CutDrop removes image backgrounds and gives you a transparent PNG. This page explains what we collect while you do that, and what we deliberately don't. The short version: your images are processed in memory and are not stored on our servers.
Who we are
CutDrop ("we", "us") operates this website and the background-removal service offered on it. You can reach us at zdjingji@gmail.com for any privacy question or request.
Where this policy applies
CutDrop is offered primarily to users in the United States, and to users elsewhere where we accept them. We handle personal information as described here wherever you are, and the rights in this policy are available to everyone — we don't limit them by location.
What we collect
- Account details from Google. When you sign in, Google gives us your account identifier, email address, display name and profile picture URL. We use the identifier to recognise you on future visits; we never see your Google password.
- Your images. The image you upload is sent to our processing partner to remove the background, then returned to you. We do not keep a copy of the image or the result.
- Processing metadata. For each job we record whether it succeeded or failed, the input file size, the time it took, the number of credits charged, and a timestamp. This is how we keep your credit balance accurate.
- Credit and payment records. Your balance, every credit movement, and — when you buy a pack — the payment order ID, capture ID, amount, currency and the email address PayPal shares with us. Card and bank details go directly to PayPal; they never reach our servers.
- Technical data. Standard server logs from our hosting provider (IP address, browser user agent, timestamps) kept for security and abuse prevention.
Cookies
We use two kinds of cookie, both strictly necessary:
- Session cookie (
cutdrop_session) — a signed, HttpOnly cookie that keeps you signed in for up to 7 days. It contains your account identifier, not your personal details. - Sign-in handshake cookies (
cutdrop_oauth_state,cutdrop_oauth_return) — short-lived cookies that protect the Google sign-in step against cross-site request forgery and remember where to send you afterwards. They expire after 10 minutes.
We do not use advertising cookies, cross-site trackers, or third-party analytics that profile you.
Who else is involved
We keep the number of processors small, and each one only gets what it needs:
- Google — sign-in only (OAuth 2.0).
- remove.bg — receives the image you upload in order to perform the background removal. Their handling of that image is governed by their own privacy policy and retention rules.
- PayPal — processes payments and holds your payment instrument. We receive only the transaction result.
- Cloudflare — hosts the site and the API, and terminates TLS.
We do not sell your personal data, and we do not share it for advertising.
How long we keep things
- Images and results: not stored at all.
- Account details and credit records: kept while your account exists, because your credits never expire.
- Processing metadata and payment records: kept while your account is active, and afterwards only as long as required for accounting and tax purposes.
- Server logs: rotated automatically within 30 days.
Your rights
Whatever your location, you can ask us to show you what we hold about you, correct it, or delete your account and its data. Email zdjingji@gmail.com and we'll respond within 48 hours on business days.
If you live in the United States, state privacy laws — California's CCPA/CPRA and similar statutes in other states — give you specific rights over your personal information:
- To know what categories of personal information we collected, and why.
- To access a copy of it.
- To correct information that is inaccurate.
- To delete it, subject to records we're required to keep by law.
- To non-discrimination — we won't degrade the service, charge you more, or deny you credits for exercising these rights.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising — so there is nothing for you to opt out of. We don't run targeted ads or embed third-party advertising trackers.
To exercise any right, email us from the address on your account. We may verify your identity by confirming control of that mailbox. You can also use an authorised agent acting with your written permission.
Deleting your account removes your profile, balance and credit history. Payment records we must retain for tax and accounting purposes may be kept for the statutory period.
Security
Traffic is encrypted in transit with TLS. Session cookies are signed with a server-side secret and marked HttpOnly, so page scripts cannot read them. Access to production data is limited to the operator.
Children
CutDrop is not intended for children under 13 (or the minimum age in your country). We do not knowingly collect data from them. If you believe a child has used the service, contact us and we will remove the account.
Changes
If this policy changes in a way that affects you, we'll update the date at the top and, for significant changes, note it on the site. Continuing to use CutDrop after a change means you accept the updated policy.
Questions about your data? Email zdjingji@gmail.com — a human reads it.