Privacy Policy

1. Summary

• You can use PictureToLink without an account. We do not ask for your name or email to upload.
• Every uploaded image is stripped of embedded metadata, including GPS location, camera details and timestamps.
• Anyone with a link to an image can view it. Image pages are hidden from search engines but are not private.
• We never store your IP address in plain form. We store a one-way keyed code derived from it, to stop abuse.
• Google Analytics and Google AdSense run only according to your cookie choices, which you can change at any time with Privacy settings in the footer.
• We do not sell personal information.

2. Who we are

PictureToLink ("we", "us") operates picturetolink.com and is responsible for the personal data described in this policy. Contact: Admin@picturetolink.com or our contact form.

3. What we collect and why

Images you upload

Metadata. Before an image is stored we re-encode it and discard all embedded metadata (EXIF, GPS location, XMP, camera make and model, original timestamps). We do not store the original file or its file name. Images can still contain personal information in what they show — for example faces, documents or number plates — so please think before you upload.

Visible content. We do not use automated facial recognition and do not analyse images to identify people. Each upload is checked automatically, on our own server, by an image classifier that estimates whether it is sexually explicit. The check runs once, at upload. The image is not sent to any third party, and we keep only the resulting score with the image record. Clearly explicit images are refused; borderline ones are flagged for a person on our team to look at.

Information stored in your browser

We use your browser's local storage to remember your cookie choices and a list of your recent uploads, including their delete links. This list stays on your device; we never receive it. You can clear it with "Clear this list" or by clearing your browser data.

Forms

If you use the contact form or the report form, we collect what you enter (such as your name, email address, the image link and your message) and a keyed hash of your IP address. We use this to reply to you, handle the report and prevent spam.

Technical and security data

To keep the service working and secure, we keep short-lived rate-limit counters (keyed IP hash, number and size of requests) which are deleted when their time window ends — at most 24 hours. Our hosting provider may also keep standard server logs (such as IP address, time, requested address and browser type) for security and reliability. Our application logs do not record IP addresses.

Analytics (with your consent where required)

We use Google Analytics 4, loaded through Google Tag Manager, to understand how visitors use the site: pages viewed, approximate location (country/city), device and browser type, how you arrived, and events such as "upload completed" or "link copied". We do not send image contents, links to your images, file names or form contents to Google Analytics.

Advertising (with your consent where required)

We show ads from Google AdSense on our own pages, never on pages that display uploaded images. Google may use cookies and similar technologies to show ads and measure them.

• Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to your website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and/or other sites on the Internet.
• Users may opt out of personalized advertising by visiting Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info (or youronlinechoices.eu in Europe).

Other third-party vendors and ad networks certified by Google may also serve ads on our pages. You can see the list of Google's ad technology providers and opt out of their personalised advertising through the links above. To learn how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services and Google's business data responsibility site.

If you reject marketing cookies, you may still see ads, but they will not be personalised.

4. Legal bases (EEA, UK and similar laws)

• Providing the service you request, such as hosting your image (performance of a contract).
• Legitimate interests in keeping the service secure and preventing abuse (rate limits, hashed IPs, block lists, server logs) and in answering messages.
• Consent for analytics and personalised advertising cookies. You can withdraw consent at any time with Privacy settings in the footer.
• Legal obligations, such as acting on lawful requests and reporting child sexual abuse material.

5. Who we share data with

We use service providers who process data on our behalf:

We may disclose information if required by law, to respond to valid legal requests, to report illegal content (including to the National Center for Missing & Exploited Children), to protect the rights and safety of users or others, or as part of a sale or reorganisation of the service. We do not sell personal information and do not share it for cross-context behavioural advertising except through Google AdSense as described above and according to your cookie choices.

6. International transfers

We and our providers may process data outside your country, including in the United States. Where the law requires, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms used by our providers.

7. How long we keep data

• Images: until their chosen expiry, until deleted with the delete link or by us, or after 12 months without a view.
• Records of deleted images (identifier, fingerprint, dates and reason, but no image): up to 24 months, or longer if needed for an open abuse report or legal claim. Fingerprints of images removed for abuse are kept in a block list for as long as needed to prevent re-upload.
• Contact messages: up to 24 months.
• Abuse and copyright reports: up to 36 months after they are closed, to keep a record of notices and actions.
• Rate-limit counters: up to 24 hours.
• Analytics data: according to the retention set in Google Analytics (no longer than 14 months).

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or Californian and other US state laws), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. Because we do not have accounts, the easiest way to delete an image is with its delete link. For other requests email Admin@picturetolink.com; we may ask for information such as the image link to confirm the request relates to you. You also have the right to complain to your local data protection authority.

9. Security

We use HTTPS everywhere, keep images in private storage that is only reachable through our own image links, hash IP addresses and delete tokens, and limit access to administrative tools. No system is perfectly secure, so please do not upload sensitive images.

10. Children

The service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided personal data, contact us and we will delete it.

11. Changes

We will update this policy when our practices change and show the new "Last updated" date. Significant changes will be highlighted on the site.

12. Contact

Admin@picturetolink.com · Contact form · Image removal requests: report form