Built so your data can't leak

Privshot exists to remove personal data from images — so the way we handle that data is the product, not an afterthought. Here is exactly what happens, in plain terms.

Your images

• Processed in memory, discarded immediately. Uploads are held in memory only for the moment it takes to run detection, then dropped as soon as the response is sent. We do not write them to disk or keep them.
• Never stored, never shared. No image database, no third-party processors receive your files.
• Never used to train AI. Your screenshots are not fed into any model, ours or anyone else's.
• Where the work happens. The uploaded screenshot is analysed on our server, in memory, only to detect the PII — then discarded (as above). The redaction itself is drawn in your browser, and the final redacted image is generated locally and never re-uploaded.

How redaction actually works

A redaction is only safe if it destroys the information rather than hiding it:

• Solid boxes overwrite the pixels. The default style replaces the region with an opaque fill — there is no hidden layer to peel off and nothing to reverse.
• Flattened output. Results are exported as a single-layer image, so there is no selectable text or separate layer underneath.
• Metadata dropped. Re-encoding the image strips EXIF and embedded thumbnails that could otherwise carry the original.
• Safety margin. Each region is grown slightly so antialiased character edges can't peek out.

We also offer blur and pixelate for looks, but they are not guaranteed irreversible — for sensitive data, use a solid box. We explain why in depth in why blurring is not safe redaction.

Detection is best-effort — verify before you trust it

Automated detection uses OCR plus pattern and NLP matching. It is very good, but it will not catch 100% of PII 100% of the time, and the API has no human-review step. Treat every result as a draft to check before sharing — a missed region is an un-redacted leak. Every API response tells you what was found and with what confidence, so you can add your own review threshold.

Account & API security

• API keys are hashed — we never store them in plaintext and can't show them again after creation.
• Passwords are stored with bcrypt.
• State-changing actions are CSRF-protected; auth and public endpoints are rate-limited to curb abuse.
• Optional multi-factor login codes by email.

Payments

Billing runs through Stripe. Card details are handled entirely by Stripe — Privshot never sees or stores them. Credits are granted only through Stripe-verified payments.

Infrastructure

• Hosted on a European cloud. Your requests run on a European cloud provider (in France) — not a US hyperscaler's EU region. That matters: it keeps the infrastructure and the company under EU jurisdiction, rather than a US-owned cloud that remains subject to US law even for its European data centres.
• Served over HTTPS with HSTS and hardened security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options).

Found a security issue?

We appreciate responsible disclosure. Please reach us via the contact page or at privshot@protonmail.com before disclosing publicly, and we'll work with you.