Privacy policy

Information we collect

Account information includes your email address, account identifier and sign-in details. If you choose Google sign-in, we receive the profile information needed to create and authenticate your account, such as your name, email address and profile image. Google sign-in does not give us access to your emails.

When you edit a photo, we process the image you upload, your instructions, selected template, generated image and the request status. We also store favorites and information needed to keep your creations available in your account.

Billing information includes your subscription, image allowance, renewal dates and payment references. Stripe handles checkout and payment-card information. We do not store your full card number. If you contact support, we receive your email address and the information you include in your message.

Technical information can include your IP address, browser and device details, request times, sign-in events and error records needed to operate and protect the service.

How we use your information

• Sign you in and maintain your account.
• Process the photo edits you request, save the results and make them available to download.
• Manage subscriptions, payments and image allowances.
• Deliver sign-in codes and service messages, and respond to support requests.
• Investigate errors, prevent fraud and abuse, and meet legal obligations.

Where a legal basis is required, we rely on performing our agreement with you for account, editing and subscription services; legitimate interests for proportionate security and fraud prevention; and legal obligations for required records. Where processing requires consent, we ask for it, and you can withdraw it.

Your photos and AI editing

Your selected photo and instructions are sent to service providers that process the requested AI edit. Results are returned and stored with your account. These providers need access to the content you submit to perform that task.

Only upload photos you have the right to use, including any permissions needed from people shown in them. We do not use your photos for advertising, publish them as examples without permission or use them to build our own training dataset. We do not provide biometric identity verification or use photos to identify people.

Who receives information

We use providers for hosting, secure storage, authentication, transactional email, payment processing and AI editing. They receive information needed for their role. Google processes sign-in when you choose it, and Stripe processes payments and billing. Some providers also process information for their own security, fraud prevention or legal obligations.

We may disclose information when legally required, to respond to a valid legal request or to protect users and the service. We do not sell your personal information. If ownership of the service changes, relevant information may transfer subject to the protections and notices required by law.

Storage and retention

We retain account information and saved photos while needed to provide your account and editing history. You can request deletion of your photos or account by emailing contact@tooextra.app. Download any images you want to keep before requesting deletion.

Some information may remain for legal, accounting, security or dispute-resolution purposes, and backups may take additional time to expire. Service providers may retain processing and security records under their own retention policies. Canceling a subscription stops future renewal; it does not by itself request account deletion.

Cookies and device storage

We use cookies and browser storage to keep you signed in, protect authentication, remember your appearance preference and retain editing drafts or saved selections. Some local drafts remain on your device until replaced, cleared or removed through your browser settings.

We do not currently use advertising pixels or optional analytics cookies. If we add tools that require consent, we will ask before enabling them. You can clear cookies in your browser, although signing in and some preferences may stop working.

International processing and security

Providers may process information outside your country. Where data-protection law requires safeguards for an international transfer, we use the applicable contractual or other recognized safeguards. Contact us for information about the safeguards relevant to your data.

We use access controls, encrypted connections and other measures appropriate to the information processed. No online service can guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your information; restrict or object to certain processing; or withdraw consent. Email contact@tooextra.app from your account address. We may need to verify your identity and will respond within the period required by applicable law.

You can also complain to your local data-protection authority. Withdrawing consent does not affect processing already lawfully carried out. The service is intended for adults aged 18 and over. Contact us if you believe a child has provided personal information.

Updates and contact

We update this page when our practices change and provide additional notice where required. The date above shows the latest revision. Contact us at contact@tooextra.app. For billing and cancellation, see our terms and refund policy.