Privacy policy
What happens to an image you upload, what we keep about you, and what you can ask of us. Short version first.
Last updated 22 October 2026
Overview
The short version
Blinkimg compresses and converts images, and measures the images on a page you name. This page says what happens to an image you upload, what a page scan keeps, what we keep about you, and what you can do about it. It covers the website and the developer API. What we provide and what we ask of you is the terms of service; this page is what we hold.
- Your images are deleted within 24 hours. They are used for the one job you asked for and for nothing else.
- Nothing is used for training. No image and no result ever trains a model, ours or anyone else's.
- We keep little about you. An email address and a name if you have an account, and counts of what you did. Not the images.
- A page scan is kept for 30 days. The analyzer measures a page you name and keeps the numbers and a screenshot for that long. It never keeps that site's images.
- Free pages show Google ads. Paid plans show none. The Advertising section says how to opt out.
- We never sell your data. Not to advertisers, not to anyone.
Deleted within 24 hours, automatically
Uploads and results sit in storage behind signed links that expire. A sweeper removes every file within 24 hours of the upload. Nobody has to remember to do it, and nobody can switch it off.
Who we are
Who is responsible
Blinkimg is an independent service run by its founder. There is no company behind it yet; when one is formed, this page will name it. Until then the person who runs Blinkimg is the data controller for everything described here, and the address at the end of this page reaches that person directly.
Questions about privacy go through the contact page, or to sahadat@blinkimg.com.
Your images
What happens to an image you upload
An image travels over HTTPS to our storage, where it waits for a worker. The worker reads it, produces the result you asked for, and writes the result back to the same storage. You download it over a signed link that works for a short time and for that file only.
While it is with us
- It is stored for at most 24 hours, then deleted by an automated sweeper. Downloading it, or closing the tab, does not extend that.
- Metadata is stripped by default. Camera details, editing history, the GPS position, comments and anything hidden after the picture do not travel into the result unless you choose to keep them.
- Nobody looks at it. No person opens your files. If you send us a file with a support question, we open that one, then delete it.
- It is never used for training, benchmarks or marketing. Not by us, and not by a provider.
Kept for the day
What we hold for those hours
The original, the result, the file’s name, and a fingerprint of the original, so a second upload of the same file with the same settings reuses the finished result instead of running again. The name and the fingerprint go when the file does.
Never
What we do not do
Look at your images, share them, keep them past the day, use them for anything but your job, or let an advertiser near them.
Records
What we keep after the image is gone
Once the files are gone, a few records remain. None of them contain the image.
- Job records
- The format in and out, the sizes before and after, the settings, how long it took, any error, and who asked: the account if there is one, the visitor id from the robot check, and the network address. Kept 30 days, then purged. The file’s name and its fingerprint sit in the record only while the file exists, and are cleared when it is deleted. The upload’s own record, its size and the network address, is kept the same 30 days.
- Usage ledger
- One row per finished image: when, which surface (the website or the API), the bytes in and out, and the credits it cost. Kept with no end date, because it is the record behind your credits and your invoices; when an account is deleted, its rows stay with the de-identified account, with no name or address on them. The network address in every row is removed after 30 days, and what stays is the time, the surface, the bytes and the credits.
- Free-use counters
- The website's free allowance is counted for the hour and the day per visitor once the robot check has given your browser a visitor id, and per network address until then. Every counter expires on its own; the visitor id lasts 30 days.
- Contact messages
- What you write through the contact page, with your name and address, kept for a year so a second message finds the first; a message marked spam goes after thirty days. A file sent with it is deleted within 24 hours, like every upload.
- Ratings and reviews
- Your star rating, and if you write a review, your words, name, optional role, optional social profile and email. The email is never shown: it keeps one review per person and lets us reply. When a review is approved, we look up your photo, from your GitHub profile if that is the profile you gave, else from Gravatar for your email, and show a copy of it with your review; Gravatar receives a coded form of your email, never your review. A key your browser keeps tells a second rating from you apart from a new person. Kept until you ask us to remove them.
- Scan reports
- The page address you scanned, the numbers, a screenshot and who ran it. Kept 30 days, or until you delete it; the section below says what a scan touches.
