Privacy Policy

Last Updated: October 5, 2026

Cutout Magic

This Privacy Policy describes how Cutout Magic collects, uses, and handles your information when you use our website or browser extension.

1. Information We Collect

1.1 Image Data

When you use Cutout Magic to extract or remove objects and backgrounds, we process the images you choose to upload. These images are stored on Cloudflare R2 to allow you to access them at any time.

1.2 Account Information

We collect basic information such as your email address and name provided by you directly during registration. This data is stored in Turso (a secure SQLite database).

1.3 Usage Credit Data

Some tools cost usage credits that you can purchase. We keep track of these purchases and history (which tools you used and when) to manage your balance.

1.4 Security and Session Data

To protect against abuse, bots, and unauthorized access, we collect and store the following when you log in:

• IP Address: Your IP address is stored with your session. This helps us detect and prevent brute-force attacks, spam, and other malicious activity.
• User Agent: The browser and device information you use to access our service is stored with your session to help identify unusual login patterns.

We also use rate limiting (20 attempts per 60 seconds) to prevent automated attacks.

1.5 Extension-Specific Data

The Cutout Magic browser extension only accesses the images that you explicitly upload.

1.6 API Keys

To connect MCP clients (like Claude Desktop) to your account, you can create API keys in Settings. We store only the key's name, a short prefix shown in the settings page, and a hash of the key — the plaintext key is shown once on creation and never stored. We record when a key was last used. Revoking a key deletes it immediately.

Images and images uploaded or processed through an API key are treated exactly like data from your browser session: they are yours and are sent to the same third-party AI providers described in section 4.

2. How We Use Your Information

We use the collected data to:

• Process images and provide the cutout/labeling/cropping services you request.
• Manage your account and usage credit balance.
• Maintain a history of your processed images for your convenience.
• Protect against abuse: IP address and user agent data help us enforce rate limits and detect bots, hackers, or other malicious actors attempting to abuse our service.

3. Extension Permissions

Our browser extension requires the following permissions to function:

• sidePanel: To provide a convenient interface for managing and uploading images.
• Host Permissions: To communicate with our API to access your account and process images.

4. Data Sharing and Third Parties

We do not sell or share your personal data with anyone else—including IP addresses and user agents. We only use this data internally to protect our service from abuse. We process your data using the following third-party services:

• AI Service Providers: We use Google Cloud Vision to annotate and label images (including an automatic label pass on every upload) and Google Gemini for advanced object cutouts. Background removal runs through a Cloudflare worker, and uploads pass an automated content check. Images and image data may also be processed by these services. These providers process images according to their own privacy policies.
• Payment Processors: We use Stripe to securely handle usage credit purchases.

When you delete your account, we also request deletion of your data from these providers, except where retention is required by law (for example, payment records held by Stripe).

5. Data Retention

• Images: Images and their processed versions are stored on Cloudflare R2 while your account is active so you can access your history. You can delete individual images at any time. Deleting your account permanently erases your images and every processed version from our storage.
• Account Data: Your profile (name and email), collections and favorites, API keys, pending verification codes, and sessions are retained while your account is active. Deleting your account permanently erases them from our active systems.
• Usage Credits: Your credit balance and usage history are kept while your account is active to maintain an accurate balance and provide a record of your transactions. Deleting your account erases your credit ledger; records of purchases remain with our payment processor as required for payment processing and legal/tax obligations (see Section 4).
• Session Data: IP address and user agent are stored with your session and retained for the duration of the session (up to 7 days). When a session expires or is deleted, this data is deleted with it. Deleting your account deletes all of your sessions.

You may delete individual images at any time, and you may delete your entire account by emailing contact@cutoutmagic.com. Account deletion is permanent and irreversible. Limited residual copies of your data may persist for a short time in CDN edge caches (which expire automatically) and for up to 30 days in backups kept solely for disaster recovery; we do not use them for any other purpose. Certain records, such as payment records, may be retained where required by law.