Your photos never reach us. Here is what does.

The cutout is computed in your browser, on the home page and in the editor. The photo, the result, your projects and the downloaded models stay in your browser’s own storage and are never uploaded to CRABOY or anyone else. We cannot see them, and we keep no copies.

The models are downloaded once from CRABOY’s model host, models.craboy.com, which runs on Cloudflare (its storage and its edge network). They arrive encrypted and are opened only inside your browser, with a short-lived key the app gives your browser for that download. Like any web server, the model host receives your IP address and browser type with each download; the key names the downloader only by a keyed one-way code (of the account, or, on the home page, of your network), never by name or email. Fallback models come from Hugging Face instead: on the home page when the browser has no graphics card, and in the editor when the device cannot run CRABOY’s own models. Each is pinned to a published version and checked before use, and Hugging Face receives the same kind of request. Nothing about your photo travels with any download.

craboy.com uses no analytics, no advertising and no tracking cookies. The pricing section reads the published prices from app.craboy.com. The header asks app.craboy.com whether you are signed in there (your browser sends its sign-in cookie with that one request) and, if you are, shows your first name and initial in place of “Sign in”; nothing about the visit is recorded. The contact form sends what you type to app.craboy.com (07 below). Like any web host, ours keeps standard server logs (IP address, browser type, the page requested and the time) for security and operations.

Every cookie and stored item is needed for what you asked for, or keeps a choice you made, so there is no consent banner. None is used for advertising or tracking, and none is shared.

Cookies on app.craboy.com, all secure and limited to that site unless noted:

• __Host-craboy-session: keeps you signed in (HTTP-only), for up to 30 days, ended earlier by signing out or after 7 days without a visit;
• __Host-craboy-staff: a Team member’s passkey session, for up to 8 hours (HTTP-only);
• __Host-craboy-flow: the sign-in round trip to the sign-in provider, for 10 minutes (HTTP-only);
• __Host-craboy-promo: a promotion link’s code, kept through sign-up for up to 7 days (HTTP-only);
• craboy-theme: your theme (light, dark or system), shared by craboy.com and app.craboy.com so both look the same, for a year;
• sidebar_state: whether the account pages’ sidebar is open, for 7 days.

Stored in your browser, never sent to us:

• on craboy.com: your first name and initial while you are signed in, removed after you sign out and in any case within 7 days; the count of the day’s three demo cutouts (local storage and an IndexedDB database named craboy), for that day;
• in the editor: your projects, images and results (IndexedDB), until you delete them; interface choices such as the open tab, sound on or off and the last backdrop family; which account’s projects to open; an unfinished checkout, for a day; a one-time reload after an update;
• on both: the downloaded models and the files that run them, in the browser’s cache, until the browser clears them (for the home page’s demo, about 230 MB with a graphics card and about 190 MB without one; the page asks the browser to keep them, and the browser decides).

The sign-in provider (Auth0) and the payment provider (Whop) set their own cookies on their own pages when you sign in or pay; their notices cover them.

You need an account only to buy credits or a subscription. It holds your account number, your verified email address, the name you choose, an optional picture, and the sign-in methods you use (Google, an email code, a password or a passkey). Auth0 keeps the credentials themselves; Google keeps your Google account.

Each session records the browser and the kind of computer or phone it signed in from (for example “Chrome on Mac”), so you can recognize it under Security → Sessions. Each browser that processes for your account makes its own key: the account holds the public half, and the private key never leaves that browser.

Your account processes on up to two computers, and every browser on one computer counts once. To tell computers apart, when a browser registers to process, the editor compares a few coarse traits of its computer: the type of operating system, the time zone, the screen’s shape (the ratio of its sides, never its size), the graphics chip model where the browser reports one, and a keyed one-way code of your internet address’s network prefix (never the address itself). These are used only to count computers against that allowance and to list them for you under Account, and are deleted with the account. Redeeming a promotion keeps the same kind of one-way codes (of the network, the computer and the email address, never the values) so that one person cannot claim it many times.

We record which version of the Terms you accepted and when, at sign-in and at each purchase, and, at each purchase, that you asked for it to start at once (see section 07 of the Terms).

Whop takes the payment and the tax on it. CRABOY never sees your card details; it records the order, the amount, the tax, the receipt number, the subscription period and any refund, in US dollars, for your billing page and for accounting.

