ShinobiToolsFree · No trace All tools →

Privacy Policy

Last updated: 29 September 2026

The short version

You upload a photo, the tool strips its metadata, you download the clean copy. Your upload is deleted the moment processing finishes, and the cleaned copy is deleted from the server within 45 minutes. We don't have accounts, we don't build advertising profiles, and we never look at, share, sell or train anything on your photos. The one exception: if you choose to send us a file yourself, we keep it for at most 30 days and one person on our team looks at it. Even then it is never shared or used for training (see below).

What we process

  • Your photo: held in temporary storage only as long as needed to clean it. The upload is removed immediately after processing; the cleaned copy is wiped within 45 minutes. The metadata that was found is shown to you once and is not stored. Uploads and results are never included in our backups.
  • Basic technical data: IP address and standard request headers, used for rate-limiting, security and counting visits. For the counts we keep a hash of your IP address, not the address itself, and delete them after 60 days. Not linked to your photos, not used for profiling.
  • Screenshots from “Report a problem”: if you use the feedback button, the box to include a screenshot of the page is ticked by default, and you can untick it. A screenshot can show whatever was on your screen, so it is deleted after 30 days.
  • If you tick “Also send my file and the result” in that window: the file you chose and the result of your job are stored for 30 days and used only to reproduce and fix the problem you reported. They are not shared, not included in our backups, and you can ask for earlier deletion at info@shinobitools.com. Basis: fixing the problem you reported (Art. 6(1)(f) GDPR); the box is ticked by default and you can untick it.

To count returning visitors and understand how the tools are used over time, we set one first-party cookie with a random number. The number is not derived from your IP address or your device, and the cookie lasts 13 months. We store it only in a scrambled form that we cannot link back to the cookie without a secret kept on our own server. It is used for our own statistics only, never shared and never used for advertising or any other purpose. We do not set it if your browser sends Do Not Track or Global Privacy Control. You can stop it at any time by clearing your cookies or with the opt-out button below. Data of individual visitors is deleted after 13 months; aggregated counts without any identifier are kept. Nothing changes in the short daily code made from your IP address that we use for our other usage counts: those counts are still deleted after 60 days.

To protect the service, if one address sends many rejected uploads in a short time (20 files over the size or format limit within an hour), we block uploads from that address for 24 hours. For this we keep a scrambled form of the address (a different code from the daily one, because the block must outlast the day) for at most 24 hours, and it is never used for anything else.

Files you choose to send us

Next to a result, you can click “Share these 2 files” to help us find mistakes our tests don’t catch. This is entirely optional and off by default.

  • What we ask for: the one file you uploaded and the result we gave you, and nothing else: only the part we need: up to 30 seconds of audio, one page of a PDF, or an image with the location data (EXIF/GPS) removed.
  • Faces: a separate checkbox, off by default, where you confirm the file shows faces and everyone in it agreed, with no children in it. Without it, faces are blurred or the file is refused.
  • Why: to find mistakes our automatic tests don’t catch, and turn real ones into new test cases.
  • Legal basis: your explicit consent (Art. 6(1)(a) and, for special-category data such as faces, Art. 9(2)(a) GDPR). For other people who may appear in your file, our legitimate interest with strict minimisation (Art. 6(1)(f) GDPR).
  • How long: at most 30 days, then it is deleted automatically.
  • Withdraw any time: you get a one-time code on screen. Enter it whenever you like and we delete the pair, its label and the consent record immediately: as easy as giving it.
  • Who sees it: one person on our team, and nothing else. A local AI model only adds a label for the kind of mistake, never a description of a person, and it never leaves our own computer.
  • What we never do: we never store your IP address, filename or email with it; never train or fine-tune any model on it; never share it with anyone else, publish it, or offer it through the API; and never use it to identify or score anyone.

What we never do

  • No accounts and no tracking of who uploaded what, apart from the random statistics number described above. We only have an email address if you chose to leave one for a discount code or pass codes. See Email list below.
  • No sharing or selling of your photos or their metadata, and no storing them longer than described above.
  • No use of your files to train AI models.

Email list

You can leave your email address to get a code that takes 10% off a Pro pass. If you also tick the box under it, we email you when there is a pass code or a new tool. Those are the only reasons we ask for it. The tools work without it: nothing here needs an account, and nothing is hidden behind giving us your address.

