Privacy

Your images

The upscaler runs entirely inside your browser using WebGPU or WebAssembly. When you drop an image, it is opened in your browser's memory, processed by a neural network running on your hardware, and rendered back to you. Without an account it is never transmitted, stored, or seen by us. You can verify this with your browser's network inspector: while you upscale signed out, no request carries your image. Better still, load the page once and then use the tool with your connection turned off: it works exactly the same.

One exception happens only if you start it. Under a finished result, “See this photo in Cloud HD” sends one small crop from the centre of your photo (at most 384 by 256 pixels) to our processing provider, fal.ai, in the United States, so you can compare its result with the free one. The crop is sent straight through and not kept by us; the provider’s copy expires within an hour. To limit how often it can be used, we keep a one-way hash of your IP address and the date for 7 days. Nothing is sent until you press the button.

Free accounts

An account is optional and free. It keeps every upscale you make while signed in, so you can open and export it again later. Sign-in is handled by Clerk, which keeps your email address and sign-in details for us.

While you are signed in, each finished upscale is sent to our storage together with a small preview and a copy of the image you picked, so the before and after can be shown side by side. We keep them, your email address, and when your account was created and last used, until you delete them. You can delete any upscale at any time from Your upscales; to delete your account, use Delete account in Settings. This stops your plan and removes your saved files and credits. Interrupted deletion is retried automatically. We retain a deletion record containing your sign-in provider ID, deletion time and reason, prior-plan flag, and Stripe customer reference to reject old sessions and handle late payments. Operator audit records contain staff identity, action, record ID, reason and timestamp for support and accountability; they expire after 180 days. A temporary retry record contains the provider ID and cleanup status until deletion finishes. Contact the address below if you need help. Authorized staff may inspect saved images and videos to answer support requests, investigate processing problems, comply with the law, or enforce our Terms. Staff access requires a recorded reason and is logged. We never sell your media or use it to train models.

To protect stored media from automated abuse, we keep daily totals of media requests and requested transfer bytes for each account, plus site-wide totals and coded identifiers for temporary provider input files. These counters contain no playback history or IP addresses and are removed by an hourly cleanup after the following UTC day. Deleting an account does not reset its short-lived safety counters.

Cloud HD

Cloud HD is an optional mode for accounts, and it is the one feature that sends a file off your device for processing. Only when you pick it (or ask for an HD version of a saved upscale), the image or video you chose is uploaded to our storage and sent to our processing provider, fal.ai, in the United States, which runs the model and returns the result to us. It is used only to make that result. The temporary upload is deleted once the job ends, or within a few hours if no job starts from it. For a completed video, we keep a copy of the uploaded video with the result in your account so you can compare before and after on any device. This may be the version prepared for processing, with its final frame held through the soundtrack. Both count toward your library storage and are removed when you delete the saved video or your account. An existing saved input remains in your library. The provider’s copies expire one hour after the job. Results stay in your account until you delete them or your account.

For each job we keep a record of its kind, size, options, the credits it used, its status and when it ran, so your credits add up and failed jobs are refunded. Those records stay with your account.

Pro payments

Pro plans and credits are sold by Stripe through its Link merchant-of-record service, which collects your payment details, billing address and any tax information and handles receipts, refunds and disputes under Stripe’s privacy policy. We never see your full card number. We keep the Stripe customer reference for your account, your plan, its status and renewal dates, whether you have used a trial (and, to keep the trial to one per card, a one-way card identifier from Stripe, never the number), and the credit ledger, for as long as your account exists and afterwards as long as tax and accounting law requires. To keep free trials from being claimed over and over, we also keep one-way coded identifiers made from your email address and your network, which cannot be turned back into either, for up to a year. This necessary account and payment processing does not depend on your Analytics choice.

What we collect

If you schedule a trial cancellation because the price is too high, we may send one email offering a subscription discount. We use your account email and most recently saved language choice, with English as the fallback. The offer records its subscription, price, expiry, delivery attempt and whether it was claimed or declined. We keep that record until account deletion to prevent repeated offers and duplicate billing changes. Opening the email link does not change your subscription: confirmation on the offer page is required. You can decline there, use the email’s unsubscribe link to stop discount offers, or ignore it and keep your cancellation. Unsubscribing does not change your subscription. These emails contain no tracking pixels and are separate from newsletter subscriptions.

