Privacy notice.
Updated 12 October 2026. This notice describes the commercial service and its third-party processing. Local development and test payments are labelled as such.
Controller and contact
Imagefake Team operates Imagefake and controls account, usage and report data. Contact support@imagefake.com for access, correction, deletion, objections or privacy questions. Imagefake is an independently operated service.
Optional Google sign-in
Google provides your verified email, name and stable account identifier. We use these to provide your account and a server-side session. We do not store your Google access or refresh tokens. Sessions expire after 30 days; sign-out revokes the current session. A keyed, pseudonymous marker records whether a Google identity or its linked browser trial has used the one-time free check. It remains after account removal for the service’s lifetime to prevent repeated trial claims. It is not an anonymous hash. Old internal sign-in IDs are retained for 90 days to block requests that were already in flight when an account was removed.
Anonymous checks and browser storage
Starting a check creates an essential, HttpOnly browser cookie lasting up to one year. The server stores a keyed digest of its random credential, not the raw credential, to protect access to your private reports and enforce one successful free check shared across all tools. A localStorage counter caches the displayed usage; changing it does not grant credits. If you sign in with that cookie present, we link free-trial eligibility to your Google account without merging paid balances or granting other browsers access to your reports. Linked trial markers remain for the service lifetime to prevent repeated claims. Expired session credentials are removed by scheduled cleanup. Clearing all browser storage may lose access to anonymous reports; cookie-based limits cannot uniquely identify a person. Network rate limits and a global trial budget also apply.
Images and the detector
When you explicitly submit a check, the prepared image goes to IsItAI. We remove selected embedded metadata but do not remove identifying details visible in the image. IsItAI states that it may retain anonymized images to improve its models; we cannot promise no training or a 24-hour deletion deadline at IsItAI. Do not submit sensitive, intimate, children’s or confidential images. Only submit images you have the right to process.
Storage and deletion
Imagefake stores prepared images and results privately in Cloudflare R2/D1 for up to 24 hours. Expired and deleted reports are immediately inaccessible; scheduled cleanup removes stored objects, with retries after failures. You can delete a completed report sooner. Minimal usage, fraud-prevention and payment records are separate from image retention. We retain necessary transaction records for up to seven years after purchase, or longer where a legal requirement, unresolved dispute, active subscription or unredeemed permanent-credit balance requires the minimal supporting record. Permanent credits are not erased merely because a transaction record reaches seven years. Minimal free-check activity and unpaid expired orders are removed after 90 days; the one-time trial marker remains separately.
Payments
Stripe hosts checkout and handles card details; Imagefake does not receive full card numbers. We store order, payment-reference, billing-country, amount, refund and credit records to deliver purchases and reconcile payments. If you authorize automatic renewal, Stripe saves the payment method; Imagefake stores its Stripe identifiers, renewal consent version, subscription dates and renewal preference. Payment, renewal and cancellation confirmations are delivered in My checks and can be downloaded. Turning off renewal does not erase permanent credits. Checkout identifies the applicable seller and tax handling. We do not infer consent to marketing from a purchase.
Security and service providers
Cloudflare hosts the service and provides Turnstile anti-abuse checks. We use short-lived counters, pseudonymized IP-based limits, identity limits and payment checks to protect capacity. Google, Cloudflare, IsItAI and Stripe can process data outside your country. Applicable safeguards and provider arrangements must cover the regions in which the paid service is offered.
Analytics and cookies
An essential guest cookie is created when you start a check, and a separate account session cookie is created when you sign in. The cached free-use count in localStorage is essential usage state, separate from analytics consent. Turnstile is used for upload and checkout security. Optional GA4 and ShipSolo Plausible run only after opt-in on public production pages. Private checks, reports, accounts, checkout and API paths are excluded. No images, scores, names or payment identifiers are sent as analytics events. You can withdraw analytics consent using the site controls.
Legal bases and your choices
Account, image-check and purchase processing supports the service you request. Fraud prevention relies on legitimate interests; accounting records meet legal obligations; optional analytics relies on consent. You can request access, portability, correction, deletion or restriction and object where applicable. Account removal requires a recent sign-in and settlement of active checks, pending payments and unused credits; contact us for an erasure request if self-service is blocked. Statutory rights are not removed by this workflow. You may complain to the relevant data-protection authority, including the UK ICO.
Contact and support
Email you send to support@imagefake.com is routed through Cloudflare Email Routing to our support inbox. Email content follows mailbox retention and is not part of the 24-hour image cleanup. Avoid sending images or payment-card details by email unless specifically needed and requested.
Provider details: IsItAI privacy policy · IsItAI terms.
Imagefake is independently operated under the name Imagefake Team. Contact support@imagefake.com for support, billing or privacy questions.
Contact Imagefake