad failure category, provider response status, and any provider request reference. It does not store the original file name or the text of optional facts.

Task-specific download and sharing action records, when present, remain in the same private R2 archive and are subject to the same 30-day object lifecycle. Turning analytics off stops new browser action records and, for recent tasks in the current browser, stops our server from updating their payment and email status; it does not alter earlier records already retained until their normal expiry.

The server's purchase analytics attribution is kept privately with your task for up to 30 days, separately from photo files. Turning analytics off also requests removal of this attribution for recent tasks in the current browser, stopping pending server analytics events once that request arrives. Events already sent to Google remain subject to Google's retention settings.

The 30-day R2 lifecycle does not control copies in transit, email attachments in your mailbox or your email provider's systems, active AI-processing systems, caches, backups, security records, or service-provider logs. Those providers may apply different retention periods under their own terms and operational practices.

The anonymous identifier cookie may persist for up to one year. A minimal task and purchase receipt is kept for up to 400 days after generation for delayed payments, duplicate notifications, refunds, and disputes. The checkout email and task cookie are removed from that receipt at the 30-day task cleanup; Stripe maintains its own transaction records separately. Google Analytics event-level data is configured to be retained for up to 14 months, while aggregated reports may remain available for longer under Google's product behavior.

You can remove the local session from the page by closing the restoration workspace or refreshing the page. Because there is no current account or history system, there is no in-app account deletion control. Privacy requests may require enough information to verify the request and locate relevant processing records.

10. Your choices and privacy rights

You choose whether to upload a photo, whether to request natural color, and whether to provide optional facts. Do not upload a photo unless you have the right or permission to have it processed.

By using PhotoMend, you agree to the usage analytics described in this policy. Google Analytics is enabled by default without a separate permission popup. You may turn it off without losing access to restoration features through Analytics choices on this page, also linked from the footer. A previously saved choice to disable analytics remains effective.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or information about the personal data we control, and to object to or restrict certain processing. You may also have the right to complain to a data-protection authority. We will handle a verified request as required by applicable law.

11. International processing

We and our service providers may process information in countries other than the country where you live. Those countries may have different data-protection rules. Where required, transfers will rely on an applicable legal mechanism or other protection required by law.

12. Security

We use HTTPS and server-side request controls intended to reduce unauthorized access and abuse. No transmission or storage system is completely secure, and we cannot guarantee that information will never be accessed, altered, disclosed, or destroyed.

13. Children

PhotoMend is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under the age required to use online services where you live, use PhotoMend only with the permission and involvement of a parent or guardian.

14. Third-party links

The website may link to third-party pages, including image-source pages for public-domain examples. We do not control those sites or their privacy practices. Review their policies before sharing information with them.

15. Changes to this policy

We may update this policy as PhotoMend changes. We will change the "Last updated" date and, where required, provide additional notice for material changes. Your continued use of the service after an update means that the updated policy applies to future use.

16. Contact

Privacy questions or requests may be sent to support@photomend.app. We may request information reasonably necessary to verify your identity, authority, and request.