Your skin isn’t
our content.

How TattooProof handles your information. Updated September 16, 2026.

Your photographs

Reference and body photos initially stay in your browser session. They are uploaded to private Cloudflare R2 storage only when you explicitly select the option to save images to your account. Photos are sent to OpenAI only when you separately consent to a relevant image request, such as design review, refinement, line-art preparation or AI placement. You can delete stored images from your account. Body photos cannot be included in comparison links.

Local and online projects

“Save on this device” stores written details in this browser’s local storage. Photos are not saved in the local draft. “Save to my account” stores written details in Cloudflare D1, with optional private image references. Account access requires your username and password. Save your recovery code: it allows a password reset without email. Passwords are stored as salted PBKDF2 hashes; recovery codes and session tokens are hashed.

OpenAI services

After your consent, language checks, concept/meaning reviews and brief translation send the supplied text to OpenAI. Concept reviews can additionally send your chosen design reference when you select that option; body photos are excluded from those reviews. Custom generation sends your written idea, style, proposed size and placement. AI placement sends your chosen design and body photo to OpenAI after a separate consent; these inputs and the resulting preview are not automatically stored in your account. OpenAI text responses are requested with storage disabled; this does not override OpenAI’s own API processing and retention policies. AI output is guidance, not human verification. Results remain in your browser unless you save them to a project.

Sessions and payments

A secure HTTP-only cookie connects you to your credit balance. Anonymous sessions last up to one year; account sign-in sessions last 30 days of inactivity and are extended automatically while you keep using the site, so an active account stays signed in. The sign-in cookie is kept for up to 90 days so that it can be renewed. Stripe processes payment details through hosted checkout and manages recurring Studio Pro billing. We store transaction references, amounts, currency and credit fulfilment status, never card numbers. Abuse controls use short-lived hashed IP/network buckets, per-account limits and global quotas. Free-trial eligibility uses a hashed network record for 30 days. Expired buckets are cleaned by a scheduled job. Network identifiers are used to prevent repeated free allocations and fraudulent rewards.

Comparison links

Creating a comparison publishes the title, description and selected design references to anyone with its unlisted link. Links expire after 30 days and can be revoked in your account. Recipients may copy or forward content. Anonymous voting uses an HTTP-only browser identifier; signed-in voting also records the voter account and a hashed network identifier for duplicate prevention and sharing-reward eligibility. Votes are informal feedback, not identity-verified research.

Personal reviews and support

When you submit a paid review, the operator sees a snapshot of the project and only the reference or body photos you explicitly include. Review notes and any delivered files are private to your account and authorised reviewers. Support messages are also shared with the operator and answered in your account.

Studio Pro and artist discovery

A studio owner receives your written project brief, contact information, budget and availability only after you choose to submit that intake. Body photos are excluded. Listed studio profiles are public after owner opt-in and moderation. Intake information remains private to the submitting client and receiving studio account.

Optional emails

When email sending is configured, the optional preparation series collects your email and selected tattoo interest. Resend sends a confirmation message; the six-message sequence starts only after you confirm. Each message includes an unsubscribe link. Unsubscribing cancels pending messages. Email addresses and consent records remain until account deletion; confirmation and unsubscribe tokens protect these actions. Tattoo photos and exact wording are not included in the series.

Optional measurement

With your consent, first-party measurement records a random browser identifier, broad event names, selected offer and sanitized campaign/source labels. It excludes photos, tattoo wording and email. Events are retained for 90 days; the business dashboard shows aggregate counts. Declining prevents measurement. You can change the choice using Privacy choices.

Optional session recordings

If you allow first-party measurement, we also keep a private recording of how the public pages are used, so the operator can see what helps or blocks people: page views, clicks, pointer movement, scroll depth, load timings, browser errors, and a masked copy of the page as it appeared. Field contents are never recorded — we store only that a field was focused and roughly how long the answer was. Password, payment and hidden fields are excluded entirely, and text inside any element marked as private is replaced with dots. Signed-in workspaces are never recorded: the studio, account, checkout, support, reviewer, business and monitor pages are all excluded, and recording stops the moment you open one. Recordings are held for 30 days and then deleted automatically. Declining first-party measurement prevents both measurement and recording, and you can withdraw at any time using Privacy choices.

Optional Google Ads measurement

Google’s tag (AW-18459061495) loads on every page with measurement switched off. Until you give your separate permission it writes no cookies, collects no advertising data and sends no page view or purchase event; Google receives only a cookieless signal that measurement is denied. We load it this way so Google can confirm the tag is installed. With your separate permission the tag measures visits from advertising. Google may receive browser and device information, your IP address, ad-click identifiers and a limited page address, and may set advertising measurement cookies. We strip query parameters from page events and replace private workspace URLs with a generic address. We do not include tattoo wording, uploaded images, email addresses or account credentials in these events. Personalised advertising, Google Analytics and enhanced conversions are disabled. After Stripe confirms a purchase, we send its actual paid amount, currency and a pseudonymous transaction identifier to Google if you allow Google measurement. The identifier prevents duplicate counting. We do not send your Stripe checkout reference, card details or customer identity. Initial subscription purchases are measured; automatic monthly renewals are not browser conversions.

Google measurement is off by default. Earlier permission for first-party measurement does not grant permission for Google. Use Privacy choices to allow or withdraw it independently. Withdrawing stops Google measurement and removes Google measurement cookies accessible to this site; it does not erase information already received by Google. Google processes data under its Privacy Policy, including processing outside your country. Read how Google uses information from partner sites.

Export and deletion

Use account settings to export your written account data and image inventory, or permanently delete your account and stored images. Download images from your projects before deletion. Anonymous order records remain for payment reconciliation. Local drafts must be deleted separately in the studio. Copies already downloaded or shared by recipients cannot be recalled.

Hosting

Cloudflare processes requests to deliver and secure this website. Fonts are self-hosted. Google Ads measurement is optional and loads only after separate advertising consent. No Google Analytics property is installed.

Contact

For privacy questions or help with your data, contact the operator through private account support.