Privacy Policy

1. Who is the data controller

This site (the "Service") operates under the brand mosfoto. For any privacy questions, write to hi.oleksiv@gmail.com.

2. Data we process

Your images (processing). Cropping, rotating, format conversion (including HEIC) and compression run fully in your browser — the source file is not uploaded to our servers for these steps and is not stored by us. Background removal is the exception: to remove the background, the photo is uploaded over an encrypted connection to our server, where it is stored for up to 1 hour and then automatically deleted.

Product analytics. We use PostHog (EU instance, eu.posthog.com) to understand how the tool is used. PostHog receives: page views, clicks on buttons and links, and a handful of custom events such as Image Uploaded, Background Removed, Image Downloaded — together with technical properties like the file's MIME type, dimensions and file size in bytes (a number, not the file). Each visitor gets an anonymous random ID; we do not ask for, collect or store names, emails or any other personal identifiers.

Session recordings (important). PostHog records a reconstruction of what happens on the page (mouse movements, clicks, scrolling, the visible interface) so we can debug issues and improve the UX. This recording also includes the image visible in the editor — meaning the photo you are currently cropping appears in the replay in PostHog the same way it appears on your screen. Only the site operator and PostHog (as a processor) have access to these recordings. If you would rather not have this captured, do not use the editor with photos you would not want to share.

Error reports. If the app throws an unexpected error, the error message and stack trace are sent to PostHog so we can fix it.

We do not use advertising trackers, do not profile users, do not run A/B-test third-party scripts, and do not share data with marketing partners.

3. Background removal

When you press "Remove background", your photo is transmitted over an encrypted connection to our server, stored temporarily, and processed by the open-source BiRefNet model hosted on Replicate. The uploaded photo and its result are stored on our server for up to 1 hour, then automatically deleted. See replicate.com/privacy for how the model provider handles data.

4. Cookies and local storage

We do not use cookies for advertising or cross-site tracking, and we do not show ads. PostHog stores a single anonymous identifier in your browser (in localStorage) so repeat visits can be counted as one person rather than two strangers — this identifier holds no personal information and is not linked to any account.

5. Third-party providers

Vercel Inc. — hosting and infrastructure.

PostHog (EU) — product analytics, session recording and error tracking. Data is stored on EU servers (eu.posthog.com). See posthog.com/privacy.

Replicate, Inc. — AI model hosting used for background removal; photos are processed transiently and temporary files are deleted immediately after processing. See replicate.com/privacy.

Each provider has its own privacy policy and acts as an independent processor or controller under GDPR.

6. Your rights under GDPR/RODO

You have the right to: access your data, rectification, erasure, restriction of processing, portability, objection, and to lodge a complaint with a supervisory authority (in Poland — UODO, uodo.gov.pl).

Send requests to hi.oleksiv@gmail.com. We will respond within 30 days.

7. Changes to this policy

We may update this policy. The current version is always available at this URL. The last revision date is shown below.