If you add billing details under Billing (a company name, a tax ID, an address and a country), CRABOY prints them on the receipts of the purchases you make afterwards. They are optional and used for nothing else. Each receipt keeps a copy of the details it was issued with, so changing or removing them never alters a receipt you already have.

Credits are kept as a ledger: each grant, each processed image and each return, so your balance can be shown and checked.

CRABOY sends account emails only, from mail.craboy.com through a transactional email provider: security notices (a sign-in method added or removed, a password reset, a changed email address), the confirmation of each purchase with its receipt number, a reminder before certain renewals, and a note that support has replied to you (never the reply itself). Sign-in codes and address checks come from the sign-in provider. No marketing email, no tracking pixels, no remote images. The provider reports whether each email was delivered, bounced or marked as spam, so we stop sending to an address that does not take our email.

When you write to us from Account → Support, the request keeps its topic, its subject and your messages, the purchase you pick if it is about one, and, unless you switch it off, the name of your browser and system (for example “Chrome on Mac”). Your account goes with it, so the team knows whose it is and which plan it has. We use all of it only to answer you: the support team members who look after your account read it, and their replies reach you as CRABOY support.

The contact form at craboy.com/contact needs no account. It keeps the topic you choose, your message, the email address you give for the reply and the name, if you give one, and reaches the same team. It also keeps a keyed one-way code of your internet address’s network prefix (never the address itself), so that no one network can fill the form for everyone. We use them only to answer you and never publish the address; the team replies from its own email.

These services process personal data on CRABOY’s behalf, each only for its part, under its own data processing terms:

• Whop: checkout, payments, tax, refunds and the payment methods you save;
• Auth0 (by Okta): sign-in, your credentials, sign-in codes and address checks;
• Supabase: the database that holds your account, orders, credits and support requests;
• Cloudflare: the network in front of our sites, security filtering, and the model host and its storage;
• a transactional email provider: sending the account emails above and reporting their delivery;
• our web hosting provider: running craboy.com and app.craboy.com, with its server logs.

Google, when you sign in with it, and Hugging Face, for the fallback models, receive your request as independent services under their own notices. Some of these services process data outside your country, including outside the European Economic Area and the United Kingdom; where the law requires it, the transfer is covered by the provider’s contractual safeguards, such as the standard contractual clauses. We do not sell or share personal information, for money or otherwise, and we use none for advertising.

• To provide what you signed up for and bought (the contract): your account, sign-in, credits and plans, payments, receipts, computers, purchase confirmations and support.
• To keep the service and your account secure and stop abuse (our legitimate interest): sessions, security notices, rate limits, the one-way codes above, server logs and the record of account actions.
• To meet legal duties: accounting and tax records, the record of your acceptance of the Terms and of the withdrawal waiver, and answering requests about your rights.

We ask for no consent beyond what the Terms say, because we do nothing that needs it: no marketing, no analytics, no profiling.

• Your account and profile: while the account is open. Closing it revokes processing access, cancels every subscription, deletes your saved billing details, the computers’ traits and the text of your support requests, removes your name, email address and picture from the account, and deletes your sign-in identities, here and at Auth0.
• Ended or revoked sessions: 90 days (the most recent one is kept for “last seen” while the account is open).
• The text of each email we sent: 30 days; the record that a notice was sent, and its delivery reports: 400 days.
• Closed contact-form requests and their messages: 365 days after they are closed.
• Processed payment notifications from the payment provider: 90 days (the payments themselves are kept as below).
• Orders, payments, receipts, refunds, the credit ledger and the acceptances of the Terms and the waiver: as long as accounting and tax law require, then deleted.
• The record of account and Team actions, processing runs and other operations: kept to secure the service and answer disputes, for a period we will state here once it is fixed.

You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form; where we rely on your consent you can withdraw it at any time. Many of these you can do yourself: from your profile you can download everything CRABOY holds about your account as a JSON file, change your name, picture and email, add or remove sign-in methods, cancel a subscription at renewal, and close the account. For anything else, write to us (14 below); we answer within a month. Some records cannot be deleted while the law requires us to keep them (10 above). You may also complain to the data protection authority where you live. Residents of California and other US states: we do not sell or share personal information, and you can make the same requests in the same way.

CRABOY is not meant for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us theirs, write to us and we will delete it.

When this notice changes, the date at the top changes with it.

Privacy requests and questions about this notice: write to us from Account → Support (app.craboy.com/profile/support), or, without an account, through the contact form (craboy.com/contact).