Crop

Circle crop image Crop image

Optimize

Compress image Remove background Upscale image

Modify

Resize image

Convert

Other

Convert JPG to PDF

Privacy policy

Plain English. Nothing hidden, nothing surprising, your photos stay on your device, and we explain exactly what we do collect.

The short version

  • Most tools run 100% in your browser. Circle Crop, Crop Image, Resize, and Convert or Image-to-PDF with a single image work on your device with the HTML5 Canvas API. Nothing is uploaded. The one exception is a single image converted to AVIF, described below.
  • Some paths send your image through our infrastructure: Compress, Remove Background, Upscale, a single-image conversion to AVIF, and Convert or Image-to-PDF with two or more files. Uploaded images are deleted automatically on the schedule described below, and they are never indexed, logged or used to train anything.
  • We do not set tracking cookies on our own pages. We measure usage with our own cookieless beacon (a random per-tab id in sessionStorage, no IP address stored, no cross-site tracking) and send technical error reports to Sentry. Advertising cookies from Google AdSense load only on tool pages, and only after you consent in regions that require it.
  • You can check the browser-only claims yourself. Open DevTools, go to Network, and run Circle Crop, Crop Image or Resize: no request carries your image.

Who we are, controller identification

For the purposes of the GDPR (EU), the LGPD (Brazil), the CCPA/CPRA (California) and similar laws, the data controller is Guilherme Campos, reachable at privacy@roundcut.app for data-protection requests. General support is at support@roundcut.app.

Under Brazil’s Resolução CD/ANPD nº 2/2022, this project is a small-scale processing agent (“agente de tratamento de pequeno porte”) and does not have to appoint a Data Protection Officer (Encarregado). The controller above is the direct channel for data subjects, as Art. 11 of that Resolução and §2 of Art. 41 of the LGPD require.

Each operation below is mapped to its legal basis under LGPD Art. 7 (Brazil) and the equivalent GDPR Art. 6 (EU), so you can audit which basis we rely on for each path.

Your images: browser-only tools

When you use Circle Crop, Crop Image, Resize, Image-to-PDF with a single image, or Convert with a single image to JPG, PNG or WebP, the work happens entirely in your browser. The image bytes never leave your device. No copy is sent to our infrastructure, cached or logged, because no request carrying your image is made. Legal basis: not applicable, since we do not process the image.

Your images: paths that use our infrastructure

Compress, Remove Background, Upscale, a single-image conversion to AVIF, and the multi-file paths of Convert and Image-to-PDF go through our infrastructure. Legal basis for all of them: LGPD Art. 7, V, performance of the service you requested (a free service), plus our legitimate interest (Art. 7, IX) in running it reliably. GDPR equivalents: Art. 6(1)(b) and 6(1)(f).

Compress. So that the result is ready sooner, the tool may start uploading your images as soon as you add them, before you click “Compress”. Each image is uploaded once and goes through a signed URL to a private Cloudflare R2 bucket and is re-encoded in its own format by our compression service (sharp + libvips on a server in São Paulo, Brazil, rented from Hostinger). If that server fails, a copy of the same service running on Cloudflare Containers answers instead. If you change the files or leave the page, that early upload and its job are discarded. The result stays in R2 for up to two hours so you can download it, share it by link, or remove it at once with “Delete from server now”. After that it is deleted automatically. The image itself is never logged, indexed by user, IP address or file name, used to train a model, or made available to anyone outside the encoding service, and it is not kept beyond the times stated here. The server keeps technical request logs (route, formats, sizes, timings and a request id), without your IP address or file names, for up to 14 days. If the service cannot be reached, the tool compresses in your browser instead, with no upload.

Remove Background. Your image is uploaded once to our Cloudflare Worker (roundcut-bg-remover), staged in a private R2 bucket (roundcut-bg-temp) and cut out by Cloudflare’s cf.image.segment transformation, which runs the BiRefNet model on Cloudflare’s GPUs. The staged copy is deleted as soon as the cutout comes back, and an R2 lifecycle rule removes any leftover within one hour. The cutout may stay in Cloudflare’s cache for up to one hour, so the same image is not processed twice. If that route fails, the Worker sends the image to ImageKit, which makes the cutout and deletes the uploaded copy right after. If both routes fail, a model runs inside your browser instead, with no upload. Images over 20 MB are shrunk in your browser before upload, and each IP address can make up to 30 requests a day.

