Privacy Policy

This site (the "Service") operates under the brand mosfoto. For any privacy questions, write to hi.oleksiv@gmail.com.

Your photo (photo tool). When you upload a photo, it is sent over an encrypted connection to our server, where it is framed, its background is replaced with white and the result is checked against the MOS requirements. How the processing works is described in section 3, and how long files are kept in section 4.

Your passport pages (passport PDF tool). When you scan or upload pages of your passport, each page is sent over an encrypted connection to our server as soon as you add it, so your session survives a reload. These images contain identity document data: your photo, name, date of birth, passport number, visas and stamps. To check the set, a downscaled copy of each page is sent to an AI model (section 3), which tells us which part of the passport the page shows, the printed page numbers and the holder's name on the data page. That name is kept with the session to label it in your list and to name the downloaded file; the downscaled copies are deleted right after the check. The finished PDF is assembled on our server from the stored pages and is kept, together with them, for the time stated in section 4.

Session records. For each editing session, whether a photo or a passport, we keep a record in our database: a random session identifier, timestamps of each step (uploaded, processed, paid, downloaded), the site language, the device type (mobile or desktop), the country derived from your IP address by our hosting provider (the IP address itself is not stored), the outcome of the automated checks, the framing you chose, the random browser identifier described in section 5 and, for a passport, the holder's name read from the data page. These records contain no images. They let us see where the tool fails, show your recent sessions on this device and handle refunds.

Payments. If you buy a photo or a passport PDF, the payment is handled by Stripe. You enter your card or BLIK details directly in Stripe's form; they never reach our servers. From Stripe we receive the payment identifier, its status (paid or not), the amount and the type of payment method (for example card or BLIK), which our server checks before releasing the file. A link to your result page is attached to the payment record in Stripe so we can handle refunds. For the photo tool the payment identifier is also kept in your browser for 7 days so you aren't charged again for photos your payment already covers. If you give Stripe an email for a receipt, it is stored by Stripe, not by us.

Product analytics. We use PostHog (EU instance, eu.posthog.com) to understand how the tools are used. PostHog receives: page views, clicks on buttons and links, and custom events such as Image Uploaded, Background Removed, Checkout Completed, Image Downloaded, PDF Pages Added, PDF Downloaded — together with technical properties such as a file's MIME type, dimensions and size in bytes, the number of pages, whether the check passed, and the payment identifier (never payment details, never the images). Each visitor gets an anonymous random identifier; we do not ask for, collect or store names, emails or any other personal identifiers. Until you accept analytics cookies (section 5), PostHog runs in anonymous mode: nothing is stored in your browser and no session is recorded.

Session recordings (important). If you accept analytics cookies, PostHog records a reconstruction of what happens on the page (mouse movements, clicks, scrolling, the visible interface) so we can debug issues and improve the UX. This recording includes the images visible on screen — the photo you are cropping, and in the passport tool the pages of your passport — the same way they appear on your screen. Only the site operator and PostHog (as a processor) have access to these recordings. If you would rather not have this captured, decline analytics cookies in the banner, or use the tools without accepting it.

Error reports. If the app throws an unexpected error, the error message and stack trace are sent to PostHog so we can fix it.

Advertising measurement. We advertise on Google and use the Google Ads tag (Google Ireland Ltd.) to learn which ads lead to a purchase. When a payment is confirmed, the tag reports the amount, the currency and the Stripe payment identifier to Google. Until you accept cookies, the tag runs in consent mode: it stores nothing in your browser and sends only cookieless signals that Google uses for aggregated, modelled measurement. If you accept, Google may store its advertising cookies (such as _gcl_au) to link your ad click to the purchase and may use this for ad personalization.

We do not use advertising trackers, do not profile users, do not run A/B-test third-party scripts, and do not share data with marketing partners.

Background removal. In the photo tool your photo is processed by the open-source BiRefNet model hosted on Replicate. The editor then shows a watermarked preview of the result; the full-resolution file stays on our server and is released to your browser only after payment. See replicate.com/privacy for how the model provider handles data.

