Your Image Never Leaves Your Device
Start from this page and your photo is processed entirely on your own device. Nothing is sent to us, and we keep nothing. The HD download you receive was made right there on your device. Free, no signup, no account.
Open the editorMost background removers — including the well-known incumbent — process every image on the vendor's servers. Your photo is uploaded, segmented in a vendor-controlled inference cluster, and downloaded back as a cutout. That round-trip is the right architecture for some use cases, but it makes the privacy story difficult: you are trusting the vendor's data-handling policy, log-retention practices, and breach posture every time you remove a background. removebackgrounds.ai takes a different default. The cutout model loads once into your browser cache, the segmentation runs on your machine, and the result never traverses our network. This page documents exactly how that works, when the default path is bypassed, and what we explicitly don't do.
How the on-device path actually works
Three steps, all local to your browser, in the order they execute on first upload:
A one-time setup, the first time you use it
The first time you remove a background here, the tool has a one-time setup to do. It runs as part of that first image rather than on every visit, and how long it takes depends on your connection. What it downloads is checked against a known fingerprint before anything runs, so a modified or corrupted copy is rejected rather than used. Afterwards it's kept in your browser, so later images — and later visits — start straight away with nothing to fetch again.
Your photo is processed on your own device
When you add an image, the cutout is worked out right there on your device. Your photo isn't sent to us — the background simply disappears and the result appears in the editor, ready to adjust. The only copy that's kept is a temporary one in your own browser, so you can pick up where you left off if the tab reloads.
Export stays on your device
When you click Download, the finished image is saved straight from the editor to your computer as a PNG — or JPEG or WebP, at the quality you picked. It never leaves your browser. The one exception is if you deliberately use Share Recipe, which uploads only the settings you applied, never the image itself.
What we explicitly don't do
Privacy by negation — listing the things this page does not do, in plain English:
- ✓ We don't send your image anywhere in private mode. It stays on your device from the moment you add it to the moment you save the result.
- ✓ We don't use your photos to improve the tool. Nothing you open here is reviewed by us or added to any set of images we learn from.
- ✓ We don't send anything that identifies you personally to any analytics service. What we count are actions — a background removed, a file downloaded — never your file names and never anything taken from the picture itself.
- ✓ We don't keep your finished cutout. It lives in the tab you're working in and is gone the moment you clear it or close the page.
- ✓ We don't need cookies for the editor to work. A few preferences are remembered inside the tab while you work, and we set no third-party cookies.
- ✓ We don't use your IP address to decide what you see. Our security provider sees it with each request so it can block attacks, and nothing in the editor depends on it.
When the backend IS used (and why)
When you start from this page, your device does the work by default — but not in every case. Two situations send your image to our servers instead:
Older or slower devices
Not every device can finish a cutout on its own. On an older phone or laptop the work can run out of memory or simply take too long. When that happens the editor hands the job over instead: your photo is sent to us, the finished cutout comes back, and the copy we received is discarded right after. On-device stays the default because it is quicker on devices that can manage it — and your photo never has to be sent at all.
Unusual or automated activity
If a session looks automated rather than human — images arriving faster than anyone could pick them, or none of the usual signs of a person using the page — we ask for a quick check that you are real and take the cutout on our side, with a cap on how many we will accept. Your photo is sent to us on that path too, and the copy we received is discarded as soon as the cutout comes back. It keeps a free tool from being drained by scripts, and ordinary use rarely runs into it.
On the suspect-fallback path the source image is uploaded, but the backend discards it after the response is returned. We do not log the source image, hash it, or aggregate it with other uploads.
GDPR, CCPA, and data-residency questions
Private mode makes most of the standard data-protection questions trivial — there is nothing to share, store, or transfer cross-border for the cutout itself. The relevant facts:
GDPR Article 25 — Privacy by Design
Article 25 asks for privacy to be the default rather than an option you have to find and switch on. In private mode there is, in the normal case, nothing for us to process — your photo stays on your device and the background is removed there, so the data-protection question largely answers itself. This is the textbook case the regulation describes.
Data residency
Residency rules apply to data that travels. In private mode your photo doesn't travel — it stays on your device, so for the cutout itself there is no region to choose and no cross-border transfer to declare. In the rare fallback case described above, your photo is sent to us, handled in a single region, and discarded once the cutout comes back; it is not copied to any other region.
Right of access, deletion, and portability
We don't keep your images — in private mode they never reach us at all, and in the rare fallback above your photo is discarded as soon as the cutout is returned. So there is nothing for us to hand over, correct, delete, or export in response to a Data Subject Access Request, and the cutout you downloaded is yours. The usage statistics we collect count actions, not content: no filenames, no image data, no account.
Children's privacy
There is no account, no email address, and no profile, so the tool can be used without registering, whatever your age. We don't ask for a name or a date of birth, and we don't collect any other direct identifier. The usage counts we do keep are aggregate, and they have never been used to build a picture of an individual user.
Why on-device beats cloud for free-tool privacy
Almost every free background remover on the market today sends your photo to the vendor's servers. Your image is uploaded, processed there, returned as a cutout, and a record of the request is kept in their logs. Even when the privacy policy promises the upload is deleted afterwards, you are trusting that it was — not checking. Private mode removes the trust requirement entirely: your photo stays on your device, so there is no policy to audit and no log entry to hope was deleted. Ordinary laptops have been fast enough to do this work locally for years, so we made it the default — which means the privacy claim is a property of how the tool works, and something you can confirm for yourself rather than take on faith.