Upscale. Your image is uploaded once to our Cloudflare Worker (roundcut-upscale) and enlarged by Cloudflare’s upscale=generate transformation, an AI super-resolution model. The staged copy is removed by the same R2 lifecycle rule, and the result may stay in Cloudflare’s cache for up to seven days so a repeated request is answered without processing again. If that route is unavailable, the image is sent to ImageKit to be enlarged there. The copy uploaded to ImageKit on that route stays in ImageKit’s storage so repeated requests can be served from its cache, and today it is not deleted automatically. You can ask us to delete it at privacy@roundcut.app. If both routes fail, the image is enlarged in your browser. Daily limits per IP address apply.

Convert and Image-to-PDF. A single image in either tool is processed in your browser and never uploaded, with one exception: a single image converted to AVIF is sent once to the same service as Compress (api.roundcut.app), whose encoder makes a smaller file, and comes straight back to you. If that service cannot be reached, your browser encodes the AVIF itself. When you pick two or more files, they may be sent to the same service as soon as you add them (and are discarded if you change them or leave), processed there, and returned as a ZIP or PDF through a temporary download link that expires after about two hours. Each tool page states which path applies.

Apart from the time limits above, your image is not kept, and it is never indexed, sold or shared with anyone beyond the named provider doing the work. We do not look at your images, and we have no process that would show them to us.

Site visit data

We measure usage with our own first-party beacon. Each page sends small events to our own address (/api/ev), where a Cloudflare Worker (roundcut-metrics) checks them and writes them to Cloudflare’s Workers Analytics Engine. The beacon sets no cookies, does not fingerprint your device and does not give you a persistent identifier. It keeps a random per-tab id in sessionStorage so the steps of one visit can be read in order. That id is discarded when you close the tab and cannot be used to recognise you later or on other sites. The beacon honours your browser’s Do Not Track setting: with DNT on, no event is sent at all, and browsers driven by automation send nothing either.

An event can contain the page path (never the query string), the page language, which tool you used, each step it went through and how long it took, whether it finished, failed or was left before the end (and in which state: processing, done but not saved, or editing), which of our processing routes served it, the kind of error when something fails, and where you came from (the referring site’s host name, or the source tag of the link that brought you). Besides the per-tab id, an event may carry a random id for the current run of a tool, created in your browser and replaced each time you start over. About a file you add, only its format and a size range travel. About each file you download, we record technical properties so we can detect files that will not open on some devices: its format, its encoding profile (for AVIF the AV1 profile, chroma subsampling, bit depth and whether it has transparency, for JPEG progressive or baseline and chroma subsampling, for PNG the colour type and bit depth, for WebP lossless or lossy and transparency), a band for its longest side (up to 2,048, 4,096, 8,192 or 16,384 pixels, or larger), whether its dimensions are even or odd, and which of our quality rules it broke, if any. Never a file name, exact dimensions, byte size, pixels or photo metadata. An event can also say what your browser handles: whether it opens AVIF, WebP and JPEG XL images, and ranges for memory, processor cores and screen density. The Worker adds your country and the Cloudflare data center, plus the device type, operating system and browser with their versions, read from the browser’s identification string, and your network operator (ASN), which is left out of events that carry the browser ranges. Your IP address is not stored. When a request looks automated, the Worker keeps the first 80 characters of that identification string so bot traffic can be kept apart. Events are kept for 90 days. After that only anonymous totals remain.

When something breaks, the same Worker forwards a short technical report to Sentry, our error-monitoring service: the error message with file names and web addresses removed, the page, the tab id, your country, device and operating system. Your IP address is not forwarded, and Sentry keeps these reports for up to 30 days. Legal basis: LGPD Art. 7, IX, legitimate interest in keeping the tools working and measuring their use, supported by a documented balancing test. GDPR Art. 6(1)(f) equivalent.

