What happens to a picture you open here
Nothing is sent anywhere to be cut out: the picture is read off your disk, the matting is solved in this tab, and it is gone the moment you close it.
The short version
There is no server behind this site that could receive a photograph. The pages are static files on a content network; the cutting is code that runs inside your own browser. When you pick a file, the browser hands its bytes to the page, the page works on them in memory, and closing the tab ends it. No copy is written to disk, to a database or to anywhere else, because there is nowhere for one to go.
Two qualifications, both written out below. If you ask for a segmentation model on the Cut panel, the page fetches that model file from our model file server, which is another host. That traffic runs inward only: a model comes to you, and your photograph does not go the other way, because there is no request on this site capable of carrying it. And on this site’s live address the page loads a cookieless visit counter, Cloudflare Web Analytics, which is described in full under Measurement.
You don’t have to take that on faith; it is something you can verify yourself. Open your browser’s network panel, cut a picture out, and watch. You will see the page’s own files from this domain, the HEIC decoder from this domain the first time you open an iPhone photo, and the analytics beacon. Cutting with the guided selection, the colour key or the ink path adds no request at all. Pressing a model adds at most two the first time — a .onnx file from our model file server and the runtime’s .wasm from this domain, both coming to your machine — and none on later visits. Nothing that leaves carries an image. That is a better guarantee than a sentence in a policy, and it is the reason this page invites you to look.
What the page does load
Fonts, code and the page itself
Everything needed to draw and run this page is served from this domain. Two typefaces are included in those files rather than fetched from a font service, so opening this page does not announce you to one.
A decoder, only when a file needs it
Photographs from recent iPhones are stored in a format browsers cannot read. When one of those arrives, a small decoder is downloaded so the file can be opened. The download goes one way — a decoder comes in, nothing about your picture goes out — and it only happens on the first such file.
A segmentation model, from our model file server, if you ask for it
This only happens after you press the control that says it will. The Cut panel offers three networks and prints the exact length of each file before anything moves: the person cutout at 6,163,938 bytes, a hair-detail matte at 25,888,640 bytes, and a studio cutout at 88,117,930 bytes which also states the roughly 17 seconds it is estimated to take without a graphics path. Until one of those is pressed no model is fetched, and the cutouts you get come from the methods that shipped inside the page.
The file comes from our model file server rather than a public model hub — a request to somebody else’s hosting would tell them that a visitor here is cutting out a photograph, and there is no reason to hand that over. The request carries no cookie and no credentials, and what it can reveal is what any file request reveals: an address asked for a file, from your connection, at a time. It cannot reveal which photograph you opened, because the photograph is not part of it.
What arrives is kept in this browser’s cache so a second visit costs nothing, and its length and its SHA-256 fingerprint are checked against the figures this site ships with before it is used or stored — a file that arrives the wrong size or with the wrong contents is refused rather than kept. The runtime that executes the model, about 13.3 MB of WebAssembly (or 15.3 MB for the build that uses your graphics card, where the browser supports it), is served from this domain and not from anybody else’s, and is kept in the same cache — so once both are here, the model runs with the network switched off. The Cut panel also carries a control that deletes the models and the runtime from this browser again.
Measurement
Visits to this site are counted with Cloudflare Web Analytics, a property that belongs to this site alone. It sets no cookie and stores nothing in your browser, so there is no banner to dismiss, and it does not build a profile of you across other sites.
The counter is a small script, beacon.min.js, loaded from static.cloudflareinsights.com after the page has finished loading — and only when the page is served from this site’s live address. A preview copy, a local copy or a page saved to disk does not load it. It sees what any page view reveals: the address of the page, the page that linked here, the browser and operating system, a country-level location derived from the connection, and how quickly the page loaded.
It cannot see your picture, the cutout, the file name or anything you did on the canvas, because none of that leaves the page. No custom events are sent; if that ever changes, this paragraph changes in the same commit, and nothing derived from a picture — not even its dimensions — would be among them.
Advertising
This site shows no advertising. No advertising code loads on any page.
Children, contact and changes
This site is not aimed at children and collects nothing that would identify anyone of any age. There is no account and no sign-in.
The one form is on the contact page. It sends what you type there — your name, your email address and your message — together with the name of this site, to a Google Form, and only at the moment you press its send button. Opening that page fetches nothing from Google, and no other page here talks to Google at all. The form has no way to carry a picture.
If this policy changes, it changes here, and the change will be a description of something the site started or stopped doing rather than a re-wording. Nothing in the first section is expected to change, because it follows from the site having no server rather than from a promise we made.