Privacy policy.

This page says what Optracy stores, why, for how long, and who can see it. It describes what the site does today, in plain words.

Questions about privacy: [email protected].

The short version

• Your images are deleted within about 24 hours. Anyone who has an image's link can open it until then.
• With an account, we keep your email, a scrambled form of your password that can't be turned back, and a few dates.
• Daily limits are counted with coded network addresses that change every day and are deleted after two days.
• The site sets two cookies of its own and runs no advertising, analytics or third-party scripts.
• Cloudflare sits in front of the site and carries every request.
• We don't sell your data or share it with advertisers.

1. Images you upload

What we keep. Each upload becomes a session on the server: your image (saved as a PNG), its file name, the color data the editor needs, a preview, the area you cropped, if any, and the files you download with their check results.

How long. A session expires 24 hours after the upload and is deleted at the server's next clean-up, which runs whenever someone uploads an image or prepares a file, and at least once an hour. It can be deleted sooner: the server keeps at most 200 sessions and 4 GB of them, and removes the least recently used first. A session is never deleted while it is being processed or while one of its files is being built.

Who can see it. Each upload gets its own link with a random 32-character code, also when you're signed in; the image itself isn't stored with your account (only a download record names it, see section 4). Anyone who has the link can open the image and download its files until it's deleted, so share it only with people you trust. The site never lists or publishes uploads. The people who run the server can access the stored files.

What we use it for. Making your files, and nothing else.

To have an image deleted before its 24 hours are up, email [email protected] with its link.

2. In your browser

Cookies set by Optracy:

Browser storage. The editor saves your color edits for each image in your browser's local storage, so they survive a reload or a new tab. A saved edit stops being used 24 hours after it was written and is removed the next time the editor or the download page opens. The editor also remembers that you closed its tips. While you move from the editor to the download page, your edits travel in the tab's session storage, which your browser clears when you close the tab.

No trackers. The site's own pages load no advertising, analytics or third-party scripts. Its security settings only allow scripts, fonts and data from optracy.com itself.

3. Your account

An account is optional; you need one only to download from the website or to use the API. If you create one, we keep:

• your email address;
• your password, only as a scrypt hash, a scrambled form that can't be turned back into the password;
• the date the account was made and the time of your last log-in;
• your login sessions: a scrambled form of each session's code, when it started, when it was last used, and when it ends;
• password reset links we create for you: a scrambled form of the link, when it was made and whether it was used (a link works once, for 24 hours);
• your plan: the end date of a monthly plan, and how many API jobs you may run at a time.

We use your email address to answer you and to send a reset link you asked for. We don't send newsletters or marketing email.

Failed log-ins are counted without keeping your email or network address in readable form: only keyed codes made from them. The counts are deleted about a day after the last attempt.

Account changes (sign-up, password or email change, and similar) are written to a log that names the account by its number and keeps the time. This log is kept without a time limit and never holds your email.

Deleting your account. Email [email protected] from your account's address. We replace your email with a placeholder, make the password unusable, disable the account, and delete its login sessions, reset links and API keys. The account number, its credit records and its API job records stay, with the uploaded file names removed, so the credit books still add up. Backups taken before the deletion age out as described in section 8.

4. Daily limits and downloads

Processing counts. The free website has daily limits. We count them per account when you're signed in and per network address when you're not, and every image also counts toward a limit for the network it came from. We never keep the address in readable form: only a code made from it with a key that changes every day and is kept apart from the database. The counts and the keys are deleted after two days.

Download counts. When a download is counted, we write down your account number, the image's code and the day. These records are deleted after two days.

5. The monthly plan and payments

We store the end date of your monthly plan on your account. Payments are arranged by email and handled outside the site; the site stores no card or bank details.

6. The API

If you use the API, we also keep, for your account:

• your API keys, only in a scrambled form, with their last four characters, their names, and when they were made, last used and revoked; a revoked key is deleted after 30 days;
• the list of your jobs: when each was sent, its options, the image's file name, size and fingerprint, and how it ended;
• the record of your credits: what was added and what each job used;
• for a repeated request, its Idempotency-Key, for 24 hours.

The image you send is deleted when its job ends, and the file made from it 24 hours after the job succeeds.

7. Email you send us

Email to [email protected] passes through Cloudflare Email Routing to the mailbox of the person who runs Optracy. We keep it as long as we need it to help you.

8. Backups

The database (accounts, counts, plan dates, API records and credits) is copied automatically every day. Automatic copies are kept for up to 4 weeks. Copies made by hand, and copies made just before a database upgrade, are kept until newer ones replace them (the 10 and the 5 newest). Backups never contain your images.

9. Server logs

The server keeps a technical log to find and fix problems. It can name an image by its code. It never writes passwords, login codes or reset links to it.

10. Companies that help run Optracy

• Cloudflare sits in front of optracy.com. Every request passes through its network on the way to our server, so Cloudflare sees your network address and the pages you ask for. It may set its own cookies to protect the site, such as __cf_bm, which expires after 30 minutes without activity; Cloudflare describes its cookies as strictly necessary. It also forwards email sent to [email protected].
• Our server is a rented machine.

We don't share your data with anyone else and don't use advertising networks.

11. Your choices

• Change your email and password yourself on your account page.
• Ask us for a copy of what we hold about your account, or to delete it, by email from the account's address.
• Ask us to delete an image before its 24 hours are up.
• Use the website without an account; you only need one to download.

12. Children

Optracy is not meant for children under 13, and we don't knowingly keep data about them.

13. Changes to this policy

When the way we handle data changes, we update this page, change the date at the top, and note it on the What's new page.

14. Contact

Questions, requests and complaints about privacy: [email protected].