Privacy Policy

CutPico is a free browser tool that removes image backgrounds. This page explains what the site does with your data, in the same plain language as the rest of the site. Last updated: 29 September 2026.

The short version

• Your photos are processed inside your browser and are not uploaded to us or to anyone else.
• CutPico has no accounts, no newsletter and no contact inbox, so there is no account or contact data held about you.
• We count page opens on our own server, without storing raw IP addresses or user-agent strings, and without visitor cookies.
• Google Analytics 4 runs only under the regional rules below, and never when your browser sends Do Not Track or Global Privacy Control.

Your photos, cutouts and downloads

When you choose a photo, your browser reads the file and the AI model runs on your device. The picture is never sent to a CutPico server, there is no upload step, and the cutout and the file you download are created locally as well. Because the photo does not reach us, we cannot view, edit, recover or share it.

The model file itself is served from this website like the other files the page needs. Your browser downloads it on the first run and may keep its own cached copy. The tool does not need a connection after the model and assets are loaded, but it is a web page: a fresh visit or a cleared cache can require the download again, and we do not promise that the tool will keep working without a connection.

First-party page counting

We count how often pages are opened, so we can see which tools are used and whether the site stays fast. Our own web server writes these counts to its own database. A counted page view holds the page path and the time it happened, plus these attributes:

• the host name of the referring page when the visit came from another site — not the full address, and not its path or query string;
• the two-letter country code that our network provider reports for the connection;
• coarse device, operating-system and browser categories, without version numbers;
• whether the request came from a search-engine or AI crawler instead of a browser.

For human page views we also store a short hash used only to estimate how many different visitors came that day. It is built from the visitor's IP address and user-agent string together with a random salt that is created at the start of each Beijing day and deleted once that day is over. The raw IP address and the user-agent string are never written to the database, and the stored hash does not by itself link the same visitor from one day to the next. We do not use these numbers to identify anyone, and they are not used for advertising or shared as marketing data.

Raw counted rows are kept for 14 days and then rolled up into daily totals, which are kept for 90 days; after that the database deletes them. Like any website, the server receives the request it needs to answer, including the IP address of the connection. That address is used to deliver the page and is not kept in the counting data.

Google Analytics 4

Where analytics is enabled, we also use Google Analytics 4 (GA4) for aggregate traffic figures. It is loaded only when the rules below allow it, it is counted separately from the first-party numbers, and the two sets of figures are never added together. The analytics request carries the page path without query strings. Advertising features, remarketing and advertising signals are not used, and ads data redaction stays on.

• Regions that require prior consent — the European Economic Area, the United Kingdom, Switzerland and comparable jurisdictions: no analytics script is loaded and no analytics cookie is set until you press Allow in the consent message.
• Other recognised regions: analytics is on by default, and you can turn it off at any time with the Privacy settings control in the footer.
• Unknown location: treated like a consent region — analytics stays off until you explicitly allow it.
• Do Not Track or Global Privacy Control: if your browser sends either signal, analytics stays off in every region.

When analytics is allowed to run, Google's servers receive the request needed to load and use the analytics script and may set the usual _ga cookies. We control only what the page sends: the page path and the standard request that any script load produces. Your photo, your file name and any query string are not part of it, and we do not ask Google to combine this data with anything else. Your choice is remembered in your browser's local storage for up to 180 days so the message does not reappear on every visit; you can change it at any time from the footer.

Cookies and local storage

Other than the analytics cookies described above, this site sets no cookies. The consent choice itself is stored in your browser's local storage, not in a cookie. The tool's working data — the photo, the model and the cutout — lives in your browser's memory and cache on your device.

Changes to this policy

If the site's data handling changes, this page is updated and the date at the top changes with it. The current version is the one shown here.

See also the terms of use and the step-by-step guide.