Your photos and links

Last updated: 23 October 2026

What stays on your device

Photos are resized and encrypted in your browser before upload. Original EXIF metadata is removed. The swap-link fragment is not sent with normal page requests. Account sync separately stores encrypted photo keys.

What we store

We store random room IDs, hashed access details, upload status, expiry times, and encrypted photos and previews. Free swaps need no name or email. A required browser cookie limits free use to one active swap. Its server record holds hashed browser and participant IDs, a room ID and expiry, not a full link. Another browser or cleared cookies can bypass this limit. We do not fingerprint devices or run analytics, ad trackers, or an admin photo viewer.

Link sync

When you sign in, we sync your swap details and photo keys in an encrypted account list. A server secret kept outside the database allows signed-in devices to unlock that list automatically. This protects a database leak alone, but the service can recover these keys. A compromise of the service and its secret could expose synced photos. This browser also saves wrapped swap details in IndexedDB so you can return to your active swap. Clearing site data removes the local copy.

Keep links private

Anyone with the full invite link can claim its one guest place. Your management link gives access to your swap. Browsers, clipboard apps, extensions and chat services may see links you use or share.

Deletion

Manual deletion costs 1 Credit and requires sign-in. Photos stop being available at expiry. Background cleanup removes stored encrypted files. We cannot promise instant removal from hosting backups, browser history, or copies another person saved.

Limits of encryption

Our server controls the rule that both people must upload. Encryption cannot stop fake photos, screenshots, sharing with the wrong person, a hacked device, or an operator changing this website. Hosting providers process connection details such as IP addresses. Rate limits use room IDs and shared counters, not a separate IP database.

Contact messages

The contact form sends your topic, message and reply email through our server, Formspree and Google email to a private support inbox. These messages are not end-to-end encrypted. Formspree’s free plan currently keeps a 30-day archive. Inbox copies have no automatic deletion timer and may stay while we handle your request and follow-up. Only the contact page loads Cloudflare Turnstile, which processes browser and connection details to check for spam. Do not send photos, passwords, private links or keys.

Accounts and requests

Google sign-in is optional. We store a random member ID, Google account ID, hashed login sessions and access permissions. We do not store your Google password. Signed-in sync includes encrypted photo keys. Use your management link to delete a swap. Use the contact form for other data requests. We may need safe information to check your request. We will not ask for your decryption key.

Payments and updates

Stripe processes Credit purchases and payment details. We store order references, payment status and Credit activity. We do not receive your full card number. Credits are for use within PicSwap, cannot be transferred or exchanged for cash, and do not renew automatically. For payment or refund requests, contact us. We review requests based on Credit use and applicable requirements. We do not sell photos or contact details.

Unused purchased Credits can be refunded automatically. A completely unused purchase receives a full refund; a partly used purchase receives a proportional refund for its unused Credits.

Share with permission

Only share photos you have permission to share. Do not share intimate photos without consent or use PicSwap for exploitation, harassment or illegal content.