Your skin isn’t
our content.
How TattooProof handles your information. Updated September 16, 2026.
Your photographs
Reference and body photos initially stay in your browser session. They are uploaded to private Cloudflare R2 storage only when you explicitly select the option to save images to your account. Photos are sent to OpenAI only when you separately consent to a relevant image request, such as design review, refinement, line-art preparation or AI placement. You can delete stored images from your account. Body photos cannot be included in comparison links.
Local and online projects
“Save on this device” stores written details in this browser’s local storage. Photos are not saved in the local draft. “Save to my account” stores written details in Cloudflare D1, with optional private image references. Account access requires your username and password. Save your recovery code: it allows a password reset without email. Passwords are stored as salted PBKDF2 hashes; recovery codes and session tokens are hashed.
OpenAI services
After your consent, language checks, concept/meaning reviews and brief translation send the supplied text to OpenAI. Concept reviews can additionally send your chosen design reference when you select that option; body photos are excluded from those reviews. Custom generation sends your written idea, style, proposed size and placement. AI placement sends your chosen design and body photo to OpenAI after a separate consent; these inputs and the resulting preview are not automatically stored in your account. OpenAI text responses are requested with storage disabled; this does not override OpenAI’s own API processing and retention policies. AI output is guidance, not human verification. Results remain in your browser unless you save them to a project.
Sessions and payments
A secure HTTP-only cookie connects you to your credit balance. Anonymous sessions last up to one year; account sign-in sessions last 30 days. Stripe processes payment details through hosted checkout and manages recurring Studio Pro billing. We store transaction references, amounts, currency and credit fulfillment status, never card numbers. Abuse controls use short-lived hashed IP/network buckets, per-account limits and global quotas. Free-trial eligibility uses a hashed network record for 30 days. Expired buckets are cleaned by a scheduled job. Network identifiers are used to prevent repeated free allocations and fraudulent rewards.
Comparison links
Creating a comparison publishes the title, description and selected design references to anyone with its unlisted link. Links expire after 30 days and can be revoked in your account. Recipients may copy or forward content. Anonymous voting uses an HTTP-only browser identifier; signed-in voting also records the voter account and a hashed network identifier for duplicate prevention and sharing-reward eligibility. Votes are informal feedback, not identity-verified research.
Personal reviews and support
When you submit a paid review, the operator sees a snapshot of the project and only the reference or body photos you explicitly include. Review notes and any delivered files are private to your account and authorized reviewers. Support messages are also shared with the operator and answered in your account.
Studio Pro and artist discovery
A studio owner receives your written project brief, contact information, budget and availability only after you choose to submit that intake. Body photos are excluded. Listed studio profiles are public after owner opt-in and moderation. Intake information remains private to the submitting client and receiving studio account.
Optional emails
When email sending is configured, the optional preparation series collects your email and selected tattoo interest. Resend sends a confirmation message; the six-message sequence starts only after you confirm. Each message includes an unsubscribe link. Unsubscribing cancels pending messages. Email addresses and consent records remain until account deletion; confirmation and unsubscribe tokens protect these actions. Tattoo photos and exact wording are not included in the series.
Optional measurement
With your consent, first-party measurement records a random browser identifier, broad event names, selected offer and sanitized campaign/source labels. It excludes photos, tattoo wording and email. Events are retained for 90 days; the business dashboard shows aggregate counts. Declining prevents measurement. You can change the choice using Privacy choices.
Export and deletion
Use account settings to export your written account data and image inventory, or permanently delete your account and stored images. Download images from your projects before deletion. Anonymous order records remain for payment reconciliation. Local drafts must be deleted separately in the studio. Copies already downloaded or shared by recipients cannot be recalled.
Hosting
Cloudflare processes requests to deliver and secure this website. Fonts are self-hosted. No advertising pixels or third-party behavioral analytics are installed.
Contact
For privacy questions or help with your data, contact the operator through private account support.