The analytics described below, plus an email address if you choose to give us one, and what is described under Free accounts, Cloud HD, Pro payments and Getting help if you use them. Nothing else.

We use Plausible Analytics and Google Analytics 4 to understand how the site is used: pages visited, the referring site, country, device and browser type, and a few coarse events (which engine ran, a size band, a duration band, a failure reason, selecting the 8× option, or viewing and clicking a Pro offer). Checkout failures include a predefined error code, coarse reason, and HTTP status; never the error message or customer details. Expected redirects to sign up are not counted as checkout failures. Plausible is cookieless and keeps no personal data. Google Analytics is provided by Google, which processes this data on our behalf under its data processing terms; it sets the cookies listed under Cookies below and does not store IP addresses. We keep Google Analytics data for 14 months. See Google's Privacy Policy and how Google uses information from sites that use its services. You can switch both off: turn Analytics off in the cookie preferences and neither tool counts your visits.

There is no fingerprinting and there are no ad networks, and we do not use Google Analytics for advertising (Google signals and ad personalization are off). Nothing about your images (their contents, names, or dimensions) is ever measured or sent anywhere.

With explicit Analytics consent, a return from a paid checkout can also send a confirmed purchase to Plausible: the amount actually paid, currency, plan or credit pack, and whether the purchase was a subscription or top-up. Our server verifies the payment and forwards your current browser type and IP address for Plausible to match the visit; we do not retain those headers for this purpose. We send no account, email, Stripe or Google identifier to Plausible. An internal payment marker prevents repeated sends and is retained for up to 400 days or until account deletion. A free trial, checkout return alone, renewal, or refund is not sent as a Plausible purchase. Turning Analytics off prevents further sends; it does not erase an event already received by Plausible.

Our account and billing records let us reconcile account creation, created checkouts, trials, payments and refunds, including when a browser closes before returning from checkout. Derived operational funnel records are kept for up to 400 days or removed when the account is deleted; financial records have the separate retention described below. These totals include accounts whose browser analytics is off.

If you explicitly accept Analytics, we may associate those outcomes with the existing Google Analytics browser and visit identifiers, together with the coarse page and prompt that led to signup or checkout. We keep that consented association for up to 90 days, or four days for an unclaimed guest checkout. For a visit identified by our hosting provider as being in the United States, we may also make this association by default unless you have turned Analytics off or sent Global Privacy Control. That regional association lasts at most 24 hours and is recorded separately from explicit consent. Other countries and unknown locations require explicit acceptance for this association. We read only existing Google identifiers and do not create identifiers to fill tracking gaps. Confirmed payment and refund events can include an opaque transaction reference, currency and amount, never your email address, sign-in identifier or media. Pending delivery identifiers are removed after delivery or within 48 hours. Turning Analytics off removes the active association and suppresses pending analytics deliveries; it does not erase events already received by Google or the account and payment records needed to provide the service. We keep a withdrawal acknowledgement, without Google identifiers, under the 400-day audit retention so an older browser preference cannot silently enable the association again. You can explicitly enable Analytics again. After you choose guest checkout, a same-origin ut_guest_analytics boolean cookie lasts up to four days so an Analytics withdrawal can reach that flow. It contains no user identifier and cannot authorize access. With explicit Analytics acceptance at both origins, navigation between our public site and account portal may carry the existing Analytics visit identifiers in a short-lived URL fragment. It is removed before analytics or sign-in starts and may be kept in this tab for up to two minutes while the destination's Analytics choice is resolved. It never grants consent or access to an account, and a declined Analytics choice clears it. These identifiers are not included in Stripe's return URL.

Email updates

Giving us your address on the newsletter page is optional. If you do, we keep the address, when and on which page you entered it, the language you were reading in, and a short one-way signal derived from your connection that lets us stop abuse of the form. We keep them until you unsubscribe, and we use them only to send occasional notes about this tool. Every email carries an unsubscribe link, and you can write to the address below to be removed instead. The list is never sold, shared, or used for anything else.