We store the address, when you signed up, which site you signed up on, the IP address you used, and the exact sentence that was shown next to the box when you ticked it. That last part is the proof that you asked for this, which is what the law expects us to keep. There is no separate confirmation click. Every email has a one-click unsubscribe link that deletes the address, so if someone else entered yours, one click removes it. The 10% code sets one cookie (shinobi_korting) for 48 hours, only so the checkout knows the discount applies.

The emails themselves are delivered by Resend (Resend, Inc.), which sees the address in order to deliver the message and nothing else. We keep your address until you unsubscribe.

Every email has an unsubscribe link that works in one click, without logging in. Use it and your address comes off the list at once: all that stays behind on the list is a one-way hash, so we can show that we honoured it. Copies of emails we already sent you are not yet deleted automatically; email us and we delete them. We never sell, rent or share the list, and we don't use it to follow you around the web.

Advertising

When ads are shown here, third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on those visits. You can opt out of personalised advertising in Google’s Ads Settings, and opt out of some other vendors’ advertising cookies at www.aboutads.info.

ShinobiTools is free and intended to be kept running by advertising (Google AdSense). Google and its partners may use cookies or similar technologies to show and measure ads; where required, consent is requested through Google's certified consent tools before any such cookies are set. See how Google uses information from partner sites. You can manage ad personalisation at adssettings.google.com.

The sister tools

Pages on this site describe and link to our sister tools (PicReviver, BGNinja, StemGrab, PassportNinja, ScribeGrab, VideoBGNinja, ScanReviver). Each of those sites runs on the same house rules but has its own privacy policy: check the policy on the site you actually upload to.

Your responsibility

Only upload photos you have the right to process. Removing metadata from a file does not change who owns it or what you may do with it.

Who we are, why we process data, and for how long

Who we are. ShinobiTools, registered with the KvK (Dutch Chamber of Commerce) under number 42147182. Contact: info@shinobitools.com.

  • Cleaning your photo, because you ask us to. Legal basis: performing the service you request (Art. 6(1)(b) GDPR). Your upload is deleted as soon as processing finishes, and the cleaned copy 45 minutes later, with or without a pass. You can also delete it yourself straight away.
  • Files from the Discord toolkit or a mini-tool on our tool pages are processed by the sister tool that does the work (for example StemGrab or PicReviver), for the same reason and on the same legal basis. That tool deletes the upload after processing and the result after 45 minutes, or after 24 hours on StemGrab and ScribeGrab if you have a pass.
  • Rate limits, security and usage counts (pages viewed, tools used, where visitors came from). Legal basis: our legitimate interest in keeping the site working and safe (Art. 6(1)(f) GDPR). We keep a hash of your IP address, not the address itself, and delete the counts after 60 days.
  • The contact form: your name, email address and message, so we can answer you. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Kept for at most 180 days.
  • “Report a problem”: your message, your email address if you give one and, if you leave the box ticked, a screenshot of the page. The box is ticked by default and you can untick it. We use this to see the problem and fix it. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Screenshots are deleted after 30 days. To sort reports, an AI model from Anthropic (Claude) reads the text of your message, but not the screenshot or your email address.
  • The email list and monthly pass (only if you sign up). Legal basis: your consent (Art. 6(1)(a) GDPR). We keep your address until you unsubscribe; see Email list.
  • Advertising and measurement cookies (Google AdSense, and Microsoft Clarity, which shows us how pages are used). Legal basis: your consent, asked through the cookie banner (Art. 6(1)(a) GDPR).
  • Google Fonts: the typeface used on this site is loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com) as a page opens, so Google receives your IP address and browser details with that request. We use it to show the pages in the intended typeface. See Google's privacy policy.
  • Stripe: if you buy a pass, you pay on Stripe's own checkout page, not ours. Your card details go to Stripe under its privacy policy, and we never see them. We receive confirmation that the order was paid, its order number and the e-mail address you entered.

Where it runs. On computers we operate ourselves. Some heavy jobs run on another of our own computers rather than on the web server. The connection to this site runs through Cloudflare, which passes the traffic on to us.

Backups. Uploads and results are never included in our backups.

Your rights. You can ask to see, correct or delete your data, object to processing based on legitimate interest, and withdraw your consent at any time: email info@shinobitools.com. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the supervisory authority in your own country.

Contact

Questions about this policy: info@shinobitools.com or use the contact form.