Back
Privacy Policy for BigJpg AI
Elke Hwang (BigJPG.AI) Privacy Policy Version 2.0 · Last Updated: July 30, 2026 This Privacy Policy explains what data BigJPG.AI collects, why, who we share it with, and what rights you have. It applies to https://bigjpg.ai (the "Website") and the image upscaling service provided there (the "Service"). The Service is operated by Elke Hwang, an individual sole trader based in the Hong Kong Special Administrative Region, who is the data controller for the purposes of this policy. Contact: support@bigjpg.ai. This policy forms part of, and should be read together with, our Terms of Service (https://bigjpg.ai/tos). ## The Short Version - Your images never reach us. Upscaling runs entirely inside your browser, on your own device. We do not receive, transmit, or store your image files at any point. - We do hold your email address if you create an account, plus basic billing records for purchases. - We do use third parties — for authentication, payments, email, hosting, analytics, and advertising — and they are all named in Section 4 below. - We show advertising via Google AdSense on most pages, which uses cookies. Details and opt-out in Section 5. - We do not sell your personal data. ## 1. Your Images Are Not Uploaded This is the most important thing in this policy, so it comes first. When you upscale an image on BigJPG.AI, the file is read and processed by your own browser using your device's computing resources. It is not sent to our servers, not sent to any third party, and not stored anywhere by us — not even temporarily. As a consequence: - We cannot see the images you process. - We cannot recover an image for you if you lose it. - We have no image data to disclose in response to a legal request, because none exists. - Processing speed depends on your device, not on our capacity. Any output file you download is written directly by your browser to your device. ## 2. What We Actually Collect ### 2.1 Account Data If you sign up, we collect and store: - Your email address. - Your authentication provider and account identifier (for example, that you signed in with Google). - Your subscription or licence status, and whether you hold a paid plan. We use this to create and secure your account, unlock paid features, and contact you about your account. ### 2.2 Billing Records When you make a purchase we store a record of the transaction — plan purchased, amount, date, and a transaction reference — for accounting, refund handling, and dispute resolution. We never receive or store your full card number, expiry date, or security code. Card details are handled entirely by our payment processors (Section 4.2). ### 2.3 Email Sign-ups If you submit your email address through a form on the Website without creating a full account, we store that address in order to reply or to send the information you asked for. ### 2.4 Usage Counter If you use the Service without signing in, we set a first-party cookie named "bigjpg_uses" in your browser to count how many free upscales you have used. This counter lives in your browser; it is not sent to our servers and is not linked to your identity. Clearing your cookies resets it. ### 2.5 Technical and Analytics Data Our hosting provider and analytics tools automatically receive standard technical information when you visit: IP address, browser type and version, device type, operating system, referring page, and the pages you view. This is used for security, to keep the site running, and to understand aggregate traffic patterns. ## 3. Why We Process Your Data, and On What Legal Basis For users in the EU, UK, and other regions with equivalent law, our legal bases are: - Performance of a contract — creating and running your account, providing paid features, processing purchases, handling refunds and cancellations. - Legitimate interests — keeping the Service secure, preventing fraud and abuse, measuring aggregate traffic, and improving the product. We balance these against your rights. - Consent — advertising and non-essential analytics cookies, and marketing emails. You can withdraw consent at any time (Section 5). - Legal obligation — retaining accounting and tax records, and responding to lawful requests. ## 4. Who We Share Data With We do not sell your personal data, and we do not share it for anyone else's independent marketing. We do rely on the following service providers, each of which processes data on our behalf or as an independent controller for their own service: ### 4.1 Authentication and Database - Supabase — stores your account record, email address, and subscription status, and handles sign-in sessions. - Google — if you choose "Continue with Google", Google authenticates you and provides us with your email address and basic profile identifier. Your use of Google sign-in is also governed by Google's privacy policy. ### 4.2 Payments - Creem - Waffo Pancake These processors handle checkout, card data, subscription billing, and refunds. They receive your email address and payment details directly from you; we receive back only the transaction record described in Section 2.2. Each operates under its own privacy policy and is PCI-DSS compliant. ### 4.3 Email - Mailgun — used to deliver transactional email such as sign-in links, receipts, and account notices. ### 4.4 Hosting and Delivery - Cloudflare — hosts and serves the Website, and provides security and DDoS protection. Cloudflare processes connection data including your IP address. ### 4.5 Analytics - pageview.app — privacy-oriented, aggregate website analytics. - Google Ads (tag ID AW-17639575584) — measures conversions from our advertising, such as which visits led to a sign-up or purchase. ### 4.6 Advertising - Google AdSense (publisher ID