Kebijakan privasi

1. Who we are

imgcanva (“we”, “us”) runs the image tools at imgcanva.com. We are the controller of the little personal data described below. You can reach us about anything in this policy at legal@imgcanva.com or through the contact form.

The short version: your images are processed on your device and are never uploaded to us. We set no cookies, run no analytics and show no ads.

2. Your images stay on your device

When you open an image in a tool, it is read, edited and saved by code running in your browser (WebAssembly, Web Workers and, for the AI tools, models downloaded from this site). The image is not sent to our servers. It lives in your browser's memory and is gone when you close or reload the tab.

3. The features that do reach our servers

A few features need a server. Each one receives only what it needs, and none of them keeps your images:

• HTML to image: the web address you type is sent to our server, which opens that page in a headless browser, takes the screenshot and returns it to you. Neither the address nor the screenshot is stored after the response.
• Send to phone: your browser encrypts the result with a key that exists only in the QR code and link, then uploads the encrypted file (up to 100 MB). We cannot read it. It is deleted after one hour, or straight away when you press Delete now. Anyone who has the link can download it during that hour, so share it only with yourself or people you trust.
• Meme generator: the list of meme templates is fetched by our server from Imgflip. The template pictures then load directly from Imgflip's servers (i.imgflip.com), so Imgflip receives your IP address and the usual browser request details, under its own privacy policy. Your captions and edits stay on your device.
• Contact form: we receive the name, email address, subject, reason and message you enter, and use them only to answer you.

4. Technical data

Like any website, our hosting provider records standard request data when you visit: IP address, browser and device type, the page requested, the time and the response. We use it only to keep the site running and secure, for example to investigate errors and abuse.

To stop abuse of the server features, we count requests per IP address in memory for up to ten minutes. These counts are not written to disk or linked to anything else.

5. Donations

If you choose to donate, the payment is handled by the provider you pick: Polar (which acts as the seller of record and processes your card details under its own privacy policy) or bKash. We never see your full card or account details. We may receive your name, email address and the amount, which we keep for our accounting records as the law requires.

6. What we do not do

• We do not set cookies or use any tracking technology (see the cookies policy).
• We do not run analytics, advertising or social media scripts.
• We do not sell, rent or share personal data for marketing.
• We do not use your images to train AI models; we never receive them.

7. Why we may process data (legal bases)

Where data protection laws such as the GDPR apply, we rely on: performing the service you ask for (HTML to image, Send to phone, answering your message); our legitimate interest in keeping the site secure and working (technical data and rate limits); and our legal obligations (donation records).

8. How long we keep it

• Images: never received, so never kept.
• HTML to image addresses and screenshots: only for the duration of the request.
• Send to phone files: up to one hour, encrypted.
• Rate-limit counts: up to ten minutes, in memory.
• Hosting request logs: as long as the hosting provider keeps them, normally no more than 30 days.
• Contact messages: until your question is answered, and no more than twelve months after that.
• Donation records: as long as tax and accounting law requires.

9. Where data is processed

Our servers and service providers may be located outside your country. Where the law requires it, we rely on appropriate safeguards for those transfers.

10. Your rights

Depending on where you live, you may have the right to access, correct or delete personal data we hold about you, to object to or restrict its use, and to receive a copy of it. Because we hold so little, most requests are simple: write to legal@imgcanva.com and we will answer within thirty days. You also have the right to complain to your local data protection authority.

11. Children

imgcanva is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

12. Changes to this policy

We may change this privacy policy at any time, for example when we add or change a feature, when the law changes, or to make the text clearer. The updated policy applies from the date shown at the top of this page.

If a change is significant, for example a new feature that sends data to a server, we will say so on the site before it takes effect. Please check this page from time to time. If you keep using the service after a change takes effect, the updated policy applies to you.