Automated checks. The finished photo (photo tool) and downscaled copies of your passport pages (passport tool) are sent to OpenAI's API, which answers a fixed list of questions: for a photo, whether it meets the MOS portal's rules (one face, neutral expression, no glasses, even lighting and so on); for passport pages, which part of the passport each page shows, the printed page numbers, the holder's name and whether the set is complete and in order. OpenAI does not use data sent through its API to train its models and may retain it for up to 30 days to monitor for abuse. See openai.com/policies.

The results of these checks are hints shown to you in the tool. They do not decide anything on your behalf: you choose whether to pay and what to submit, and the decision on your application is made only by the authority.

Where files live. Uploaded photos, passport pages, intermediate files and finished results are stored with our hosting provider (Vercel). Each file is kept under a random, unguessable name, and the link to your session is the only key to it: anyone who has the link can open the session until its files are deleted, so do not share it.

Photo tool. The uploaded photo, the cut-out, the preview and the full-resolution result are kept for 24 hours from the upload, then deleted automatically. The payment link expires with them.

Passport tool. The pages you add, their edited versions and the finished PDF are kept for 24 hours from the start of the session, or 24 hours from payment if you pay, then deleted automatically.

Earlier deletion. In both tools you can delete the files at any time with the Delete button; after that the session cannot be opened again. We cannot restore deleted files, so download and keep your own copy.

What stays. After the files are gone, the session record described in section 2 remains without images and, for a passport, without the holder's name. Payment records (amount, date, Stripe identifier) are kept for as long as accounting and tax law requires.

We do not show ads on this site. Advertising cookies (Google Ads, section 2) are set only if you accept cookies. When you first visit, a banner asks whether you accept analytics cookies. If you accept, PostHog stores an anonymous identifier in your browser (a cookie and localStorage) so repeat visits can be counted as one person rather than two strangers, and session recording is switched on. If you decline, PostHog stays in anonymous mode and stores nothing in your browser. Your choice is kept in localStorage under mosfoto.analytics-consent; clear the site's data to be asked again.

Independently of that choice, the site keeps a few values in localStorage so it can work without an account: a random browser identifier (mosfoto_client) that lets the site list your recent photos and passports on this device; for the photo tool, the Stripe payment identifier (mosfoto_paid_session) for 7 days, so you are not charged again for photos your payment already covers; and the identifier of your latest photo (mosfoto_last_generation) for 24 hours, so the home page can offer to finish it. None of these contains personal or payment data, and you can remove them at any time by clearing site data.

Replicate, Inc. — AI model hosting used for background removal in the photo tool; photos are processed transiently and temporary files are deleted immediately after processing. See replicate.com/privacy.

OpenAI, L.L.C. — the AI model that runs the automated checks on finished photos and passport pages, through OpenAI's API. See openai.com/policies.

Stripe Payments Europe, Ltd. — payment processing for the paid downloads. Card and BLIK details are entered directly into Stripe's form and never reach our servers. See stripe.com/privacy.

Vercel Inc. — hosting, infrastructure and the storage of your files (section 4). See vercel.com/legal/privacy-policy.

Supabase, Inc. — the database that holds the session and payment records (section 2). See supabase.com/privacy.

PostHog (EU) — product analytics, session recording and error tracking. Data is stored on EU servers (eu.posthog.com). See posthog.com/privacy.

Google Ireland Ltd. — the Google Ads tag that measures which ads lead to a purchase (section 2). See policies.google.com/privacy.

Each provider has its own privacy policy and acts as an independent processor or controller under GDPR.

You have the right to: access your data, rectification, erasure, restriction of processing, portability, objection, and to lodge a complaint with a supervisory authority (in Poland — UODO, uodo.gov.pl).

Send requests to hi.oleksiv@gmail.com. We will respond within 30 days. Because files are deleted within 24 hours and we hold no names or emails, please include the link to your session or the Stripe payment identifier so we can find the records that concern you.

We may update this policy. The current version is always available at this URL. The last revision date is shown below.