Your images stay in your browser.

Image processing

The online tools decode, preview, process, and export images using browser APIs on your device. The current website does not send image files, thumbnails, image blobs, file contents, full local paths, or finished results to an Image Batch server or a third-party image service.

Images are held in browser memory for the active page. They are not saved to localStorage, cookies, or a website database. Refreshing or closing the page clears the active editor state; browsers may reclaim memory on their own schedule.

Website hosting and technical requests

Like most hosted websites, the hosting provider receives ordinary HTTP request information needed to serve pages, such as network address, requested URL, timestamp, and browser headers. This is separate from image processing; image contents are not included in those page requests.

Analytics

No analytics provider is configured in this project by default. The code defines privacy-oriented event names for page and tool performance measurement, but it does not include filenames, image contents, or local paths. If analytics is enabled later, this page and any consent controls must be updated before collection begins.

Downloads and external links

Processed files and ZIP archives are created locally and downloaded through the browser. Windows installers are stored in a private Cloudflare R2 bucket and streamed through the website download endpoint. Download requests may appear in technical hosting logs; your edited image files are not uploaded to that bucket.

Optional accounts

The public website at blukimage.io offers optional registration. Cloudflare D1 stores your email, display name, salted password hash, verification status, account timestamps, hashed session tokens, and hashed time-limited email tokens. Your image queue is not associated with these records. The online editor and current desktop release do not require an account or subscription.

Security cookies and account emails

Sign-in uses a secure, HTTP-only, same-site session cookie with a maximum 30-day lifetime. A separate security cookie protects forms against cross-site requests. Verification and password-reset notifications use Cloudflare Email Service. Session records expire after 30 days; verification links expire after 24 hours, reset links after one hour. Daily maintenance removes expired sessions, expired or consumed email tokens, and rate-limit counters older than 24 hours. Rate-limit identifiers are hashed rather than storing raw IP addresses in the account database.

Account controls and scope

You can update your display name, change your password, sign out, or revoke every active session from your account. A password reset or change invalidates all sessions. Current accounts remain in the database until removed; there is no automatic account-expiry policy. The website does not offer payments, subscriptions, or image-upload cloud storage, and it is not intended to collect personal information from children.

Contact

A public contact address has not yet been configured. When a monitored privacy contact is available, it will be published on the contact page.