Draft: some details are still placeholders and will be replaced before launch.

Privacy policy

This is a translation for convenience. The German version is the legally binding one.

koi.photo is built to collect as little as possible: without an account the editor runs entirely in your browser and your files stay on your device. There are no ads, no tracking cookies, and no third-party requests when the page loads (apart from Cloudflare as a proxy, see 3). Usage statistics are cookieless and anonymised, with a self-hosted Umami (see 4).

1. Controller

Bennett Hollstein, Glasbläserallee 25, 10245 Berlin, Germany, email: [email protected]. Privacy requests: Bennett Hollstein, [email protected]. No data protection officer is appointed, as none is required.

2. Using koi.photo without an account

Images you open and documents you edit are processed and stored locally in your browser (Origin Private File System, IndexedDB). They are not sent to us unless you save a document to the cloud or share it.

3. Visiting the website, hosting and Cloudflare

When you visit koi.photo, our host netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany (server in Germany) and Cloudflare, Inc. (USA), which sits in front of our server as proxy, CDN and attack protection, process technically necessary data: IP address, date and time, requested URL, referrer, browser and device type. Purpose: delivering the website, security and preventing abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). Server logs are kept for [7 days]. For rate limiting (for example when share links are redeemed or for the image proxy) we hold IP addresses briefly in memory. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

4. Usage statistics (Umami)

To understand which features are used and where visitors come from, we count page views and a few events (e.g. "document created", "exported as PNG", "signed in") with the open-source software Umami, which we run ourselves on [our own server at netcup in Germany] (a.vantezzen.io). Umami sets no cookies and stores nothing in your browser. It processes: the page address (without document and link ids), the referring site, browser, operating system, device type, screen size, language and the country derived from the IP address. The IP address itself is not stored; visits are grouped by a hash of IP address, browser and a random value that changes every month, so you are not recognised over a longer time. Events never contain file names, content or anything you type. If your browser sends "Do Not Track", nothing is recorded. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving koi.photo). Retention: [2 years]. You can object at any time:

Turn off statistics in this browser

5. Cookies and browser storage

We use no tracking or advertising cookies, so there is no cookie banner. Everything koi.photo stores in your browser is strictly necessary for a feature you asked for (§ 25(2) no. 2 TDDDG) and never leaves your device:

• Sign-in cookies (sb-…-auth-token, sb-…-code-verifier): only after you sign in or join a share link as a guest; they keep your session (up to 400 days or until you sign out). koi-merge: 15 minutes, only while a guest account is merged into an existing account.
• Local storage / session storage: settings (shortcuts, window layout, export settings, presets), recovering open documents after a crash, hints you have already seen, your objection to usage statistics (4); briefly, the key of a share link you are joining.
• Origin Private File System and IndexedDB: your documents and recently opened files (up to 30 working copies), a cache for cloud documents.
• Cache Storage and service worker: the app itself for offline use, downloaded AI models and fonts.

You can delete this data at any time in your browser settings.

6. Account and sign-in

Cloud features need a free account. We process your email address, an internal user id, your display name (from your email prefix or your Google/GitHub name, editable), a profile colour, your plan and storage use, and sign-in times. You sign in with a link we send through Resend; we send no newsletters. Where offered, you can sign in with Google or GitHub, which gives us your email address and name. Legal basis: Art. 6(1)(b) GDPR (contract of use).

7. Bot protection (Cloudflare Turnstile)

When you request a sign-in link, continue as a guest or redeem a share link, Cloudflare Turnstile checks that the request comes from a person. Only then does your browser load a script from challenges.cloudflare.com, and Cloudflare processes your IP address and technical characteristics of your browser and device. Usually nothing is shown; a checkbox appears only when needed. Legal basis: Art. 6(1)(f) GDPR (protection against automated abuse). Transfer to the USA: see 3.

8. Cloud documents

When you save a document to the cloud, its content (layers, pixels, text, embedded fonts), title, thumbnail, folder and version history are stored on our server in Germany. Deleted documents stay in the Trash for 30 days and are then deleted for good. We store which documents you opened recently (for the Recent list). Legal basis: Art. 6(1)(b) GDPR.

