Privacy Policy

Uploaded images wait in our object storage for processing. Temporary uploads are cleaned up after processing. Results are available for 4 hours from submission. Images are not sent to any third party. With the original format kept, a file that cannot be made smaller is returned as it is. When you choose WebP, the converted result is kept even if it is larger.

The current result retention period is 4 hours, as configured by the administrator. It starts when the task is created. Downloads stop working at expiry, and an automatic cleanup job deletes the files from storage. Download anything you need within its availability period.

We keep the filename, input and output sizes, format, compression level, status, processing duration and related timestamps, source (web or API), and client IP address. Records for signed-in users are linked to their account ID; API requests are also linked to an API Key ID.

These details support compression history, quotas and rate limits, troubleshooting and aggregate site statistics. Compression records remain after an image file expires and is deleted; they currently have no automatic expiry period. You can request deletion of related records by emailing us.

When you create an account, we keep account information including your email, display name, a bcrypt password hash, creation time and most recent sign-in time. We do not store plaintext passwords.

After you sign up, our e-mail delivery service sends a confirmation link to your address. The link works once and expires after 24 hours; we store only a hash of it, and the time your address was confirmed.

If you ask to reset your password, we e-mail a link that works once, for 1 hour; we store only a hash of it. Setting a new password signs your account out on your other devices.

The sign-in and sign-up forms use Cloudflare Turnstile to keep out automated abuse. For this check, Cloudflare processes information about your browser and connection, such as your IP address.

When a sign-in session is created, we record its IP address and User-Agent (browser information). The bitinz_session cookie keeps you signed in and uses HttpOnly and SameSite=Lax. The server stores a hash of the session token. Signing out ends the current session, and expired sessions are cleaned up automatically.

A full API key is shown only when it is created and is not stored persistently. We keep its hash, prefix, name, and management details such as creation, last-use and revocation times.

The current upload limit is 25 MB per image, with up to 20 images at a time. There is no limit on how many images you compress on the web; administrators may temporarily enable hourly limits by IP or account against abuse. When enabled, consult the service response for the applicable limits. The developer API counts usage against a monthly account quota.

We use browser localStorage only to remember your language choice, under the key bitinz-lang. You can clear it in your browser settings to reset that preference. Sign-in state is managed separately by the session cookie described above.

Page visits are counted with Cloudflare Web Analytics, which uses no cookies and does not track you across sites. Totals such as the number of compressed images are aggregated from our own service records.

Before each upload, your browser completes a short local calculation to help prevent abuse. This calculation does not involve your images or personal data.

The public pages of this site show ads through Google AdSense. Account pages, such as sign-in, sign-up, the dashboard and administration, show no ads. Your images and compression results are never shared with advertisers.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

You can opt out of personalised advertising in Google Ads Settings (https://adssettings.google.com), and out of some third-party vendors’ cookies at https://www.aboutads.info/choices. How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites.

Where the law requires it, for example for visitors from the European Economic Area, the United Kingdom and Switzerland, Google’s consent message asks for your consent before personalised ads are shown.

Servers record operational information such as the request method, path, status code, response size, duration, request ID and client IP address for maintenance, security checks and troubleshooting. Access logs are separate from compression records and are not deleted together with expired download files.

Email [email protected] to ask about data handling or request deletion of your account and related records. Include the account email, the scope of your request, and result identifiers or approximate times that help locate records. We may need to verify that the request relates to your account or records.

Automatic file cleanup does not delete accounts or their records. Account and record deletion requests are handled by email, and we usually reply within 2 business days.

When our data-handling practices change, we will update this page and its Last updated date. You can return here to read the current policy.