Privacy
The full field-by-field detail lives in the project's docs/nullimage/privacy-model.md. This is the plain-language version.
The short version
We don't want your data, and the system is built so that we mostly can't have it even if we wanted to. There are no accounts. We don't know who you are.
What we collect
| Encrypted image bytes | The point of the service. We cannot read them. |
|---|---|
| Encrypted filename/type | So your browser can show the right filename and icon. We cannot read them either. |
| A one-way hash of your IP address | To rate-limit abuse. We cannot reverse it back into your real IP. |
| Timestamps (created, expires, last accessed — rounded to the hour) | To run expiry and to know the service is healthy. |
| A password hash, if you set one | To gate access. We cannot recover your original password from it. |
| Aggregate daily counts | Basic operational visibility (e.g. "143 images created today"). Never tied to a specific image or person. |
What we never collect
- The image itself, in unencrypted form, ever.
- The encryption key, ever — it lives only in the link you're given, never on our servers.
- Your real filename, in unencrypted form.
- Your raw password, beyond the single moment it's hashed.
- Your raw IP address, in any stored or logged form.
- Any account information, because there are no accounts.
- Any third-party analytics or tracking. We run no trackers.
Cookies
None, for the core image-sharing product. An admin dashboard, used only by the operator, uses a session cookie for that login — it has nothing to do with viewing or sharing images.
What we tell you, and mean literally
- "Only someone with the complete link can view this image" — true, because of how the encryption is built, not because we promise to be careful.
- "We can't see the image" — true for content. We can see that an image exists at a given link and roughly how large it is; we cannot see what's in it.
- "If you lose the link, it's gone" — true. There's no recovery flow because there's no account and no server-held key to recover from.
Data retention
Images are deleted according to whatever expiry (or burn-after-view, or manual deletion) was chosen when the link was created. After deletion, the object storage bytes are removed and the database row is reduced to a content-less placeholder before being fully removed.
Your rights (GDPR, CCPA, and similar)
Laws like the GDPR give you a right to erasure — the ability to have your personal data deleted on request. NullImage doesn't have a request process for this, because it doesn't need one: there are no accounts, so nothing here is linked to your identity in the first place, and you already hold the ability to delete any image you created immediately and unilaterally, via its manage link, without asking us or proving who you are. That's a stronger position than a request-and-wait erasure flow, not a weaker one — but it means there's no support ticket to file if you lose that link; see "If you lose the link, it's gone," above.
Contact
[email protected] for anything privacy- or security-related.