Privacy policy

AnyToPrompt is operated by Rao Rizwan Iqbal, UAE. In this policy, “we” and “us” mean the operator. For anything related to your data, email [email protected].

When you upload an image or paste an image link, this is exactly what happens:

• Your browser sends the image to our server over an encrypted HTTPS connection.
• Our server checks that the file really is a JPEG, PNG or WebP image, scales it down to at most 1,568 pixels on its longest side and strips its metadata, including camera details and GPS location.
• The processed image is sent to our AI provider, OpenAI (OpenAI API), together with the target model and output language you chose. The provider returns the text of your prompt.
• As soon as the prompt has been sent back to your browser, the image is discarded. It only ever exists in the server’s working memory (RAM) while your request is running.
• If you use Text to prompt, the words you type follow the same path: they are sent to our AI provider to write your prompt and are never stored or logged.

We never write your image to disk, never store it in a database, never log it and never use it to train AI models. We don’t keep the prompts we generate either: they are streamed to your browser and not saved on our side.

If you paste a link instead of uploading, our server downloads the image from that address on your behalf, so the website hosting it sees a request from our server rather than from you. We only fetch public web addresses and refuse internal or private network addresses.

We rely on a small number of service providers. Each receives only what it needs:

• OpenAI (OpenAI API) receives the processed image and your chosen options in order to write the prompt. Under its commercial API terms it does not use API inputs to train its models, and it keeps them only for a limited period for safety and abuse monitoring. See the provider’s privacy policy.
• Cloudflare Turnstile runs an invisible check to tell people apart from automated bots. To do this, Cloudflare processes technical signals from your browser, such as your IP address and browser characteristics. See Cloudflare’s Turnstile privacy addendum.
• Hostinger provides the virtual server this website runs on. Network traffic, including your IP address, passes through its infrastructure.
• Google Analytics receives pseudonymous usage data, such as pages viewed, device type and events like “prompt generated”, if analytics is allowed. It never receives your images or prompts.
• Google AdSense shows the ads that keep the service free. Google may use cookies and device information to show and measure ads, and to personalise them if you allow it. See how Google uses information from sites that use its services.

We don’t sell personal data. Our fonts and page scripts are served from our own server. Google’s analytics and advertising scripts load only after the page has loaded, and follow your consent choices.

Each visitor can generate up to 20 prompts per 24 hours. To enforce this, our server keeps a one-way cryptographic hash of your IP address and the times of your recent requests. This is held in memory only, is never written to disk, is deleted after 24 hours and is cleared completely whenever the server restarts.

When something goes wrong, our error logs record the type of error and the time. They never contain your image, your prompt or your IP address.

The tool keeps your 10 most recent prompts, with a small thumbnail of each image, in your browser’s local storage so you can find them again. Your theme preference (light or dark) is stored the same way. This data never leaves your device, and we can’t see it.

You can delete your history at any time with the “Clear” button next to it, or by clearing this site’s data in your browser settings.

Necessary data (your theme and consent choices) is kept in your browser’s local storage, and a small necessary cookie remembers the language you pick so the homepage opens in it next time. If you allow them, Google Analytics sets cookies to count visits and Google AdSense sets cookies to show and measure ads. Cloudflare Turnstile may store short-lived data that it needs for its security check.

In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies stay off until you allow them in the banner. Elsewhere they are on by default. Everywhere, you can change your choice at any time with “Cookie settings” at the bottom of every page.

We use Google Analytics 4 with Google Consent Mode to understand which features are used and where the site can improve. Google Analytics 4 does not store IP addresses, and our reports are aggregated. We record events such as “prompt generated” or “prompt copied”, never the content of your images or prompts.

Ads are provided by Google AdSense. Without advertising consent, Google may still show non-personalised ads based on limited, contextual information.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.

You can opt out of personalised advertising in Google Ads Settings, and opt out of some third-party vendors’ use of cookies for personalised advertising at www.aboutads.info.

To run, secure and improve the service, our own server keeps a simple usage log. For page visits it records the page, the website you came from (its name only), your browser language, time zone and device type (for example “mobile, Chrome, Android”). For each prompt request it records the time, the options you chose (generator, output language, image or text), whether it worked or the type of error, how long it took and the length of the result. If you paste an image link, we record only the website’s name (for example example.com), never the full link.

Visitors are identified only by a pseudonymous code calculated from the IP address and browser; the IP address itself is not stored. This log never contains your images, the ideas you type or the prompts we write. It uses no cookies, is not shared with anyone, can only be seen by the site operator and is deleted automatically after 180 days.

We process your image and chosen options to provide the service you ask for (Article 6(1)(b) GDPR). We process technical data such as your IP address for security, bot protection and fair-use limits, based on our legitimate interest in keeping the service safe and available (Article 6(1)(f) GDPR). Where the law requires it, we use analytics and advertising cookies only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

We keep the usage statistics described above based on our legitimate interest in running, securing and improving the service (Article 6(1)(f) GDPR).

• Uploaded images and image links: only while your request is running, typically a few seconds.
• Generated prompts: not kept on our servers at all.
• Rate-limit data (hashed IP address and request times): up to 24 hours, in memory only.
• Emails you send us: as long as needed to answer you, and no longer than 24 months.
• Data held by OpenAI (OpenAI API) and Cloudflare: according to their own policies, linked above.
• Google Analytics data: up to 14 months, after which it is deleted automatically.
• Usage statistics (pseudonymous visitor code, pages visited and prompt request details, without images, ideas or prompts): up to 180 days.

Our AI provider, Cloudflare and Google may process data in the United States and other countries. Where data leaves the European Economic Area or the United Kingdom, these transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to complain to a data protection authority. Because we don’t store images, prompts or accounts, the only data we hold about you is the short-lived rate-limit hash and pseudonymous usage statistics that can’t be linked to your name.

To exercise any of these rights, email [email protected]. We will reply within 30 days.

AnyToPrompt is not intended for children under 16, and we do not knowingly process their personal data.

When we change how we handle data, we update this page and the date at the top. For significant changes, we will also show a notice on the site before the change takes effect.

Questions, requests or complaints about privacy: [email protected]. For takedown and abuse reports, see our contact page.