ca-pub-7231473958802321) — serves advertising on the Website. See Section 5. ### 4.7 Legal Disclosure We may disclose data where required by law, court order, or a binding request from a competent authority, or where necessary to establish, exercise, or defend legal claims — including in response to a payment dispute or chargeback. Note that this can never include your images, because we do not have them (Section 1). ### 4.8 Business Transfer If the Service is sold or transferred, account data may transfer with it. We will notify registered users by email before that happens. ## 5. Cookies and Advertising ### 5.1 Categories of Cookies We Use - Strictly necessary — sign-in session cookies set by Supabase, and the "bigjpg_uses" free-usage counter described in Section 2.4. The Service cannot function without these. - Analytics — set by pageview.app and Google Ads to measure traffic and advertising conversions. - Advertising — set by Google AdSense and its partners to select and measure ads, and in some regions to personalise them. ### 5.2 Advertising in Detail We display advertising through Google AdSense on the Website. Ads are not shown on our /landing pages. Google and its advertising partners may use cookies and similar technologies to serve ads based on your prior visits to this and other websites. You can control this directly: - Opt out of personalised Google advertising at https://adssettings.google.com - Opt out across participating vendors at https://optout.aboutads.info and https://www.youronlinechoices.eu - Read how Google uses data from sites that use its services at https://policies.google.com/technologies/partner-sites ### 5.3 Browser Controls You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent sign-in from working and will reset your free-usage counter. ## 6. How Long We Keep Data - Your images — not retained at all, because they are never collected (Section 1). - Account data — kept while your account is open. Following cancellation or a deletion request, retained for ninety (90) days and then deleted. The 90-day window exists so that you can recover an account deleted by mistake, and so that we can resolve any billing dispute raised shortly after departure. - Billing records — retained for as long as required by applicable tax and accounting law, and to defend payment disputes, even after your account is deleted. These records are minimised to the transaction detail in Section 2.2. - Email sign-ups — retained until you ask us to remove the address, or until it becomes clear the address is inactive. - Analytics and log data — retained in aggregate or short-lived form by the providers in Section 4.5, under their own retention schedules. ## 7. Where Your Data Is Processed We operate from Hong Kong SAR. The service providers listed in Section 4 process data in various countries, including the United States and the European Union. Where data originating in the EEA or UK is transferred outside those regions, our providers rely on Standard Contractual Clauses or an equivalent recognised transfer mechanism. ## 8. Your Rights Depending on where you live, you may have the right to: - Access the personal data we hold about you, and receive a copy. - Correct data that is inaccurate or incomplete. - Delete your account and associated data, subject to the billing-record exception in Section 6. - Restrict or object to certain processing, including processing based on legitimate interests. - Withdraw consent for advertising cookies or marketing email, at any time, without affecting processing already carried out. - Data portability — receive your data in a machine-readable format. - Lodge a complaint with your data protection authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (PCPD). If you are a California resident, you additionally have the right to know what personal information is collected and disclosed, the right to deletion, and the right not to be discriminated against for exercising these rights. We do not sell personal information as that term is defined under the CCPA/CPRA. To exercise any of these rights, email support@bigjpg.ai from your registered address. We will respond within thirty (30) days. We may need to verify your identity before acting on a request. ## 9. Security We take reasonable technical and organisational measures to protect the data we hold, including encryption in transit (HTTPS across the whole site), access controls on our administrative systems, and reliance on established providers for authentication and payment handling. The strongest security property of this Service is structural rather than procedural: because your images never leave your device, they cannot be exposed by a breach of our systems. No system is completely secure. If a breach affecting your personal data occurs, we will notify affected users and the relevant supervisory authority where the law requires it. ## 10. Children The Service is intended for users aged 18 and over, as set out in Section 1 of our Terms of Service. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@bigjpg.ai and we will delete it. ## 11. Changes to This Policy We may update this policy to reflect changes in our practices, our providers, or the law. Material changes will be notified to registered users by email and by notice on the Website at least fourteen (14) days before taking effect. The "Last Updated" date at the top of this page always reflects the current version. ## 12. Contact For any privacy question, data request, or complaint: support@bigjpg.ai Operator: Elke Hwang (sole trader), Hong Kong SAR Related documents: Terms of Service (https://bigjpg.ai/tos) · Refund Policy (https://bigjpg.ai/refund-policy) Last Updated: July 30, 2026 · BigJPG.AI · https://bigjpg.ai