Privacy Policy

Updated November 5, 2026

Who is responsible

Photo2Stickers is operated by ANJIANG ZHAO, an individual operator. Contact: aj.zhao2024@gmail.com.

This policy describes how we handle information when you use the photo-to-sticker tool and contact support.

Photos and generated images

Your uploaded photo is sent through OpenRouter to the selected OpenAI image model. Cloudflare processes the generated image to create a smaller preview with watermarks. These providers process the content to deliver the service under their own terms and privacy policies.

Our application does not save your photo or generated image bytes in its server database or object storage. It keeps a watermarked preview and an encrypted original in your browser’s IndexedDB. Clearing browser data, changing browsers or losing your session can make those files inaccessible. Download and back up your purchase promptly.

Session, quota and payment information

• An essential HttpOnly cookie identifies your browser session for 30 days and protects access to your packs.
• A keyed hash of the IP address supplied by Cloudflare enforces the lifetime allowance of three successful free previews per IP. This is pseudonymous information; shared networks share an allowance.
• We keep browser-session hashes, pack IDs, processing/payment status, ciphertext hashes, timestamps and payment transaction metadata. We do not write raw IP addresses or photo bytes to the application database.
• Paddle collects checkout details and processes payments. We do not receive your full card number or card security code.
• If you email support, we receive the information you choose to include in that correspondence.
• The current app does not use advertising cookies or third-party marketing analytics.
• Cloudflare and the other service providers may process connection and security information under their own policies.

Why we use and retain information

We use this information to generate and deliver stickers, verify a purchase, prevent abuse, handle support and meet applicable obligations. Quota records are retained to enforce the lifetime allowance. Pack and payment records currently have no automatic deletion date and remain available for fulfillment, support and required recordkeeping. The session cookie expires after 30 days; local browser files remain until you or your browser remove them.

Service providers and international processing

Cloudflare, OpenRouter, OpenAI and Paddle may process information in countries different from yours. Their privacy policies and API data controls describe their own handling and retention:

Your privacy requests

Contact aj.zhao2024@gmail.com to request access, correction or deletion, or to raise a privacy concern. Include a pack or order ID if available so we can locate the relevant records. We review requests under applicable law; some records may need to be retained for fraud prevention or legal obligations. Photos removed from browser storage cannot be recovered from our server database.