Privacy Policy

Daily limits use an HMAC-derived network identifier. Daily counters reset at 00:00 UTC; expired counters are removed on the next guard operation. People sharing an IP address may share an allowance.

To limit abuse and generation costs, Cloudflare-hosted generation uses a transactional budget ledger with aggregate counters, short-lived concurrency leases and HMAC-derived client identifiers rather than stored raw IP addresses. Client-rate buckets expire after one minute and are removed on the next guard operation; aggregate budget counters persist. This ledger receives no image files, masks or prompts. Cloudflare may process network metadata under its own hosting terms.

After successful AI expansion, we keep only the latest original image, generated result and generation settings in IndexedDB in this browser, so you can recover them after a refresh. Recovery does not upload the images again, call the provider, or incur another generation charge. Records expire 24 hours after saving and are removed the next time the tool reads them; a closed browser cannot run scheduled deletion. Changing the image or choosing Start over removes the saved record. You can also clear this site's browser data. Storage may be unavailable, cleared or evicted, so download important results. This browser-local expiry is not a deletion promise about the provider's systems.

The Resize Image, Crop Image, and Expand Image Canvas tools process the selected image in your browser tab without uploading it for processing. Closing the tab clears their in-memory working data; files you download remain on your device.

For AI expansion, ExpandImage.org validates selected files and prepares the expansion canvas in your browser. When you choose Generate expansion, the original file, prepared image, mask, and settings are submitted to our server for validation. The prepared image and mask are then sent to the configured third-party AI image provider.

We do not intentionally log API keys, source image bytes, masks, prompts, or returned provider URLs. This first release does not create user accounts or a user image library.

We have not independently verified the third-party provider's retention and deletion periods. We do not claim a deletion window that has not been verified. Do not upload images you do not have permission to process, or images containing information you do not want sent to a third-party provider.

Static sample images shown before upload are bundled website assets and do not make a generation request.

We use Google Analytics 4 to measure page visits and traffic sources. We do not send uploaded images, filenames, generated results, prompts or generation settings to Google Analytics. Automatic enhanced-measurement events, Google signals and advertising personalization are disabled.