Operator: Andy Wong, operating Neko Photo
Contact: [email protected]
Effective date: 17 October 2026
1. Scope
This policy explains how Neko Photo handles personal information in connection with nekophoto.com and account-connected product features, including downloads, accounts, membership, feedback, roadmap participation and notifications. It distinguishes those services from ordinary local editing in the desktop application.
2. Local photos and connected features
Ordinary photo editing is designed to take place locally on your device. The account website does not require you to upload your photo library for ordinary local editing. This does not mean that every feature works without an internet connection: updates, sign-in, license checks and submitted feedback can involve network requests.
If you send an image as an avatar or include personal information in feedback or a support message, that submitted information is processed separately from your local photo library. A third-party website, plugin or service that you separately choose to use may have its own privacy practices; review those practices before sharing content with it.
3. Information processed
Account and authentication information
We process the name and email address you provide, password hashes, account status and information needed to authenticate requests, maintain sessions and protect forms. Passwords are stored as hashes rather than reversible plain text. Password-reset and account-security operations also involve temporary security information.
Membership and licenses
We process membership tier, license or early-access key identifiers, status, expiry information and administrative records needed to grant, display, renew or revoke access. Neko Photo is currently in early access (alpha) and offered without charge; we do not currently collect payment-card or billing information. A paid offering, such as a Pro subscription, may be added in the future. Before any paid offering is introduced, this policy will be updated to explain what payment information is processed, by which payment provider and for what purposes.
Connected sessions
Account-connected applications may use access tokens. Session management can include a session or token label, creation time, last-used time and expiry information where available. These records support access control and revocation; a displayed session label is not a guarantee of a verified physical device identity.
Feedback and support
We process messages, replies and related details you submit, such as category, module, severity and optional application version. Feedback records can also contain status, contribution activity and administrative responses. Please do not send passwords, license secrets, unnecessary personal information or confidential information about other people.
Avatars
If you upload an avatar, we process and store an image for profile display. The current website resizes and re-encodes uploaded avatars. You should still avoid uploading sensitive images or assuming that image processing guarantees removal of every possible identifying detail.
Roadmap and notifications
If you vote on or subscribe to a roadmap item, we associate that action with your account. Notifications can include the relevant event, delivery into your in-app inbox, read status and notification preferences. A roadmap subscription is not, by itself, a subscription to a paid plan.
Downloads and technical information
Recorded download activity may include release version, event time, a hashed IP-derived value and a shortened browser or application user-agent string. Filtering of common automated traffic is approximate, so these figures are not a count of verified installations or unique people.
A hashed IP-derived value is not necessarily anonymous. Hosting and delivery infrastructure may separately process network addresses, request metadata and access, security or error logs when handling requests.
4. Purposes
We use relevant information to:
- Provide account access, downloads and connected features.
- Manage membership, licenses and connected sessions.
- Receive, investigate and answer feedback and support requests.
- Provide roadmap participation and in-app notifications.
- Maintain service reliability, investigate failures, prevent misuse and protect accounts.
- Understand download activity and product support needs.
- Handle information requests, disputes and applicable legal obligations.
Providing information for one of these purposes does not, by itself, grant permission to use unrelated private content for another purpose.
5. Cookies and browser storage
The website uses session and security mechanisms, including cookies associated with authentication and CSRF protection. It also uses browser local storage to remember a selected light or dark theme. Security services may use additional browser information to assess requests.
You can manage cookies and local storage through your browser. Blocking required session or security mechanisms may prevent sign-in or form submission. Removing browser storage or uninstalling the desktop application does not delete server-side account records.
6. Service providers and disclosures
The website uses Cloudflare for delivery and protection and Cloudflare Turnstile for automated-abuse checks. These services process information involved in handling or checking requests under their applicable service arrangements and privacy notices. Hosting and any configured email-delivery providers also process information necessary to deliver their services.
Information relevant to support, account administration and security may be accessed by the operator and authorized service personnel. Information may also be disclosed where required by applicable law or reasonably necessary to investigate abuse, protect rights or respond to valid legal requests. Any planned use materially beyond the purposes described here should be explained before it is introduced.
7. Processing locations
Service providers may process information in locations outside your country. Processing locations depend on the hosting, delivery and communications services used. Contact [email protected] for questions about the arrangements applicable to your information. This statement is not a promise that all information remains in any one country.
8. Retention and deletion
Retention depends on the type of information and why it is held. Relevant considerations include maintaining an active account, providing licenses and support, investigating security incidents, resolving disputes and meeting applicable legal obligations.
There is currently no single fixed deletion period stated for all records. This policy does not promise automatic deletion after a particular number of days. Copies in backups or operational logs may remain after removal from the active application, subject to the relevant operational retention process.
You may request account closure or deletion by contacting [email protected]. We may need proportionate information to verify that the request relates to your account. We will explain any information that must be retained and any applicable limitations. Please do not send your password for verification.
9. Your choices and requests
Depending on applicable law and the circumstances, you may have rights concerning access, correction, deletion, objection, restriction, portability or withdrawal of consent. To ask about or exercise an applicable right, contact [email protected] with enough information to identify your request. We will assess requests under the rules that apply; this policy does not promise rights or deadlines beyond those rules.
Use available account controls to update information, manage notification preferences or revoke connected sessions. Some requests require manual handling rather than an in-app button. You may also be able to contact the relevant privacy regulator in your jurisdiction.
10. Security
We use measures intended to protect the information processed by the service, including hashed passwords and access controls. No website, storage system or transmission method can guarantee absolute security. Keep your credentials private, use an appropriate password and revoke sessions you no longer recognize. Report suspected account misuse to [email protected] without including passwords or other secrets.
11. Children and eligibility
If you are below the age at which you can independently consent to relevant processing or enter the applicable agreement in your jurisdiction, involve a parent or legal guardian before creating an account or submitting personal information. Contact us if you believe information has been submitted by a child without required authorization. This section is not a representation that the service has implemented an age-verification system.
12. Changes and contact
When this policy changes, we will update the published date and make the revised version available on the website. Material changes should be brought to users' attention through an appropriate available notice. Where applicable law requires additional notice or consent, merely posting a new policy will not replace that requirement.
Privacy questions and requests: [email protected].
Operator: Andy Wong.
See also: Terms of Use — https://nekophoto.com/terms.