JPG, PNG or WebP · up to 20 MB per image. On-device mode is designed to process images in the browser and does not switch to a server after a failure. Server mode is not enabled. First use downloads the Lite model and browser runtime; this preview does not guarantee offline availability. By using this preview, you agree to the preview terms. privacy information.
Privacy Policy
Last updated: November 2026
We collect minimal personal data and state our technical architecture plainly. This Privacy Policy explains how remove.ac handles data across our on-device Browser Studio and our Cloud GPU API.
1. How Images Are Processed
Browser Studio (Local Processing): Images selected, pasted, or dropped into the web editor are segmented locally on your device using WebGPU or WebAssembly. Those images are not uploaded to our servers. On first use, your browser caches the ~78.2 MiB segmentation model and runtime locally; no user images are stored in that cache.
Cloud GPU API (/v1.0/removebg): Only when a developer or integration explicitly calls https://remove.ac/v1.0/removebg with an X-Api-Key are image bytes transmitted over TLS to our stateless serverless GPU workers (Modal), processed in volatile RAM, and wiped immediately upon completion. Our PostgreSQL ledger stores zero image binaries (no bytea image columns) — only credit movements, output dimensions, and SHA-256 digests for idempotent replay protection. User images are never retained and never used for AI model training.
2. Account & API Key Data
When you register an account, your email address is stored in Supabase for authentication, welcome-credit issuance, and billing association. Self-service API keys (rac_live_...) are stored solely as one-way SHA-256 hashes plus short display prefixes; plaintext keys are never persisted. We never sell or rent personal data.
3. Payment & Billing Information
Paid credit packs and monthly subscriptions are processed by Paddle.com as our Merchant of Record. Card numbers, PayPal credentials, billing addresses, and tax details are collected and processed directly by Paddle under PCI-DSS compliance; remove.ac receives only signed webhook events containing transaction status, price IDs, and customer references to credit your ledger.
4. Cookies & Infrastructure Providers
We use strictly necessary HttpOnly cookies to maintain authenticated sessions and language preferences, with zero third-party advertising trackers. Core infrastructure providers are Vercel (application hosting), Supabase (authentication and atomic credit ledger), and Modal (stateless GPU inference). First-touch referring domain and UTM tags are kept in local storage and sent only during checkout for attribution.
5. Your Rights & Contact
You may revoke API keys at any time from your Account page, or email [email protected] to request access to, correction of, or deletion of your account data.