- Server logs
- Request logs record the route, the time, the outcome and the network address, never the file. They exist for debugging, not for profiling.
The page analyzer
What a page scan keeps
The website image analyzer takes a web address you type, loads that one page in a browser we run, and measures its images. It tells you how much smaller they would be through Blinkimg. Nothing on the site changes. This section says what a scan touches and what stays behind. It shipped on 17 September 2026.
What we fetch, and from where
A browser on Google Cloud Run, in Northern Virginia, United States, loads the page you named. It fetches that page and the images the page shows, and nothing else on the site. It identifies itself as BlinkimgBot/1.0, with a link to the analyzer, and it stays away from a page whose robots.txt tells BlinkimgBot to.
What we keep
- The address you typed, and the address of each image the page showed.
- The numbers: how many images, their size as served, their size after our engine, their format, and the pixels served against the pixels shown.
- A screenshot of the page, and a small card drawn from the numbers, for the report and its share link.
- Who ran it: the account for a member; for a visitor, the visitor id from the robot check, or the network address when the browser has none. A visitor’s report shows totals only until it is claimed by an account.
For how long
30 days, then the report and its pictures are removed by the same kind of sweeper that removes uploads. Delete it sooner with the button on the report.
What we never do with a site’s images
The images on a page you scan pass through our engine in memory and are gone the moment their size is measured. We do not store them, hand them to you, or use them for anything but the numbers on the report. A scan reads the page as a visitor would and writes nothing to the site.
A shared report is public
A report you claim can get a link. Anyone with the link sees the whole report: the address, the screenshot and every number. Share it where you would share the page itself. Delete the report and the link stops working.
When Google’s speed data is switched on, the page address goes to Google’s PageSpeed Insights API and the report shows what Google answers, under Google’s name. Google is already named under Where it runs; this sends it one more thing, the address of a page you chose.
Accounts
What an account stores
You can use the website without an account. An account adds a name, a plan, credits and API keys, so it stores more.
- Sign-in details
- Your email address, your name, and a hash of your password (Argon2id, with a server-side secret). We never store the password itself. When you set one, we check it against known leaked passwords by sending the first five characters of its hash to Have I Been Pwned; the password never leaves our server.
- Google sign-in
- If you sign in with Google, we store the Google account id, the email address and the name Google shares. Nothing else from your Google account.
- Two-factor authentication
- The secret for your authenticator app, encrypted at rest (AES-256-GCM), and hashes of your recovery codes. We cannot read a code back.
- API keys
- A hash of each key. The key itself is shown once, when it is made, and never stored.
- Profile picture
- If you add one, it is resized to 128 pixels and stored as WebP.
- Activity
- A log of sign-ins, key changes and security actions, with the network address for 90 days and without it for a year. Billing and administrative entries are kept longer, as accounting rules require.
- Sessions
- A session is removed 30 days after it ends. A signup that is never verified is removed after a day.
Payments
Billing through Stripe
Paid plans and packs are sold through Link, a Stripe company, as the seller of record: it charges the card, adds tax where it applies, sends the receipts and invoices, and offers an order page at link.com where the subscription can be managed too.
Stripe collects and stores your card. The number never reaches our servers. What we keep is what a receipt needs and what stops fraud:
- Your Stripe customer id, your plan and its state, and each invoice: the amount, the date and the reason.
- The card’s brand, last four digits, type and country, and Stripe’s fingerprint of it. The fingerprint lets us notice one card behind many free accounts.
- Refund requests and their outcome.
What Stripe does with your details is covered by Stripe's privacy policy.
Mail we send
Account mail goes to everyone with an account: verification codes, password resets, security notices and receipts. It cannot be switched off while the account exists, because it is how the account stays yours.
Product news goes only to members who agreed. Signing up is that agreement, and the form says so. Every such mail carries an unsubscribe link, and Settings has the same switch.
The newsletter, from the box in the footer, is separate. Clicking Subscribe is the agreement, and every issue carries an unsubscribe link.
Amazon Web Services delivers our mail. When an address bounces, or someone marks a mail as spam, we record that and stop sending to it.