Strictly necessary cookies

Cloudflare, our hosting, DNS and edge provider, may set a few strictly necessary cookies to deliver the site and protect it from automated abuse (for example the __cf_bm bot-management cookie). They are not used for advertising or tracking. Legal basis: LGPD Art. 7, IX, legitimate interest in site security. Under the ANPD’s 2022 cookie guide, strictly necessary cookies do not need prior consent. See the Cloudflare cookie policy for the full list.

Preferences kept in your browser

RoundCut keeps a few small items in your browser. A roundcut_locale cookie remembers the language you picked in the language menu, for one year. localStorage holds your theme (light or dark) and whether you installed the site as an app. sessionStorage, which is cleared when the tab closes, holds the per-tab id of the usage beacon, a Google Drive access token if you open a file through the Drive picker, and small flags that stop a notice or a reload from repeating. None of these is used for advertising or to follow you across sites. Legal basis: LGPD Art. 7, V, performance of the service you requested (your preferences).

Abuse limits

To keep the free tools available, the Remove Background and Upscale Workers count requests per IP address per day in Cloudflare KV storage. Each counter holds only the number of requests, never images or other content, and expires after about a day. Legal basis: LGPD Art. 7, IX, legitimate interest in keeping the service available.

Advertising

RoundCut shows AdSense ads served by Google on tool pages (a band on the start screen, a banner beside the editor on desktop, and up to three units around the download screen) and two units inside blog posts. Institutional and legal pages carry no ads.

Legal basis: LGPD Art. 7, I, your consent. Under the ANPD’s 2022 cookie guide, advertising cookies are not strictly necessary and need explicit prior consent through a banner that offers “accept” and “reject” with equal prominence.

We use Google Funding Choices as our consent management platform (CMP). It is AdSense’s own CMP, implements the IAB TCF v2.2 consent signal, and is the path Google recommends for LGPD, GDPR and CPRA compliance. The banner is shown automatically to visitors from regions that require prior consent (EU, UK, Brazil, California). Your choice (accept all, reject all, or customize) is stored and respected on later visits, and you can reopen it at any time through the “Privacy” link the CMP adds to the page footer.

When you consent, third-party vendors including Google may use cookies and web beacons to show personalized ads based on your visits to RoundCut and other websites. If you decline, AdSense still shows ads, but only non-personalized ones, chosen from the page content and not from your browsing history. You can also turn off personalized advertising in Google’s Ads Settings, or use aboutads.info for industry-wide opt-outs.

Some download screens show one card labelled “Sponsored” that recommends a third-party service related to what you just did (for example, an AI headshot service on the circle-crop tool). Its link carries our affiliate code: if you buy there, RoundCut earns a commission and you pay the same price. The card is a plain link. Nothing from the partner loads on our pages, no cookie is set here, and we send the partner no personal data. Any tracking starts on their site, under their own privacy policy. We count clicks on the card with the same cookieless beacon described above.

Premium tier (future)

We plan to offer an optional paid “RoundCut Pro” tier, processed through Lemon Squeezy as merchant of record. If you subscribe, Lemon Squeezy will process your billing details (name, email, billing address, payment method) under its own privacy policy, and we will receive only a confirmation that your license is valid plus your email address for licensing messages. Legal basis: LGPD Art. 7, V, performance of the contract you enter into when subscribing.

Until the Pro tier launches, no payment information of any kind is processed by us or on our behalf.

International data transfer

Our compression server runs in Brazil. Some providers work outside it:

  • Cloudflare, Inc. runs a worldwide network, so your requests, including Remove Background and Upscale, may be handled in the Cloudflare data center closest to you. If our São Paulo server fails, the fallback copy of the compression service on Cloudflare Containers may also run outside Brazil.
  • ImageKit handles the second route of Remove Background and Upscale.
  • Functional Software, Inc. (Sentry), a United States company, receives the technical error reports described above.
  • Google LLC serves advertising, subject to your consent.