Signing up leaves two marks so the same browser is not asked again and cannot sign up over and over: a cookie, sk_nl, which holds a one-way scrambled form of the address rather than the address itself along with the answer you were given, and a note in your browser's local storage under sk-nl:done (plus sk-nl:tries, a count of recent attempts). Both last 180 days at most. The cookie is HTTP-only, so nothing on the page can read it, and neither is used to recognise you anywhere else. Clearing site data removes them.

Getting help

Searching the help center happens in your browser. When Analytics is enabled, we count whether a search found an answer, never the words you typed. Opening the support panel loads our help library. If you send a message to the assistant, we send that message, recent chat history and relevant help articles to Anthropic to generate a reply. This does not automatically send your images or payment details. Please do not put passwords, card numbers or other sensitive information in a message.

We store chats and feedback for up to 30 days after the last activity. If you contact a person, we keep your email address, optional name, message and any conversation you hand over in a support ticket for up to 365 days. We email the ticket to our support inbox and send you a receipt. Withdrawal declarations use this same ticket system and include your name, purchase email, contract details and the receipt timestamp. Cloudflare stores the records and delivers those emails. To limit abuse, we also record a random browser identifier, a hashed network identifier and request counters; counter records expire two days after their counting window. Turnstile checks requests when you start a chat or send a support message.

Cookies

The site itself sets up to two first-party cookies. ut_consentrecords the choice you make in the cookie notice so we do not ask again. It lasts 180 days, is mirrored in your browser's local storage under ut-consent, and holds nothing about you beyond that choice. If you leave the notice unanswered it closes itself after about twenty seconds and records what is already running: Essential on, Analytics on, and nothing else. Nothing new starts at that moment. In the EEA, the United Kingdom and Switzerland, Google Analytics stays cookieless until you accept Analytics. A few local-storage entries help the tool itself: ut-lang, the language you last picked or carried into the app (so the app uses it and another language can offer yours back); ut-theme, light or dark if you chose one (your appearance choice follows links between the public site and app through a temporary URL preference removed when the destination opens); ca-trial-claim, the guest Checkout session and return page kept for up to 30 days to resume interrupted account setup; ca-rail and ca-lib-view, the account pages’ folded side menu and grid or list layout; pu-prefer-wasm, which remembers for 14 days that this device should use the CPU engine after a crash; and ut-cloud, the Cloud HD switch’s options (whether Cloud HD stays on is remembered only while you are signed in). While an upscale runs, the tab keeps the image and its progress in its own session storage and IndexedDB so it can pick the job back up after a crash; that copy stays in your browser. The newsletter’s two marks are described above and only exist if you sign up. If you sign in to a free account, more exist: sid, an HTTP-only cookie that keeps you signed in for up to 30 days and is only sent to our account API, separately on the public site and app subdomain;ut-acct-sync, a host-only display hint with your email and update time (or a signed-out marker), lasting up to 30 days; ut-acct in local storage, which holds your email address, your first name and a small copy of your profile picture, so the page can show that you are signed in; and Clerk’s own sign-in cookies on the account pages. Signing out removes the session cookies and local account hints, with a signed-out marker preventing old hints from reappearing. The app exchanges authentication with the public site only when you sign in or out; image data is never part of that exchange. Browser storage and privacy choices belong to each origin separately. When a file moves from the Library upload dialog to the workspace, or crosses sign-up or checkout (images you picked before signing up, or the file you chose for Cloud HD), it waits with its selected options in this browser’s IndexedDB (ut-pending, ut-cloud-intent) for up to an hour and is removed once it starts; an unfinished Cloud HD upload is remembered under ut-uploads so it can resume.

