This policy covers backgroundremoverpng.com (and removebackgroundpng.com, which redirects to it). It was last updated on October 26, 2026.
Your images
Free photo cutouts are processed online by default. In the main editor, the background removal tool pages and the batch studio, the page sends our server a reduced copy of the decoded picture: a JPEG at most 1280 pixels on its long side, without the original file name or camera/location metadata. Our server passes it to Cloudflare Images background removal (a BiRefNet model run by Cloudflare) and returns only the resulting transparency mask to your browser, which applies it to your full-size original. We store neither the copy nor the mask. Cloudflare processes the copy as our hosting provider under its privacy policy and may cache processing results briefly. Our server logs record each request's outcome, timing and reduced pixel size for a few days, without images or addresses.
To limit free online use, our database keeps counters: daily and monthly totals, and a per-visitor daily count identified by a protected hash of the date and your connection address. The counters contain no image, image checksum or address; per-visitor counts are deleted about an hour after their day ends (UTC). A short-term rate limit at Cloudflare uses the same protected value. These counters are separate from page analytics.
If online processing is busy or unavailable, or you reach the daily free online limit, the page finishes the cutout on your device without uploading the photo. The model and software files it downloads may be cached; this cache contains no photos. Clear this site’s browser data to remove it. Choosing a free Preview download never uploads anything.
Generated scenes are sent only when you ask for one. When you choose a scene under Background, or describe one, the page sends our server a softened copy of your cutout as it sits in the frame, on plain gray and at most 2048 pixels on its long side, together with a copy that shows only its outline in one color, and the scene you picked or the words you typed. Our server passes the softened copy and the scene to Cloudflare Workers AI, which draws a new photo around the subject with FLUX.2 [klein], a Black Forest Labs model run by Cloudflare; if that model's filter refuses the softened copy, our server tries once more with the outline copy instead. The new picture comes back to your browser, which places your original cutout over it. We store neither the copies, the scene description nor the picture, and Cloudflare does not use them to train models. Our server logs record each request's outcome, timing, picture size and chosen preset for a few days, without images, descriptions or addresses. Counters limit free scenes in the same way as free cutouts above, under separate daily and monthly totals.
If you paste or drop an image's web address instead of a file, your browser sends us that https address and our server downloads the image from its website (with a fixed user agent that names this site), then passes it back to your browser, where it opens like a chosen file. We do not store the address or the image; a per-visitor hourly count, identified by a protected hash of the date and your connection address, limits how many links can be opened. An image search result link is read in your browser, and only the picture's own address is sent. A picture pasted as embedded image data rather than a web address opens in your browser without this download.
Max is an explicit paid action. Choosing an eligible Max output uploads a copy of the decoded picture through Cloudflare to Modal, where our high-resolution model re-cuts it. The editor removes the original filename and camera/location metadata first. Processing returns a mask describing which pixels to keep. Source pixels, replacement backgrounds, brush corrections and final composition stay in the browser. We do not use your images to train models or publish them.
The input copy is deleted after processing completes. Result masks are available for up to 24 hours from job creation, then access expires. Cancellation deletes active input/results where possible. A one-day storage lifecycle and scheduled cleanup also remove abandoned files; deletion may take longer during an outage. These temporary objects are in private storage, accessible only through the job's protected access credentials. They are not a photo library or an account backup. Save the files you want to keep before closing the tab.
Cloud processing records contain a random job id, protected access-token value, image checksum, byte size, dimensions, model version, processing state and timing. A daily protected hash of the connection address supports rate and capacity limits. These records are kept for up to 61 days and are separate from page analytics. A random-id-only record prevents reuse of an old job identity. Credit reservation, completion and return records link that ID to the owning account and allowance; they contain no image, checksum or connection address and remain with billing history. The processing providers receive the data necessary to run this service; see Cloudflare's privacy policy and Modal's privacy policy.
Conversion, resizing, compression, passport print preparation, logo cleanup, signatures and circle cropping run locally. Background removal opened from a converter also stays local. The GIF tools, the PNG and WebP to SVG converters, the favicon generator, the pixelate tool, the image cropper, the color picker, the PDF makers, the PDF to JPG converter and the video background remover run locally too: video frames are read and cut out on your device, and the video is never uploaded. A local retry does not undo an upload previously requested. The project container and replacement background photos are never uploaded.
The passport print tool keeps your photo and manual framing in the open tab only. Its JPG/PDF downloads omit source camera and location metadata; your original remains on your device. It does not upload, save a profile, analyze a face or check compliance.
If you choose Copy PNG, the browser writes your edited image to your device’s clipboard after any required permission. This action does not read other clipboard contents or upload the image. You choose where to paste it.
A custom download file name stays in the current editor view and is used only to name your saved file. It is cleared when you open a new image and is not sent to analytics or stored by the site.
