Privacy
Awaiting legal review. This describes what the system actually does today, written by the engineers who built it. It is not a lawyer-reviewed privacy policy and must be replaced beforePicSoar takes payment or processes anyone's personal data at scale.
What we hold
| Data | Why | Retention |
|---|---|---|
| Email address | Account identity and login links | Until the account is deleted |
| Organization, project, origin and preset configuration | To operate the service | Until deleted, then 30 days |
| Usage ledger | Billing and dispute resolution | 7 years (financial record) |
| Operational analytics | Dashboards and debugging. Sampled. | Per plan: 7 to 365 days |
| Audit events | Security and accountability | Per plan |
| Hashed IP and user-agent on sessions | Detecting session theft | Session lifetime, 14 days |
Your images
Images delivered through the CDN are read from your origin and cached as derivatives at the edge. We do not copy them into our own storage, we do not index their contents, and we do not use them to train anything. Purging a project makes every cached derivative unreachable immediately.
Images processed in the browser-based compressor are never transmitted to us at all. That is a property of how the page works, not a policy we could quietly change.
What we deliberately do not collect
- No third-party analytics, advertising, or session-replay scripts on this site.
- No cookies except the session cookie on the dashboard, which is strictly necessary.
- Raw IP addresses are never stored — only salted hashes, for abuse detection.
- Logs are structured and redacted; secrets, tokens, and signed URLs are never written to them.
Deletion
Deleting a project removes its delivery configuration from the edge immediately and marks its records deleted; they are purged after 30 days. The usage ledger is retained, because it is the evidence behind invoices you have already received.
Account deletion is not yet self-service. Email support@picsoar.com and it will be done manually.
Subprocessors
Cloudflare (compute, storage, CDN, DNS resolution for origin verification). No others today. Adding one is a change to this page, announced before it takes effect.