Privacy Policy

Last updated: 2026-10-24

This policy explains how Fondly (fondlyphotos.com), operated by ITOTI Jarosław Dąbrowski, Poland ("we"), handles personal data. We are the controller of the data described here.

Files and content you process

Your browser downsizes the photo you choose and sends it to our server, which passes it to our AI processing provider, Replicate, Inc. (USA), to restore it. Deep repair runs the FLUX.1 Kontext [pro] model of Black Forest Labs through Replicate. Replicate deletes the photo and the results within one hour, and we delete the uploaded photo as soon as the restoration finishes. We do not store, look at, sell or train AI on your photos. The restored photo is sent back only to your browser.

Faces in photos

Restoration detects faces in your photo only to sharpen them. We do not create, store or use face templates or any other biometric identifiers, and we never try to recognize who is in a photo. Any face measurements a model computes exist only while that restoration runs and are deleted with the photo, at the latest within one hour. This is our retention and destruction policy for biometric data: we keep none.

Photos of children

Family photos often show children. We treat them like every other photo: processed only to restore them and deleted within one hour. Fondly is meant for adults; please upload photos of children only if you are family or have a parent's or guardian's permission.

Fair-use limits and security

To keep the free plan available and stop automated abuse, we use Cloudflare Turnstile (a privacy-friendly human check) and count restorations per browser and per internet connection. For this we store a random browser ID kept in your browser and a one-way, daily-changing hash of your IP address. We never store the IP address itself. Usage records (date, options, processing cost) are deleted after 90 days.

Credits and Pro on our server

If you use credits, a gift code or Pro, your license key is sent with each restoration so our server can check your plan with our payment provider and record usage. We store only a one-way hash of the key together with your remaining credits.

Gift codes

So that the person you give a gift to can redeem it by typing the short code from the card, we keep each gift's short code and its key in our database (Cloudflare) only in encrypted form (AES-256-GCM). The encryption key exists only in our server configuration, not in the database, and we look codes up by a keyed hash. Gift codes and keys are never written to logs or analytics. The QR code on the card carries the key in a part of the link that your browser does not send to our server. We keep the encrypted record while the gift has unused restorations and delete it within 90 days after the last one is used.

Payments

Purchases are handled by our reseller and merchant of record, Polar Software Inc. (polar.sh). They collect your name, email, billing address and payment details and process them as an independent controller under their own privacy policy. We receive your email, the products you bought and your license key status. We never see full card numbers.

License key

If you activate Pro, your license key is stored in your browser's local storage and periodically sent to the payment provider to confirm the subscription is still active.

Analytics

We use privacy-friendly, cookie-free analytics that record aggregated page views only. We do not use advertising or tracking cookies.

To improve the interface we also count anonymous usage events: which color theme (light or dark) is shown, whether it was changed, and whether a tool or the checkout was used. These are stored only as daily totals, with no IP address, device identifier or any other information that could identify you.

If you choose a color theme, that choice is saved in your browser's local storage so the site remembers it. It never leaves your device.

Service providers and transfers

Cloudflare, Inc. hosts this website and provides the analytics above; like any host it processes technical data such as IP addresses to deliver the site and protect it from abuse. If you email us, your message is handled by our email provider. Some of these providers are in the United States; where the GDPR applies, transfers rely on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

Why we use data and for how long

We use data to provide the service you ask for, to process purchases and refunds (performance of a contract), to keep the service secure and free of abuse (our legitimate interests) and to meet tax and accounting duties (legal obligation). Emails to support are kept for up to 3 years after the last message, so we can handle refunds and any claims; purchase records are kept as long as tax law requires.

No selling, no children's data

We do not sell or share your personal information for advertising, and we do not use it for targeted advertising or profiling. Fondly is not directed to children under 13, and we do not knowingly collect personal data from them.

Your rights

Under the GDPR and US state privacy laws (e.g. CCPA) you may request access to, correction, deletion or a copy of personal data we hold, and object to its use. Contact support@fondlyphotos.com. You may also complain to your local data protection authority; in Poland this is the President of the Personal Data Protection Office (UODO).

Contact

ITOTI Jarosław Dąbrowski, Poland · support@fondlyphotos.com