Buying credits from the editor keeps your image in this browser. When you choose Buy, Get credits, All plans or Restore purchase in the editor, the page first saves a copy of the open image file, its cutout, brush corrections, background photo, settings and custom file name in this browser's storage (IndexedDB), plus a short return note in session storage. This copy never leaves your device. It lets the editor reopen your image when you come back from Stripe, the account or pricing page, or with the browser's Back button. It is deleted when the editor reopens it; an unused copy expires after one day and is removed the next time you open one of this site's tools. You can also remove it by clearing this site's browser data.
If Max already has a credit applied or a paid cutout ready, Restore purchase opens a separate tab instead. The original tab keeps that job's private access in memory so you can retry its download. We do not copy those access credentials into browser storage. Keep the original image tab open until you finish downloading.
In the batch studio, original files, background photos and brush edits stay in the tab. Free items are processed one at a time as described above; Max temporarily uploads the sanitized source copy described above. Unsaved work disappears when you close or reload it. Save project downloads a file containing your original photos (including their original metadata), file names, cutout masks, saved brush/color-removal corrections, export settings and selected background photo. Open project reads it on your device. For cloud jobs the file also contains private job access credentials, allowing their existing masks to be retrieved within the 24-hour window. Anyone with that project can access its available previews; paid cloud masks require the owning account or an already-downloaded full mask. Download Max before saving to include that full mask for editing after expiry. Project files are not uploaded or automatically saved by this website; keep downloaded projects private and delete them from your device when no longer needed. A random export identifier lets the same account recognize a previously unlocked image when the project is reopened; it contains no image data. Starting unfinished cloud images from a project uploads sanitized image copies as usual. Pause keeps their cloud identity for resuming; Remove or Clear cancels unfinished jobs where possible. If you choose to save an export recipe, its name and settings (format, background colors or photo positioning, shadows, framing, padding and width) are stored in this browser's local storage. Saved recipes contain no images or file names and are not sent to us. A photo recipe needs a new local file after reload. You can delete recipes in the studio or clear this site's browser data. If browser storage is unavailable, a recipe lasts only for the current tab.
The API
If you use the remove.bg-compatible API, your server sends us each image, or an https address that our server downloads it from with a fixed user agent. Cloudflare Images processes the image on Cloudflare's network to separate the subject, and the result goes back in the same response. We do not store API images, their URLs or the results, and we do not use them to train models or publish them.
To run the API we keep: for each API key, its name, last four characters, a hash of the key (never the key itself) and when it was created, last used and revoked; per account and calendar month, the number of free previews used and any prepaid previews; per key, request counts for rate limiting, deleted within about an hour; and for 24 hours, a keyed fingerprint made from your account and the image's bytes, so that sending the same image again is not charged twice. The fingerprint cannot be matched to an image without our server secret and is deleted after 24 hours. Credits spent through the API appear in your credit history like other credit use.
The API also records anonymous counts in Cloudflare Workers Analytics Engine: the requested size, output format, whether the image came as a file, base64 or URL, the channels option, the result or error code, how the call was paid, credits charged, processing time, output megapixels and the country of the request. These counts contain no key, account, image, file name or URL.
What the site records
We do not use advertising identifiers or fingerprinting.
When a page is requested, our server records a count with: the page address, the domain of the website that linked to it (if your browser shares one), a broad source category taken from that domain or the link's campaign source tag (a named search engine or AI assistant, this site, another site or none), the country (worked out by our hosting provider from your connection; the IP address itself is not stored in these counts), whether the device is a phone, tablet or computer, and whether the request looks like it came from an automated program.
When you use the tool, the page sends a few anonymous events: that an image was opened (with the preset and the approximate size in megapixels), whether processing used free online processing, the paid server or a local graphics chip/processor and how long it took, which result the black background tool chose for the picture (a photo, a glow or a picture on another background), a fixed reason (such as busy or daily limit) when free online processing gave way to your device, which format and pixel size you downloaded, and the type of any error. The image converter sends the same kind of counts: how many files you added, the input and output format of each, its approximate size in megapixels, and whether you downloaded one file or a ZIP. The GIF and video tools send the same kind of counts: the number of frames, their approximate size, how long a video took to process and whether it used a graphics chip or the processor, and which format you downloaded. These events never include the image, its checksum, job access credentials, the file name or anything typed into the page.
These counts are kept in Cloudflare Workers Analytics Engine, which retains them for about three months. We use them to see which pages and features are used and to find problems.
The batch studio sends the number of files added, model processing time and backend, counts of recipe saves and cutout edits, download format and file count, project save requests and successful opens (with a file count), and the stage of a processing failure. It never sends recipe names, selected colors, source photos, brush data or file names.
We also use Google Analytics 4 for page visits and counts when an image is processed or a download is requested. Its script is served through this website and may set first-party _ga cookies to recognize repeat visits. Google receives the page path, page title, limited campaign tags, the referrer's origin, those event names, and ordinary browser and connection information, including your IP address and the approximate location our hosting provider works out from it (country, region, city and approximate coordinates). Our server passes that location on because these requests reach Google through this website. We do not send image files or file names to Google Analytics, and these events carry no image size or format details beyond the page path. Other page query values are omitted. The property is configured to retain event-level data for 14 months; aggregate reports may remain available longer. We disable Google advertising features in the tag. Google describes its handling of data at Google's Privacy Policy.
