↪ POLICY

Privacy

Last updated: June 2026

This Privacy Policy describes how image.sh (operated from Queensland, Australia) collects, uses, and protects your personal information. By using this service, you agree to this policy.

Information we collect

Account information. When you sign in with Google, we receive your Google account identifier, email address, name, and profile picture. We use this to create and identify your account.

Content you upload. We store the images you upload and their associated metadata (filename, dimensions, file size, upload timestamp, view count). We strip GPS and other EXIF metadata from JPEG images on upload to reduce inadvertent disclosure of location data. We do not currently strip metadata from PNG, WebP, GIF, or AVIF files — please remove sensitive metadata yourself before uploading these formats.

Usage information. Our web server records standard log information for each request, including IP address, request URL, response status, timestamp, and user agent. These logs are used for diagnostics and abuse prevention.

Cookies. We use a session cookie (sid) to keep you signed in after authentication. This cookie is HTTP-only, marked Secure on HTTPS, and uses SameSite=Lax. We may temporarily use an invite_token cookie when you arrive via an invitation link. We do not use third-party analytics or advertising cookies.

How we use information

We use the information described above only to:

• authenticate you and maintain your session;
• store and serve the images you upload;
• generate the public links and embeds that you choose to share;
• enforce storage quotas, rate limits, and the Terms;
• diagnose technical problems and prevent abuse;
• communicate with you about your account or material changes to the service.

Sharing

We do not sell your personal information. We share information only:

• with Google, when verifying your sign-in credential. Google's handling of that interaction is governed by their own privacy policy;
• with law enforcement or other authorities, where we are legally required to do so or where we believe in good faith that disclosure is necessary to prevent harm.

We do not share your uploaded images with any third party. Public image pages and direct image URLs are accessible to anyone who has the link — that is what the service is for. There is no public directory or feed; people cannot find your images unless you share the link with them. You can mark images as "hidden" from your library at any time, which makes the page return 404 to anyone except you and administrators.

Data retention

We retain your account information and uploaded content for as long as your account is active. When you delete an image, the file and its variants are removed from disk immediately. If you wish to delete your account, contact the operator using the address below; we will remove your user record and all associated images, typically within seven (7) days.

Server access logs are retained for diagnostic purposes for no more than ninety (90) days.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise these rights, contact the operator at the address below.

If you are in Australia, you may make a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in the European Economic Area or the United Kingdom, you may have additional rights under the GDPR or UK GDPR, including the right to lodge a complaint with your local supervisory authority.

Security

We protect your information using HTTPS in transit, server-side ID token verification for sign-in, HTTP-only cookies for sessions, parameterised database queries, and standard server hardening. No service can be guaranteed perfectly secure; you accept this risk by using the service.

Children

This service is not directed at children under thirteen (13), or the equivalent minimum age of digital consent in your jurisdiction. If you believe a child has provided personal information to us, contact the operator and we will remove it.

Changes

We may update this policy from time to time. Material changes will be communicated through the service and reflected in the "Last updated" date above.

Contact

For privacy queries, contact the operator at: hello@image.sh