Four things leave your device. Here they are.

The short version

Image Horse opens your photos in your browser and edits them there. The image engine is Rust compiled to WebAssembly and it runs on your own processor, so the pictures you open are not uploaded to edit them, resize them, compress them or annotate them. You do not need an account to use it.

Four things do leave your device, and each one is listed below: anonymous usage analytics, your account details if you make an account, the cloud features that only run when you are signed in, and the AI tools, which are off until you switch them on.

What stays on your device

Your photos, your edits, your layers and your gallery are stored in your browser’s own database (IndexedDB) on the machine you are using. We do not receive them and we cannot read them. They are not backed up anywhere. If you clear your browser’s site data for Image Horse, that copy is gone and we have no way to restore it, so export anything you want to keep.

Because this storage belongs to the browser and the address, a gallery saved on one browser or one device does not appear on another.

Analytics

Both the website and the editor run Google Analytics 4, and it runs for everyone — there is no switch for it and we do not ask first. It sets cookies and it contacts Google on every page load. It records pages viewed, rough location derived from the network address, and general device and browser details. It does not receive your photos or anything you type into the editor. The website and the editor are separate properties.

The editor also runs Vercel Web Analytics, which counts page views without cookies and without identifying you.

The contact form

Messages sent from the contact form go through Web3Forms, a form relay, which emails them to one inbox. It receives what you type into the form, including your name and email address if you give them. Nothing from the form is stored on this site.

Accounts

Accounts are optional and the editor works fully without one. If you do make an account, it is handled by Clerk, which stores your email address, your name and picture if you provide them, and the identity from whichever provider you signed in with. If you sign in with Google or GitHub we receive your email address, name and avatar from them, and nothing else — we never see your password with either.

Cloud features, when you are signed in

Signing in enables features that need a server: share links, syncing your settings across devices, your saved colors, and keeping edit history off-device. These run on Convex. What is stored there is the material those features need — the document you chose to share or sync, the colors you saved, and the account it belongs to. Signed out, none of it runs.

Keeping edit history off-device means a flattened copy of an edited photo, stored under your account so another device can pick it up. It is governed by the “Everything in your browser” switch, like the AI tools: with the switch off, no copy of a photo is uploaded, signed in or not. Deleting a copy you already uploaded works either way — that sends nothing, and it is how you take something back.

A share link keeps the flattened image you shared, a count of how many times it was opened, and the time of each opening — the time only. Nothing about who opened it is recorded: no address, no browser, no account. Settings › Shared shows every link you have made with those counts, lets you stop a link after a number of views or on a date, pause and resume it, or delete it, which removes the image too.

The settings sync is named in full because it is the one that happens without you asking each time. Three things travel: your preferences (the Settings dialog), which panels and tabs you last had open along with the command palette's recent list, and which mode each tool was left in. That is the whole list. The online-features switch is not on it, because agreeing to send data to a server is something you do on each device, and nothing that identifies your device or browser is sent along. Your photos, your edits and your gallery are not in it — they stay in this browser, on this device, exactly as they do signed out.

Settings › Sync shows what sync is doing, on a phone too. It has a switch that turns sync off for that device alone: nothing is fetched or sent from it until you turn it back on. It also has a button that deletes the synced copy from your account. What is left afterwards is a note that each item was deleted and when, so your other devices do not send it straight back. Nothing is sent again until you change one of those settings, or press “Send this device’s settings”, on a device where you are signed in.

The AI tools

These are off by default and they are the only part of the editor that sends a picture to a server. The switch for online features is in the New dialog and in Settings › Security; while it is off, the AI tools are not offered. When you turn it on and use one, the prompt you wrote and the image or mask you are working on are sent to our server and processed by Replicate, which runs the model. They are used to produce your result and are not used to train anything by us.

Payment

The paid tier is billed by Stripe. Stripe handles the card details and we never see them. We keep the subscription status Stripe reports so the app knows which tier your account is on.