When you add an image to a tool, your browser reads it from your disk. The image engine — delivered by our server like any other part of the page — processes it in background threads of your browser (Web Workers and WebAssembly). The result is offered to you as a download.
At no point is the image, its name, its size, its dimensions, its pixels or its metadata sent to us. The only messages a tool run sends to our server are which tool started and, at the end, whether it finished, failed or was cancelled — so your plan's operations can be counted.
Results exist only in the open tab until you download them. We keep no copy — there is nothing on our side that could be shared, leaked or used to train anything.
How you can check
Open your browser's developer tools (F12), go to the Network tab and run a tool. You will see two small requests to api/usage/operations — one at the start, one at the end — and no upload. Requests to api/analytics/collect belong to our own visit statistics: they describe the page visit, never your images. The page's security policy (connect-src 'self') also prevents it from sending data to any other server.
More details, including the technical safeguards, are on the security page.