Your photos stay yours.

Effective 12 October 2026. NoAITag is operated by VOLARIA AI S.A. (Volaria AI), Poland. For privacy or account assistance, contact w44@volaria.ai.

Accounts and photos

We require a Google sign-in or an email confirmation code to use the free cleaner. We store your verified email, display name, account creation date, language, consent choices and last account activity to provide and secure your account. We do not upload or store your photos, filenames, image metadata or cleaning reports. Cleaning runs on your device.

Optional marketing

We send AI-product offers only if you separately opt in. Registration is not marketing consent. You can withdraw this consent in your account without losing access to free cleaning. NoAITag does not sell the customer list.

Optional analytics

With your permission, we use Vercel Web Analytics and our own product events to understand page visits, sign-in attempts, successful or failed cleaning and downloads. Our database stores event type, language, number of files and a random session identifier, associated with your account when signed in. We never include email in Vercel analytics, photos, filenames, arbitrary clicks, form values, Google tokens or session replays. Declining analytics does not block the service. Do Not Track is respected.

Providers and safeguards

Vercel hosts the site. Neon hosts accounts and the database in Frankfurt and delivers email confirmation codes through its authentication service. Google handles Google sign-in; we request basic identity only, not Gmail inbox access. Essential first-party session cookies are required for sign-in. Analytics preferences are stored locally. Some providers may process data outside the EEA under their contractual safeguards.

Your choices and retention

Account data is held while your account is active. You can download your account data, change consent or request account deletion in the account panel. On deletion, identity records are removed and product events are irreversibly unlinked; aggregate statistics may remain. Verification codes expire after 15 minutes. Operational rate-limit identifiers are one-way hashes, not raw IP addresses. Hosting and authentication providers may retain their own security logs under their policies. You may request access, correction, deletion or object to processing, and complain to your data-protection authority.

Required account processing is for providing the service and securing it. Optional marketing and product analytics rely on your consent.