Privacy Policy

Effective November 7, 2026

Photo Lab is operated by Murphy Tech, a sole proprietorship based in the United States (“we”, “us”). This policy explains what we collect when you use Photo Lab, why, and who else handles it. Questions: [email protected].

What we collect

• Account: your email address, an optional name, and a salted hash of your password (never the password itself).
• Photos: the photos you upload, the edited versions, and the prompts and settings you used.
• Billing: handled by Stripe. We store your Stripe customer ID and subscription status. We never see or store your card number.
• Usage: your credit balance and history, and server logs (which include IP addresses) kept for security and troubleshooting.
• Error reports: when something breaks, technical details such as the page, browser, error message and your account's internal ID number. These do not include your photos, passwords or email address.
• Visit statistics: anonymous, aggregate counts of page visits (pages viewed, referring site, browser and country). No cookies, and nothing that identifies you.

How we use it

Only to run Photo Lab: to sign you in, store and edit your photos, bill your subscription, send account emails (such as password resets), keep the service secure, fix bugs and understand which pages people use. We do not sell your personal information, share it for advertising, or use your photos to train AI models.

Who sees your photos

Only you. Photos are stored in a private storage bucket and are only served to the account that owns them. Our staff do not browse your photos. We would only access a specific photo if you asked us to help with it, or if the law required it.

Third parties that process your data

AI providers. To make an edit, we send the photo (or the cropped area being edited, plus any reference photo you choose) to the AI provider for the model you selected: fal.ai, Google (Gemini) or OpenAI. They process it to return the result. Their own privacy terms apply to what they receive.

Service providers, each handling only what its job needs:

• Stripe: payments and subscriptions.
• Cloudflare: photo storage (R2) and database backups.
• Resend: sending account emails such as password resets.
• Sentry: error reports (described above).
• Umami: anonymous visit statistics (described above).
• Our server hosting provider, which runs the machine Photo Lab runs on.

These providers may process data in the United States and other countries. We may also disclose information when the law requires it, or to protect the rights and safety of our users or the public.

Retention and deletion

We keep your photos and account until you delete them. Deleting a photo removes it and its edited versions. “Delete account” in your account menu cancels your subscription and erases your photos and account. Database backups may still hold a deleted account for up to 7 days before they are replaced. Server logs and error reports are kept for up to 90 days. Stripe keeps payment records as financial law requires.

Cookies

We use one essential cookie to keep you signed in. We do not use advertising or tracking cookies, and our visit statistics need no cookies at all.

Security

Connections are encrypted (HTTPS), passwords are stored as salted hashes, and photos sit in private storage that only your account can reach. No system is perfectly secure. If a breach affects your data, we will notify you as the law requires.

Your rights

Wherever you live, you can see, download, correct or delete your data. Most of this you can do yourself in the app. For anything else, email [email protected] and we will answer within 30 days. Depending on where you live (for example California, or the EU and UK), you may have further rights under local law, such as the right to object to processing or to complain to a data protection authority. We will not treat you differently for using any of these rights.

Children

Photo Lab is for people 18 and older. We do not knowingly collect data from children. If you believe a child has an account, email us and we will delete it.

Changes

If we change this policy, we will update the date at the top. For important changes, we will tell signed-in users by email or in the app before the changes take effect.