Legal basis for the transfer: the ANPD recognised the European Union as offering an adequate level of protection in January 2026 (Resolução CD/ANPD nº 32/2026, LGPD Art. 33, I), and the European Commission recognised Brazil in turn, which also covers images that visitors in the EU send to our server in Brazil (GDPR Art. 45). For other countries, including the United States, we rely on standard contractual clauses (LGPD Art. 33, II, GDPR Art. 46(2)(c)) together with the transfer being needed to provide the service you asked for (LGPD Art. 33, V).

Sub-processors

  • Cloudflare, Inc. DNS, hosting (Cloudflare Workers static assets), DDoS protection, our analytics store (Workers Analytics Engine), Workers (roundcut-bg-remover, roundcut-upscale, roundcut-compress-proxy, roundcut-metrics), R2 storage (roundcut-bg-temp, cleared hourly, plus short-lived job results for downloads and shared links), KV abuse counters, the cf.image transformations used by Remove Background and Upscale, and a fallback copy of the compression service on Cloudflare Containers. Privacy policy.
  • Hostinger International Ltd. The server in São Paulo, Brazil, behind api.roundcut.app (Compress, AVIF conversion, multi-file Convert, multi-file Image-to-PDF). Privacy policy.
  • ImageKit (Raw Engineering Inc.) Second route for Remove Background and Upscale. Privacy policy.
  • Functional Software, Inc. (Sentry) Error monitoring: technical error reports forwarded by our Worker, without your IP address. Privacy policy.
  • Google LLC (AdSense) Ad serving on tool pages, subject to your consent in regions that require it. Privacy policy.
  • Lemon Squeezy LLC Only if you buy a Pro license in the future. Privacy policy.

Your rights as a data subject

Depending on where you live, you have rights under laws including the EU’s GDPR, Brazil’s LGPD (Art. 18), the California CCPA/CPRA and similar regulations.

Under Brazil’s LGPD (Art. 18), you have the right to obtain from us:

  1. Confirmation that we process your personal data (item I).
  2. Access to the data we hold about you (item II).
  3. Correction of incomplete, inaccurate or outdated data (item III).
  4. Anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the LGPD (item IV).
  5. Portability of your data to another provider, as regulated by the ANPD and subject to commercial and industrial secrets (item V).
  6. Deletion of data processed on the basis of your consent, except where the LGPD allows retention (item VI).
  7. Information about the public and private entities we have shared your data with (item VII).
  8. Information about the option of not giving consent and what refusing means (item VIII).
  9. Withdrawal of consent at any time (item IX).

To use any of these rights, email privacy@roundcut.app. Under the small-scale regime of Resolução CD/ANPD nº 2/2022 (Art. 14, I), our maximum response time is 30 days, and we aim to answer within 5 business days.

Because the service holds almost no personal data tied to you (no accounts, no persistent identifiers, no logged image content), most of these rights are met by the design itself. If you would like written confirmation that no data is held about you, email the address above.

Right to complain to the supervisory authority

In Brazil, you can also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd. In the EU, contact your national data-protection authority.

Children and adolescents

The LGPD defines a child as a person up to 12 years old and an adolescent as someone from 12 to 17 (Art. 14). RoundCut is a general-audience tool and is not directed at children.

Processing a child’s data requires specific and prominent consent from at least one parent or legal guardian (Art. 14 §1). Since the service is not directed at children and asks no user for identifying information, we do not knowingly collect children’s personal data through normal use. If you learn that a child has submitted personal information through the site, write to privacy@roundcut.app and we will delete it.

Changes to this policy

When something material changes, for example when the Pro tier launches or a new tool changes how data flows, we update the “Last updated” date below and, where appropriate, post a notice on the home page.

Contact {#contact}

Questions about this policy or about how RoundCut handles data? Email privacy@roundcut.app. We aim to answer within 5 business days. The legal maximum under the LGPD small-scale regime is 30 days.

Controller: Guilherme Campos. Brazil, privacy@roundcut.app Last updated: 2026-09-28