Privacy Policy
What RetypeWords does with your images and your account data
2026/09/03
Introduction
RetypeWords is an online tool that replaces text inside images. To do that we have to receive your image, process it, and give you back an edited version. This policy explains exactly what happens to it and to the rest of your data.
The short version: your images are processed to produce your result and for nothing else, they are deleted after 48 hours, and they are never used to train models.
What We Collect
Images you upload
The image file itself, plus what the tool derives from it in order to work: the position of the text it found, the text it read, and the replacement text you typed.
Account information
Your email address, and a password hash if you set a password. If you sign in with Google, we receive your email address and basic profile information from Google — not your Google password.
Usage and billing
Credit balance and transaction history. If you buy Credits, our payment processor handles the card details; we never receive or store your full card number.
Technical data
IP address, browser and device information, and pages visited. We also use a device fingerprint and IP to enforce the one-free-edit-per-device limit and to detect abuse of free usage.
How We Use It
| Purpose | What it covers |
|---|---|
| Providing the Service | Reading the text in your image, producing the edited result, letting you review and download it |
| Your account | Authentication, credit balance, job history, support |
| Billing | Processing purchases, preventing payment fraud |
| Abuse prevention | Enforcing free-usage limits, detecting automated abuse, responding to reports |
| Legal obligations | Responding to lawful requests, keeping records we are required to keep |
| Improving the Service | Aggregated, non-identifying statistics — how often edits succeed, how long they take |
We do not use your images to train models. They are not added to a training set, not used to improve model quality, and not sold or licensed to anyone.
We do not sell personal information, and we do not use your images or account data for advertising.
Who Else Processes Your Image
Producing an edited image requires third parties. Each receives only what it needs:
| Processor | What it receives | Why |
|---|---|---|
| Cloud hosting and storage | The image file, encrypted at rest | Running the Service and storing your upload for the retention window |
| Database provider | Account data, job records, credit ledger — not image files | Persisting your account and job state |
| OCR provider | The image, to read the text in it | Finding the words and their positions |
| Image model provider | The image and your replacement text | Producing the edited result |
| Payment processor | Your payment details, directly | Taking payment; we never see the card number |
| Email provider | Your email address and message content | Verification and notification emails |
These are processors acting on our instructions, not independent controllers using your data for their own purposes. We do not otherwise share your images.
We may disclose data where legally required, or to investigate a report of abuse under the Acceptable Use Policy.
How Long We Keep It
| Data | Retention |
|---|---|
| Uploaded images and results | 48 hours, then deleted automatically |
| Job records (status, region text, credit outcome) | Retained for support, billing and abuse response |
| Account data | Until you delete your account |
| Billing records | As long as tax and accounting law requires |
| Abuse and safety records | Up to 12 months |
Deleting a job deletes the image bytes, not merely the database row pointing at it. Deleting your account removes your account data and any remaining images.
Security
Data is encrypted in transit and at rest. Images are held in private storage that is not publicly addressable — there is no shareable link to your upload, and every request for an image is checked against your account. Access is limited to what is needed to operate the Service.
No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority as required by law.
Your Rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive a copy in a portable format, and to withdraw consent. Under GDPR our legal bases are performance of a contract (providing the Service), legitimate interests (security and abuse prevention), legal obligation, and consent where it applies.
If you are in California, you may request disclosure of the categories of personal information collected and request deletion. We do not sell personal information, so there is nothing to opt out of on that front.
To exercise any of these, use the contact form. We do not discriminate against you for exercising a right.
International Transfers
Our infrastructure and processors may be located outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
Children
The Service is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.
Changes
We may update this policy. Material changes will be notified through the Service or by email before they take effect, and the date at the top of this page will change.
Contact
Questions, or to exercise a right: use the contact form.
This policy describes our actual practices for a small independent product. It has not been reviewed by a lawyer and is not legal advice.