PRIVACY POLICY.
100% IN-BROWSER & LOCAL DISK EXECUTION. ZERO SERVER UPLOADS. ZERO AI TRAINING. COMPLETE DATA SOVEREIGNTY.
[1. ZERO CLOUD PROCESSING & ZERO SERVER UPLOADS]
PhotoNow Engine (accessible at https://photonow.vercel.app/) is architected upon a fundamental principle: Offline-First, Zero-Cloud Computing. When you or an autonomous AI agent convert photos, transcode videos, or extract audio tracks, your original media files and converted outputs never leave your local machine or browser runtime.
- No Cloud Storage: We do not operate Amazon S3 buckets, Cloudflare R2, Google Cloud Storage, or any remote file storage infrastructure.
- Local Browser Execution: Browser-based operations execute exclusively in memory via HTML5 Canvas 2D, MediaRecorder, and Web Audio APIs.
- Local MCP Agent Execution: Stdio MCP operations run locally on your filesystem using bundled static FFmpeg and Sharp binaries without remote API round-trips.
- Supported Formats: All conversions (WebP, AVIF, PNG, JPEG, WebM, MP4, MKV, MP3, WAV, AAC, FLAC) are generated strictly on client hardware.
[2. CLIENT-SIDE STORAGE SANDBOX (INDEXEDDB)]
For user convenience, the PhotoNow web workbench maintains local conversion history and binary Blobs using your browser's native sandboxed database (IndexedDB, database name: photoConvert_DB).
- All stored items exist solely within your specific browser profile and local storage partition.
- We have no technical ability to access, inspect, copy, or recover items stored in your local IndexedDB.
- You maintain total sovereignty: you can delete individual conversions or wipe the entire database instantly using the
[CLEAR STORAGE]button.
[3. EPHEMERAL TELEMETRY & MCP ENDPOINT SECURITY]
When you access the website or when an autonomous AI agent dispatches tool calls to our Model Context Protocol endpoint (/api/mcp):
- Ephemeral In-Memory Rate Limiting: To defend against volumetric DDoS attacks and crawler flooding, our server maintains an in-memory sliding window tracking IP addresses. This counter is stored in volatile RAM and is completely evicted every 60 seconds.
- Zero Media Payload Logging: Requests to
/api/mcpare never saved to disk, and file bytes or media parameters are never logged. - Infrastructure Telemetry: Our hosting provider (Vercel) may collect standard aggregate server logs (HTTP response code, user agent string, request timestamp, approximate country of origin) solely for system health and DDoS mitigation.
[4. NO AI TRAINING & MODEL ISOLATION]
Unlike cloud multimedia APIs that use uploaded user media to train artificial intelligence models:
- We NEVER use your photos, videos, audio recordings, or metadata to train machine learning models.
- We NEVER share, sell, or transmit your media data to OpenAI, Anthropic, Google, Meta, or any AI research lab.
- When AI agents connect via MCP, PhotoNow functions purely as an execution tool on the client side, maintaining end-to-end data confidentiality.
[5. ZERO TRACKING COOKIES & NO ADVERTISING]
PhotoNow respects developer and creator privacy:
- We do NOT set third-party marketing cookies, tracking beacons, or cross-site fingerprinting scripts.
- We do NOT sell, broker, or monetize user data under any circumstances.
- We do NOT integrate advertising networks or third-party behavioral trackers.
[6. GLOBAL COMPLIANCE: GDPR, CCPA/CPRA, CalOPPA & COPPA]
Because PhotoNow is built with a zero-cloud architecture and does not harvest, store, or process Personally Identifiable Information (PII) on remote servers:
- GDPR & UK-GDPR: Rights to access, rectification, and erasure are naturally fulfilled by the user directly within their browser storage. No cross-border personal data transfers occur.
- CCPA / CPRA: We do not “sell” or “share” personal consumer information as defined by California law.
- COPPA (Children's Online Privacy): PhotoNow is designed for software developers, engineers, and creators. We do not knowingly collect personal information from children under the age of 13 or 16.
[7. DATA SECURITY & MEMORY HYGIENE]
All web transmissions utilize strict Transport Layer Security (TLS/HTTPS). In the browser and Node.js MCP runtime, image canvases, video buffers, and audio contexts are garbage-collected and deallocated from RAM immediately following conversion completion.
[8. PRIVACY INQUIRIES & DPO CONTACT]
For questions regarding this Privacy Policy or our architectural zero-cloud security model, please contact:
Primary Privacy Contact: Sibasish Chakraborti
Email: sibasishchakraborti@gmail.com
GitHub Repository: GitHub / PhotoNowEngine