Last Updated: December 2025 • Version: 1.0.0
Your images never leave your device. Period.
We don't collect, store, or transmit your images to our servers. We don't track you, profile you, or sell your data. The only thing we store are anonymous mathematical hashes (fingerprints) that you optionally contribute to help the community.
This isn't marketing speak - it's architectural fact. Our system is designed so that it's technically impossible for us to see your images.
| Data Type | Collected? | Details |
|---|---|---|
| Images | ❌ NEVER | All ML processing happens in your browser. Images never leave your device. |
| Personal Information | ❌ NO | No names, emails, phone numbers, or any personally identifiable information. |
| Tracking Cookies | ❌ NO | No cookies, no tracking pixels, no analytics scripts. |
| Browsing History | ❌ NO | We don't know what websites you visit or what you look at. |
| Device Fingerprints | ❌ NO | No browser fingerprinting, canvas tracking, or similar techniques. |
| Cryptographic Hashes | ✅ YES (optional) | Only if you enable "Contribute to Database". See below for details. |
| Server Logs | ✅ YES (minimal) | Standard server logs (IP, timestamp, request path) for rate limiting. Auto-deleted after 7 days. |
When you enable "Contribute to Database" (it's on by default but you can turn it off), the extension computes mathematical "fingerprints" of images and sends these to our community database.
a7f3d8c9...)Hashes are one-way functions. Given a hash, it's computationally infeasible to reconstruct the original image. Even if our entire database leaked, attackers couldn't recover your images.
This is fundamentally different from cloud-based AI detection services that require uploading your actual images.
Our API server (api.qwip.io) runs on Vercel and maintains standard HTTP access logs:
IP addresses in logs are never associated with the hash data you contribute. They exist only for rate limiting and are deleted quickly.
The extension settings give you full control:
Because we don't collect personal information, most data protection regulations don't apply to our core functionality. However, we're designed to exceed these standards:
In the unlikely event our database is compromised, attackers would gain:
Hash Collision Analysis: In theory, if an attacker has a large database of known images and their hashes, they could match your contributed hashes to identify which images you viewed. This is why we use multiple hash types and don't store URLs.
Timing Attacks: Server response times could theoretically leak information. We add random delays to prevent this, but it's a known limitation.
We document these risks because transparency matters. For maximum privacy, use local-only mode.
We chose Vercel because they're SOC 2 compliant and don't scan or mine customer data.
Our service is not directed at children under 13. We don't knowingly collect data from children. If you believe a child has contributed data, contact us to remove it.
We'll update this policy if our privacy practices change. Material changes will be announced:
Continued use after changes constitutes acceptance. If you disagree, disable server features or uninstall the extension.
If you have privacy questions or want to exercise your rights:
Privacy isn't a feature we added - it's the foundation of our architecture. We can't see your images even if we wanted to. We can't track you even if someone paid us to.
This is by design, not by promise. Trust, but verify: our code is open source.