Cloud HD keeps this tab's job ID in ut-cloud-job, including a completed result for reloads. During an upload, ut-cloud-pending in session storage points to its input, prepared bytes, options and upload receipt in IndexedDB (ut-cloud-run). Recovery expires after 12 hours; expired files are removed when that storage is next used. The input is removed once the job is accepted or explicitly cancelled. For video comparison, a separate copy of the latest original video stays in this tab’s existing local result storage for up to 24 hours, until replaced or cleared. The job record includes a file signature to match that original after a reload. Signing out clears these records. ut-uploads remembers uploaded parts for up to 12 hours. If browser storage is unavailable, you may need to select the file again; accepted jobs still finish in your account.

ut_lang remembers your language for one year when you choose it in the language menu, suggestion bar or app Settings, or carry the displayed language between our public site and app. Each host stores its own cookie and local-storage preference. A temporary language-only URL parameter carries the choice between them and is removed on arrival. It contains no account identity. When you are signed in, we also save your most recent supported choice with your account for account emails. Browser display preferences remain separate on each device. Links to English pages use your saved choice; prefixed language links keep their language. Without a choice, the public site can suggest or open your browser's or country's language when available.

The support panel uses st-support-device for a random browser identifier sent with support requests to limit abuse,st-support-persona-seed to keep its presentation consistent, and support:upscale-tools:appearance for its appearance preferences. These local-storage entries have no automatic expiry; clearing site data removes them.

ut-trial-offer-dismissed in session storage remembers that you closed the trial offer card. It contains only that choice, stays in this tab, and is cleared when the tab closes.

Plausible sets no cookies; Google Analytics sets the two cookies marked Analytics below, only while Analytics is on:

• _ga (Analytics, 2 years): Google Analytics, a random identifier that lets us tell a returning browser from a new one when counting visits.
• _ga_NP8PLH71NV (Analytics, 2 years): Google Analytics, keeps the state of the current visit.

Turn Analytics off in the cookie preferences and neither service counts your visits, and the Google Analytics cookies are removed. The essential storage described above remains. Your privacy choices in the footer reopens your preferences at any time. In your account, use the privacy control in the corner. The Cookie Policy lists every cookie and storage entry in one place.

Support payments

Optional support payments are handled by Ko-fi and Stripe on their own websites. We do not see your card details. Ko-fi sends us your display name, email address, message and amount so we can thank you and keep accounting records. Nothing from Ko-fi or Stripe loads on this site; the "Support this tool" link simply opens their page. Tips are voluntary and non-refundable except at our discretion.

Hosting

The site is served as static files from Cloudflare's network. Like any content delivery network, Cloudflare may keep short-lived operational logs (such as IP address and requested URL) for security and abuse prevention; those are governed by Cloudflare's privacy policy. Our own server logs record account and Cloud HD events (for example a job id, its status or an error) without the contents of your files; they are sampled and kept for a few days.

Who processes your data

• Cloudflare (United States): hosting, and the storage of uploads and saved upscales.
• Clerk (United States): sign-in for accounts.
• Stripe and Link (United States and Ireland): Pro payments, tax and refunds.
• fal.ai (United States): the Cloud HD models, only for the files you send to Cloud HD and the crops you send to the Cloud HD preview.
• Anthropic (United States): replies to messages you send to the support assistant.
• Plausible (European Union) and Google (United States): the analytics described above.
• Ko-fi: the optional support payments described above.

If you are in the European Economic Area or the United Kingdom, using an account or Cloud HD means your data is transferred to the United States; these providers process it under data processing terms that include the European Commission’s standard contractual clauses or an equivalent safeguard.

Your rights

We process account data to provide the account and the features you ask for (our contract with you), payments and their records to meet tax and accounting law, and analytics only with the consent you give in the cookie notice where that is required. The US regional association described above is optional audience measurement and can be stopped through Your privacy choices or Global Privacy Control. You can ask for a copy of your data, its correction or deletion, or object to its use, by emailing the address below; you can also complain to your data protection authority. Accounts are for people aged 13 and over.

Questions

Upscale.tools is operated by Elowin Labs LLC, the controller of the personal data we collect to operate this service. Our registered business and postal contact address is 1402 North N Street, Lake Worth Beach, FL 33460, United States. For privacy questions or to exercise your data rights, email hello@upscale.tools or write to that address.

Last updated November 9, 2026.

← Back to the upscaler