Privacy Policy
How CapCrop handles your data
Last updated: 2026-07-01 (draft)
1. Who we are
CapCrop is operated from California, United States by the individual who runs it — no separate legal entity has been formed yet — and is governed by the laws of the State of California. Questions about this policy can be sent to privacy@capcrop.com.
2. What we collect
| Data | Why we have it |
|---|---|
| Email, username | Account identity, sign-in, transactional email |
| Password hash or linked sign-in (Google/GitHub/Microsoft) | Authenticating you |
| Your uploaded photos, scans, crops, and AI-enhanced variants | The core of the service — your content, stored so you can work with it |
| Photo metadata (captions, tags, scene type, decade, people count) | Made searchable, by you or by our AI partner if you choose |
| Billing and usage records | Accurate billing and abuse detection |
| Credit ledger | Your balance and purchase history |
| Sharing: which scan sessions you share into a group, and with whom | Letting people you choose collaborate on a shared session |
| Referral code, and the invite you signed up through (if any) | Running the invite/referral credit rewards |
| Legal consent records: which policy/AI-risk acknowledgment you accepted, the version, and when | Proof of agreement; re-asking only if that wording materially changes |
| Single-use, hashed email-verification and password-reset tokens | Verifying your email and letting you reset your password |
| Waitlist signups (pre-launch): email, IP, user-agent | Launch notice and, if opted in, progress updates |
| Session cookie, server-log IP address | Keeping you signed in and the service secure |
We don't collect more than the table above, and we don't run an ad or analytics tracker on this product.
3. How your photos reach AI, and who sees them
Uploading, cutting a sheet into individual photos, straightening, labeling, and exporting all happen on our own servers and never touch a third-party AI. Two optional features send a photo to a third-party AI processor, and only when you tap them: Auto-tag (caption/tags/decade suggestions) and Restore (repairs fading, dust, and scratches).
Current AI partner: OpenAI. Your photo is processed through OpenAI's API. Under OpenAI's API data-usage policy, content sent through the API is not used to train OpenAI's models. This is not a zero-retention arrangement, however: OpenAI may keep the content for a limited period (up to 30 days) for abuse and misuse monitoring, after which it is deleted. We send only the photo you chose, plus a random internal account id — never your name or email.
Subprocessors (as of this draft)
| Subprocessor | What it receives | Purpose |
|---|---|---|
| OpenAI | The photo you Auto-tag or Restore; a random account id | Tagging and restoration |
| Stripe | Billing/payment details | Payment processing |
| Resend (our transactional-email provider) | Email address, message content | Transactional email |
| DigitalOcean | Everything CapCrop stores | Hosting |
This list is kept current as the product evolves (see
PROVIDERS.md); a new processor is added here before it goes
live. If a hosted CSAM-detection service is ever enabled, it will be
added here too (see TRUST_AND_SAFETY.md §7).
4. Objectionable content and CSAM
Uploading child sexual abuse material (CSAM) or other illegal content is strictly prohibited under our Terms. CapCrop does not currently run its own automated scanning of your photo content. Photos you send for Auto-tag or Restore are processed by OpenAI, which applies its own content moderation to what it receives. If we introduce our own content-scanning system in the future, we'll update this policy — and, where it's a hosted third-party service, add it to the subprocessor list in §3.
Independently of any scanning, if CapCrop obtains actual knowledge of apparent CSAM we may be legally required to report it (for example, to NCMEC) and to preserve the related material; §4 of our Terms covers the underlying prohibition.
5. Cookies and local storage
CapCrop uses one cookie: a session cookie that keeps you signed in
and carries a per-visitor CSRF token used to protect form
submissions — it's set for every visitor, signed in or not, the moment
you load the site (HttpOnly, SameSite=Lax,
Secure on HTTPS). It can't be read by page scripts and isn't
sent on cross-site requests. We don't use advertising or analytics
cookies.
We also use localStorage for three things, stored on your
device the same way a cookie would be: capcrop-theme (your
light/dark preference), capcrop_notify (on the waitlist
landing page only, remembers the email you typed), and
capcrop_ai_warning_seen (remembers that you've already seen
the one-time warning shown before a photo first leaves CapCrop for
Auto-tag or Restore). Clear any of these anytime through your browser's
site-data settings.
6. Retention and deletion
You can delete your photos anytime — removing a photo or clearing a session deletes it from CapCrop, and deleting a scan lets you choose whether to keep the crops made from it. Export a copy before you delete anything. CapCrop is a workspace, not a backup service: original scans may be removed after a period (around 30 days); finished crops are kept longer but not promised indefinitely.
Billing and usage records are kept for accounting and legal purposes even after the related content is deleted, and your credit ledger is never deleted.
7. Your rights
Access, export, and delete your own data directly in the product (Account page, session/photo delete, Export). For anything else, contact privacy@capcrop.com.
California residents (CCPA/CPRA). You have the right to know what personal information we collect and why (§2), to access and delete it, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell your personal information, and we do not share it for cross-context behavioral advertising — CapCrop runs no advertising or analytics trackers (§5), so there is nothing to opt out of on that front. Use the in-product tools above or email privacy@capcrop.com; we verify requests against your account.
EU / UK users (GDPR / UK GDPR). Where GDPR or UK GDPR applies, our legal bases are: performance of your contract (operating your account, storing and processing your uploads, taking payment); your consent (the optional Auto-tag/Restore features that send a photo to OpenAI, waitlist update emails, and the AI-processing acknowledgment at signup); our legitimate interests (security and abuse prevention); and legal obligations (retaining billing records, and any CSAM reporting under §4/§6). You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority. Because OpenAI, Stripe, Resend, and our hosting provider are US-based, using CapCrop involves an international transfer of your data to the United States; we rely on the transfer mechanisms those providers offer (such as the EU/UK Standard Contractual Clauses). Email privacy@capcrop.com to exercise these rights.
8. Children's data
CapCrop is intended for users aged 16 and over. You must be at least 16 to create an account, and the service is not directed at children. We do not knowingly collect personal information from anyone under 16; if you believe someone under 16 has created an account, email privacy@capcrop.com and we will delete it. This concerns the age of the account holder, distinct from the CSAM-content question in §4.
9. Changes to this policy
We'll update the date above when this policy changes.
- 2026-07-01 — second draft pass. Completed the "What we collect" table (session sharing, referrals, consent records, hashed sign-in tokens); named Resend as the transactional-email subprocessor; corrected §4 to state that no automated CSAM scanning is currently active. Filled in the owner-supplied facts: operated from California under California law (§1), privacy@capcrop.com contact (§1/§7/§10), OpenAI API as no-training but not zero-retention (§3), a 16-and-over minimum age (§8), and added CCPA/CPRA and GDPR/UK GDPR sections (§7). Still pending counsel review.
- 2026-06-30 — initial draft.
10. Contact
Questions about this policy or your data: privacy@capcrop.com.