Advertising
Ads on free pages
Free pages show ads from Google AdSense, to visitors and to members on the Free plan. Pro and Pro Max (see pricing) show none, and their browsers never load the ad script. On a tool page an ad appears only after you add a file, beside the work, never over it.
Google and other third-party vendors use cookies to serve ads based on your prior visits to this site and to other sites. Google’s advertising cookies let it and its partners serve ads to you based on your visits to this site and to other sites on the internet.
You can turn off personalised ads in Google’s Ads Settings. You can opt out of other vendors’ cookies for personalised ads at aboutads.info. Google explains what it does with data from the sites that show its ads in how Google uses information from sites that use its services.
In the EEA, the United Kingdom and Switzerland, no advertising cookie is set until you agree.
Ads never see your images. They load on the page; the image pipeline is separate, and nothing about a file goes to an advertiser.
Where it runs
Who processes your data
Our own servers do the work. A few providers run pieces of the service, and each sees only what its piece needs.
Hostinger
Our own servers, in Boston, United States. They compress your images and hold the records on this page.
Google Cloud Run
When our servers are busy, an image may be compressed in Google's Northern Virginia, United States region. It is held in memory for the seconds that takes and is never written to disk there. The analyzer's browser runs there too: it loads the page you named and measures its images the same way.
Cloudflare
Serves the site, runs the robot check, stores uploads and results for their 24 hours, and a scan report’s screenshot for its 30 days.
Amazon Web Services
Delivers our email, and tells us when an address bounces.
Stripe
Takes payments and stores your card, and its Link is the seller of record for paid plans. We never see the number.
Sign-in, if you choose it, and the address of a page you scan when its speed data is on. Google AdSense chooses and shows the ads on free pages (see Advertising).
Microsoft Clarity
Records how our public pages are used: clicks, scrolling and what the page shows, so we can see where a page confuses people. It sets no cookie, and each page view gets its own id. The compressor, the editor and every account and sign-in page are masked or never recorded, and it never loads for a browser that sends Global Privacy Control or Do Not Track.
How it is protected
HTTPS everywhere
Every request, upload and download is encrypted in transit.
Passwords hashed
Argon2id with a server-side secret. A copy of the database would not give up a password.
Two-factor authentication
Optional for everyone, with an authenticator app and recovery codes.
Signed links
Results download through links that expire and work for one file only.
Found a vulnerability?
Write through the contact page under Security, or to sahadat@blinkimg.com. Tell us what you found and how to reproduce it. We will reply, fix it, and credit you if you would like that.
Your rights
What you can ask of us
Wherever you live, you can ask for any of these. In the EEA, the United Kingdom, Switzerland, California and other places with a privacy law they are your rights under it; everywhere else we grant them anyway.
- See what we hold
- Ask, and we send you a copy of everything on this page that is tied to your account.
- Correct it
- Change your name and your email address in Settings; a new address is confirmed by a code sent to it. For anything else, ask, and we correct it.
- Delete it
- Delete the account yourself from Settings, or ask us to. Its plan and keys stop at once, and for 30 days you can restore it by signing in. After that, everything that identifies you goes: the address, the name, the password, the second factor, the photo, the Google sign-in, the sessions and the codes. The account’s usage ledger, invoices and refund records stay with no name or address on them, because they are the accounting record; nothing else does. Images need no request: they are gone within the day. A scan report has its own Delete button, and goes on its own after 30 days.
- Stop the mail
- The link in any product mail, or the switch in Settings. Account mail stops when the account does.
- Complain
- If you think we have handled your data badly, you can complain to the data protection authority where you live. We would rather hear from you first, and we will answer.
We answer every such request within 30 days.
Children
Blinkimg is not meant for children under 13, or under the age your country sets for agreeing to a service like this. We do not knowingly keep an account for one. If you think a child has made one, write to us and we remove it.
Changes
When this page changes
The date at the top moves when this page does. A change to who processes your data goes out by mail to members before it takes effect. A new feature that keeps its own record is described on this page from the day it ships, with the date. Small clarifications do not.
Contact
How to reach us
Privacy questions and requests
A form and an address, both read by a person.
- Write to us
- The contact page
- sahadat@blinkimg.com
- Answer within
- 30 days for a request about your data.