The costs of this approach are ours, not yours: we pay to deliver the tool, the first visit takes about a second to get ready, and because your photo stays with you we never see the results and can't tune quality from what people actually make. The benefit is that you can hand this page to a privacy-conscious client, a compliance team reviewing tooling, or a journalist investigating why background removers have become a route for image data to leak — and the answer is short, concrete, and checkable rather than something they have to take on trust. In normal use your photo never leaves your device: watch your browser's own network activity while you make a cutout and you will see the page's own files load and the usual anonymous usage events — that a cutout happened, and the file's size and type, never its contents — but the photo itself is never among them. There is no retention window to read and no policy you have to believe, because the image was never ours to keep; the two cases where the fallback does send it are set out in full earlier on this page.
For sellers, freelancers, and creators who routinely handle sensitive client material — product prototypes under NDA, unreleased fashion looks, medical or dental photography, identification documents, draft brand assets, internal pitch decks, prerelease product shots — private mode is not a marketing line, it is how this page works. There is no setting to misconfigure and no policy to take on trust, because on this path your photo never reaches us. It opens on your device, the cutout is computed there, and the file you download is the one your own machine produced. That is the inverse of the usual free-tool bargain: instead of handing your image to a company and trusting its data policy, you never hand it over at all. In practice that changes what you can use it for rather than how it feels to use: the steps are the same, and the difference is that there is nothing to ask your legal or security team about afterwards. It also means the answer to "where did that file go?" is simply that it did not go anywhere. For work covered by an NDA, a client agreement, or an internal handling rule, that is usually the difference between a tool you can use today and one you have to get approved first.
When the cloud-API path is genuinely better
Private mode is not always the right pick. Three honest cases where a hosted-API tool would serve you better:
Low-end phones and older, slower laptops
On a sub-$200 Android phone or a laptop five years old or older, doing the work on the device itself can take longer than sending the photo off and getting it back. We spot that automatically and switch those devices over to processing on our side, but if your whole workflow runs on a Chromebook with 2 GB of RAM, letting us do the work is the better default — and a paid cloud service such as Photoroom may suit that workflow more cleanly.
Automated batch jobs in your own systems
If another system needs to cut out images on its own — a Zapier automation, an internal tool handling hundreds of images an hour, an online store that trims product photos the moment they are uploaded — a tool you open in a browser and click through does not fit that workflow. You want a paid service designed to plug into your own software. Photoroom, Slazzer, and the other cloud vendors all sell this as a first-class product.
Centralised audit trail / SOC 2 evidence
If your security team requires a log entry for every image, a vendor-managed audit trail, and a contractually-binding data-handling policy you can attach to a SOC 2 control, private mode is the wrong shape — when nothing is sent to us, there is no central record to point at. A paid vendor with an enterprise data-processing addendum is the right choice for that compliance posture.
If none of those three apply, private mode is genuinely the simplest privacy story available in this category. See /vs/remove-bg/ for the side-by-side.
Related pages on this site
Three follow-up pages that go deeper on adjacent questions:
Privacy FAQ
Where is my image processed exactly? ▾
On your own device — inside this browser tab. When you start from this page, your photo is opened and the background removed right there on your own computer or phone. The picture itself is never sent to us: no upload, no copy on our side, nothing for us to store or look at. There is no quiet exception, either — if your browser can't do the job on its own, you get an honest message and the choice to switch to our standard remover, which does send a small copy to our servers; what you never get is a silent upload. The one thing that does leave the page is our usage counting: whether an upload started, finished or failed, plus the file's size and format — never the picture, its name, or anything read out of it.
Is this GDPR-compliant? ▾
Yes, by architecture. Private mode realises Article 25 (Privacy by Design) by removing the data-processing operation from our infrastructure entirely — your image is processed on your own device. There is no data transfer, no log entry, and nothing for a Data Subject Access Request to retrieve. The optional suspect-fallback path uploads your image to a single-region backend that discards inputs after returning the response; the legal basis there is legitimate interest (abuse prevention), the data-retention period is zero, and the operation is documented on this page.
Does Cloudflare see my image? ▾
On the default path, no. In private mode your image stays on your device; nothing transits our edge except the one-time model download every user receives and analytics beacons that carry no image data. On the suspect-fallback path, your image transits Cloudflare on its way to the backend, but Cloudflare does not inspect content of HTTPS requests on its Pages or API tier — they see encrypted bytes between TLS termination and origin. The backend itself discards the upload after returning the cutout.
Do you store my photos anywhere? ▾
No on either path. In private mode your image is never sent anywhere, so there is nothing to store. If you use the standard remover instead, the small working copy it sends is discarded immediately after the cutout is returned — the backend has no persistent storage layer for user uploads, no database table, no object-storage bucket. The cutout you exported is held only in your browser's canvas memory until the tab is closed. We do not have a separate research, training, or moderation dataset where user uploads would be retained.
What about the analytics events I see in DevTools? ▾
Those carry no source-image data. The full event registry is documented in docs/ANALYTICS.md and consists of allowlisted custom events such as image_upload_started, background_removed, image_downloaded, processing_error. The events count actions, not content — there is no filename, no image hash, no EXIF data, no OCR text, and no preview thumbnail. Web Vitals events (CLS, INP, LCP) are also collected for performance monitoring and are similarly content-free. The analytics property ID is 529376046 and the data is held under the standard GA4 retention configuration.
Open the editor — your image stays where it belongs
Free, no signup, no account. In private mode, your photo never leaves your device.
Open the editorLast verified: