realpng

Privacy

Flower Execution Limited, a company registered in Hong Kong at Flat A, 15/F, Hiller Commercial Building, 65-67 Bonham Strand East, Sheung Wan, Hong Kong, runs realpng and is the controller of the data described here. We collect as little as the service needs to work, we delete your images and videos within two days unless you share them, and this page says exactly what happens to them.

  1. If you visit the site

    Browsing the site stores nothing about you personally. Our hosting provider logs each request, including your IP address and browser, and those logs are deleted after two weeks. We use them only to keep the site secure and working.

    PostHog, in the United States, tells us which pages and features people use, so we can see what works. It sets no cookie and stores nothing on your device, so each visit counts as a new one until you sign in. After that it ties the pages and features you use to your account id. We have it discard your IP address and location, and we do not send it your images. If your browser sends Do Not Track, it records nothing.

    If you ask for the case study, we keep your email address to send it to you, and nothing else.

    If you drop an image on the home page, your browser keeps it in its own storage while you move to the tool or sign in. It stays on your device until you run a check or an optimization.

    You can run a few checks without an account. To count them, we keep a one way hash of your IP address, or of its network for IPv6, and the checks it used in a month, until two months after that month ends. A cookie lets your browser get its own checks back. It lasts a year, or until you sign in, when your checks from the last day move into your account.

  2. If you create an account

    Sign in is run by Clerk. We keep your email address, your account role, and whether you have run your first check and your first optimization. Clerk sets cookies that keep you signed in, and the service does not work without them. We do not use advertising cookies.

  3. If you check or optimize an image

    Your image goes straight from your browser or client to private storage on Amazon Web Services in Stockholm, Sweden. Our servers read that upload once and delete it at that moment. If you give us a link instead, we fetch the image from that link.

    Checks run on our own servers. A check you run on the website keeps a private copy of the image, a small preview and its result, so a closed tab can get them back. They can be reached for a day and are deleted within two days. A check through the API or the MCP server comes back to you and is not stored. To optimize an image, we send it to a GPU server run by Modal, which re-renders it and returns the new version. Modal does not keep it. Videos are checked and optimized on our own servers and never reach Modal. Everything this section says about images applies to videos the same way.

    The optimized image is saved privately and reached only through a download link that expires. Next to it we keep a private copy of the original and a small preview, so the optimization can run and the website can show it. They can be reached for a day, and all three are deleted within two days.

    On the website we also keep the file name of each check and optimization for 24 hours, so the tool page can show your runs again after a reload.

    We keep a history of every check and optimization: when it ran, whether it came from the website, the API or the MCP server, the name of the API key that ran it, and the credits it cost. It never includes the image or its file name. You can see it on your account page, and it is deleted after 90 days.

    If you make a share link for a run, we copy its images and its result, without the file name, and anyone with the link can see them. Stopping the share deletes the copies. Otherwise the link stops working after 30 days and the copies are deleted within 31 days.

    Images can carry metadata such as camera details, location and time, as well as C2PA records and invisible watermarks. The detector reads them to report on them. The optimizer re-encodes your image and does not keep its original metadata. The optimization score on an optimized image comes from our detectors' reading of the result. We never use your images or results to train models, and we do not keep them in any dataset.

  4. If you use the API or the MCP server

    We keep a one-way hash of each API key, never the key itself. With it we keep the key's name, its first few characters so you can recognise it, the email of whoever created it, when it was created and last used, and a secret for signing webhook calls.

    We count each account's requests per minute to enforce rate limits, and those counters are deleted after two minutes. We record which account started each optimization so only that account's keys can read the result, and that record is deleted after 24 hours. If you set a webhook, we keep its address for a day and send the result there.

  5. If you buy a plan

    The purchase is handled by Polar as merchant of record. Your payment details never reach us. We see that a sale happened, which plan, its amount, the country it came from and the email it was made with.

  6. Why we keep it

    To run the service, keep it secure, fix errors, see how it is used, stop abuse, bill you and meet our legal duties. That is the whole list. We do not sell your data, we do not build profiles from it, and we do not send marketing you did not ask for.

    If you are in the EEA, the UK or Switzerland, we rely on our contract with you to run the service, on our legitimate interest in keeping it secure and free of abuse, on legal obligations for tax records, and on your consent for anything optional, which you can withdraw at any time.

  7. Who else sees it

    • Amazon Web Services, who host the site, the storage and the databases in the EU, and deliver pages from locations worldwide.
    • Modal, who run the GPU servers for image optimizations, in the United States.
    • Clerk, who run sign in, in the United States.
    • Polar, who process purchases and handle tax and receipts. Polar is responsible for the payment data it collects.
    • PostHog, who measure how the site is used.
    • Sentry, who record errors so we can fix them. An error report can include your browser, your IP address, the page you were on and your account id.

    Nobody else, apart from anyone you give a share link to. We would only share more if the law required it, or with a buyer if the business were ever sold, and this notice would still apply.

  8. Where it goes

    We are based in Hong Kong and some of our providers are in the United States. When data leaves the EEA, the UK or Switzerland, it is protected by the European Commission's Standard Contractual Clauses, or by an adequacy decision such as the EU to US Data Privacy Framework where the provider is certified.

  9. How long we keep it

    • Uploaded images are deleted as soon as we read them. An upload nobody used is deleted within two days.
    • Optimized images, the copy of the original kept with each optimization and its preview, and website checks with their previews and results, can be reached for a day and are deleted within two days. The image of a check through the API or the MCP server is never stored.
    • The file name of a check or optimization on the website is kept for 24 hours.
    • A share link stops working after 30 days, and its copies are deleted within 31 days, or as soon as you stop sharing. Closing your account does not stop a share link early.
    • Your history of checks and optimizations is kept for 90 days.
    • Server logs are deleted after two weeks.
    • A case study request is kept until we send the case study, you ask us to delete it or you close your account, and for six months at most.
    • API keys are kept until you or an administrator delete them.
    • Your account is kept while it is open and deleted within 30 days after you close it, backups included.
    • So that a closed account cannot start the free plan over, a one way hash of your email and the free credits it used in a month are kept until two months after that month ends.
    • The hash of a visitor's IP address and the checks it used in a month are kept until two months after that month ends. The cookie that names a visitor's browser lasts a year, or until they sign in.
    • What PostHog records against your account id is kept until you ask us to delete it.
    • Purchase records are kept for as long as tax and accounting rules require.

  10. Your say in it

    Ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop or limit using it, or ask for it in a portable format, and we will. One email is enough: team@flowerexecution.com. We answer within a month and may first need to confirm it is you. If we ever get this wrong you can complain to your national data protection authority.

    If you live in California, you have the right to know what we collect, to delete it, to correct it and to opt out of its sale or sharing. We do not sell or share personal information as the CCPA defines those terms, and using your rights never changes how we treat you.

  11. Keeping it safe

    Everything travels over HTTPS and is encrypted at rest. Storage is private and reached only through short-lived signed links, API keys are hashed, and images delete themselves on the schedule above. If a breach ever affects your data, we will tell you and the authorities as the law requires.

  12. Children

    The service is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.

  13. Changes

    When this notice changes, the date below changes with it. If a change matters, we will tell you by email or in the service before it takes effect.

Questions or a deletion request: team@flowerexecution.com. Last updated .