We also collect anonymous reliability counts: whether the page script and tool controls started, broad error categories (including whether a failed resource belongs to a tool, analytics, this site or another service), and measurements of loading speed, responsiveness and layout movement. For the slowest response on a page, they also note how its delay divided between waiting, running and redrawing, whether it followed a tap, click or key press, and the broad kind of control involved (such as a button, link or file upload). In browsers that report it, they also note whose script ran longest during that response (this site's, a browser extension's or another site's), how it was started, and how the time divided between scripts, page layout and drawing, never the script's address or name. For page loading, they also note how the wait divided between connecting, the server's reply and fetching and drawing the largest image or text, whether that was text or an image, when the largest layout movement happened, and whether the page was opened fresh, reloaded, returned to or loaded in advance. These include the public page path, device class and the version of our browser software. They contain no error messages, stack traces, resource addresses, files, typed text or visitor identifiers. These diagnostics go to Cloudflare Analytics Engine, not Google Analytics, and use the same retention period as the other anonymous counts.
If video background removal fails, those reliability counts also record a fixed processing step: reading a frame, capturing its picture, removing the background or assembling the result. A failed frame read distinguishes a timeout, an unreadable frame and an unknown cause. They include no video, file name, frame position or exception text.
We do not load Google Analytics for visitors in the EEA, UK, Switzerland or Quebec, or when the browser sends a Global Privacy Control signal. Our Cloudflare counts still run in those cases.
Accounts and payments
Public pricing and tool offers, including the batch studio, send anonymous purchase-step counts to Cloudflare Analytics Engine: an offer becoming visible, opening plans, choosing a pack or subscription, checkout becoming ready or failing, and returning from checkout or confirming payment. These use fixed step, location and failure categories, along with the public page path, country, device class and software version. They contain no visitor identifier, account information, plan code, amount, payment reference, file data or URL parameters. Account pages remain untracked; neither account nor pricing pages send page counts or load Google Analytics.
You can buy credits without signing in first. A necessary, secure browser cookie gives you access to that purchase for up to 30 days. We receive the email used at Stripe checkout so you can restore purchases on another device with a one-time email code. Entering an email at checkout does not grant access to its existing purchases. Verifying that email combines its purchased credits and signs out older checkout-only sessions. This does not move your files between devices. A checkout reference may be kept temporarily in session storage while payment confirmation is retried.
Accounts are optional for editing and free Preview downloads. Buy credits to use Max exports above 0.25 megapixels; no signup is required before checkout. Conversion, resizing, compression and circle cropping stay free without an account.
If you create an account, we store your email address, payment-provider customer reference, purchases, subscription status and credit activity. Credit activity uses a random identifier for each open image; it contains no photo, file name, image hash, cutout or brush data. Signing in on another device restores your credit balance, not your photos.
Sign-in uses a code sent through Cloudflare Email Sending. Codes expire after ten minutes and allow at most five attempts. We store protected code values and hashed session tokens. Necessary, secure cookies keep the sign-in challenge for ten minutes and your session for up to 30 days. You can sign out on this device or all devices from your account. We use protected hashes of connection addresses and email addresses to limit sign-in abuse; these short-lived counters are separate from page analytics.
Stripe hosts checkout and subscription management and receives the information you enter there. We do not receive or store complete card numbers. Our billing records contain provider references, allowances, amounts, currency and payment events needed to supply credits, handle refunds and resolve purchase problems. Account and pricing pages do not load Google Analytics, and account emails and payment references are not sent to our anonymous usage counts. See Stripe's privacy policy.
Expired sign-in challenges, sessions and rate-limit counters are deleted regularly. Account and purchase records remain for account access, support and applicable record-keeping requirements. Contact help@backgroundremoverpng.com to request access to or deletion of your account data.
Hosting and security logs
The site runs on Cloudflare, which processes every request (including your IP address) to deliver the site and protect it from abuse. Cloudflare's handling of that data is described in its own privacy policy at cloudflare.com/privacypolicy.
If you email us, we use your address and message only to reply, and we do not add you to any list.
Children
The site is a general-purpose tool and is not directed at children under 13.
Links to stores and services
When a page links to another company's product, the link goes through an address that begins with /go/. When you follow one, our server redirects you to that site and counts the click, the same way as a page view: which link, the page it was on and roughly how long after the page opened, but no identifier for you. Once we join a company's affiliate program, the redirect adds that program's referral code, so the company can credit a purchase or sign-up to us; its own privacy policy then applies.
Changes
If what the site records changes, this page and its updated date will change.
Contact
Questions about privacy: hello@backgroundremoverpng.com.