What happens to a picture you open here
Nothing is sent anywhere to be cut out: the picture is read off your disk, the matting is solved in this tab, and it is gone the moment you close it.
The short version
There is no server behind this site that could receive a photograph. The pages are static files on a content network; the cutting is code that runs inside your own browser. When you pick a file, the browser hands its bytes to the page, the page works on them in memory, and closing the tab ends it. No copy is written to disk, to a database or to anywhere else, because there is nowhere for one to go.
You don’t have to take that on faith; it is something you can verify yourself. Open your browser’s network panel, cut a picture out, and watch: no request carries your image anywhere. That is a better guarantee than a sentence in a policy, and it is the reason this page invites you to look.
What the page does load
Fonts, code and the page itself
Everything needed to draw and run this page is served from this domain. Two typefaces are included in those files rather than fetched from a font service, so opening this page does not announce you to one.
A decoder, only when a file needs it
Photographs from recent iPhones are stored in a format browsers cannot read. When one of those arrives, a small decoder is downloaded so the file can be opened. The download goes one way — a decoder comes in, nothing about your picture goes out — and it only happens on the first such file.
A segmentation model — wired for, not shipped
As this site stands, nothing of the kind is downloaded: no weights address is set in the deployment, the segmentation option on step 2 is shown disabled with that reason printed beside it, and every cutout you make here comes from the region solve that shipped inside the page. The page says so above the drop zone as well, because it changes what the tool is good at.
The wiring for one exists for the day it is filled in. The weights would be a file at an address set when the site is deployed, fetched only if you picked that option on step 2 and then kept in your own browser cache. That traffic travels inward — a file comes to you, and nothing about your picture goes the other way.
Measurement
Right now, none. No measurement script is served with these pages and no visit of yours is recorded anywhere — the analytics property has never been filled in, so the beacon is left out of the HTML rather than shipped as a request that collects nothing. You can confirm that in the same network panel described above.
The plan, when it is switched on, is Cloudflare Web Analytics: no cookie, no profile, and a property belonging to this domain alone rather than an account shared across other sites. It would record that a page was viewed, roughly from where, and how quickly it drew. Even then it could not observe what you opened, what you did on the canvas or what you saved, because none of that leaves the page to begin with — and if it is ever turned on, this paragraph is rewritten in the same commit.
Advertising
This site is built to be paid for by Google advertising, and you should expect to see it here in time. You are not seeing it today: the domain has not been through AdSense review, the switch that draws a unit is off, and no advertising code loads on any page as you read this. The placements are already settled for when it is turned on — underneath the working surface and inside the reading material, never above the tool or inside it.
Once units do run they are served by Google and subject to Google’s own use of cookies and identifiers, which you can inspect and change at Google’s ad settings; a content blocker stops them without breaking anything the tool does.
What an advertiser could learn either way is that someone loaded a page on this domain. It could not learn anything about your photograph, because the advertising code and the cutting code never meet: the picture exists as pixels in a canvas the ad script has no access to and no reason to look for, and there is no request anywhere in this site that would carry it.
Children, contact and changes
This site is not aimed at children and collects nothing that would identify anyone of any age. There is no account, no sign-in, no email field and no form of any kind.
If this policy changes, it changes here, and the change will be a description of something the site started or stopped doing rather than a re-wording. Nothing in the first section is expected to change, because it follows from the site having no server rather than from a promise we made.