9. Sharing and editing together

A share link gives others access to the document. People who open it can join without an account, as a guest; for that we create an anonymous guest account with a random name ("Anonymous …"). Other members see your display name and profile colour, whether you are online, your cursor and selection, your edits and who saved which version. They never see your email address.

When a link is posted, for example in a messenger, the preview card shows the thumbnail, the title and "Shared by <your display name>". Anyone who knows the link address can fetch this card while the link is active; the messenger loads it under its own privacy policy. You can revoke links at any time. Legal basis: Art. 6(1)(b) GDPR.

10. Local AI (Select Subject, Remove Background, Object Select)

These features run entirely on your device. Your image is never uploaded. Before the first use we ask whether the model (about 19 to 120 MB) may be downloaded once. It comes from Hugging Face, Inc. (USA, huggingface.co), which receives only the usual connection data (IP address, browser), never image data. Legal basis: Art. 6(1)(b) GDPR (a feature you requested).

11. Fonts

The interface fonts are served from our server. Google Fonts for your text are loaded by your browser directly from the jsDelivr CDN (cdn.jsdelivr.net), only when you pick such a font, open a document that uses one, or type characters that need a fallback font (for example Japanese, Arabic, emoji). This sends your IP address and browser data, but not your text, to jsDelivr and its CDN partners (including Cloudflare and Fastly, partly in the USA). Legal basis: Art. 6(1)(b) and (f) GDPR. koi.photo reads locally installed fonts only with your permission, and they never leave your device. Uploaded fonts are embedded in your document.

12. Images from the web

When you drag an image in from another website and that site does not allow direct loading, our server fetches it on your behalf, so the other site sees our server, not you. We store neither the address nor the image; on errors we log only the host name. Images linked inside an SVG file are loaded by your browser directly from their servers, and only if you click "Load".

13. Cloud AI (Generative Fill, Expand, AI Remove, the assistant)

Cloud AI is not enabled yet. This section applies once the features are turned on. Cloud AI is available to signed-in accounts only. Before the first use we show a notice you have to accept; nothing is sent before that. Only what you trigger for a request is sent:

• Generative Fill and Expand: the image area around your selection (at most about 1 megapixel), the mask and your prompt, to Black Forest Labs (FLUX).
• AI Remove: the image area and mask, to Google (Gemini).
• The assistant: your messages and a summary of the document (title, size, layer names, kinds and properties, the first 100 characters of text layers), never pixels. The model is DeepSeek V4.1 Flash, an open-weights model; we have it run only by Baseten, Inc. or Fireworks AI, Inc. in the USA, only by providers with zero data retention and no training on your input. Your data does not go to DeepSeek or any other provider in China.

All requests go through the AI Gateway of Vercel Inc. (USA). We store no images, prompts or chats. For quotas and cost control we store per request: time, feature, model used, number of images or tokens, cost, credits and status; these records are deleted with your account. Legal basis: Art. 6(1)(b) GDPR (a feature you requested). Transfers to the USA: Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR).

14. Recipients and processors

15. Retention

16. Deleting your account and exporting your data

You can delete your account at any time under Account Settings ▸ Security. Your cloud documents (including the Trash), folders, share links, memberships and AI usage records are deleted immediately. Your edits in other people's documents you worked on remain; internal change records then hold only an id that no longer resolves to you. Local copies in your browser are not affected. Backups: [provider, location, e.g. 30 days].

Under Account Settings ▸ Storage, "Download all files (.zip)" downloads all your documents as .koi files plus an account-data.json with your account data (profile, documents, folders, memberships, share links, recently opened documents, AI usage) (Art. 15, 20 GDPR).

17. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to [email protected]. You can also complain to a data protection authority (Art. 77), for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

18. Other

Providing data is voluntary, but you cannot create an account without an email address. There is no automated decision-making or profiling. We update this policy when koi.photo changes; the version published here applies. Effective from 2026-11-01.