Privacy policy.

The short version: passport, visa and ID photo editing is local and needs no account. The AI headshot studio is the only feature that sends a photo to a server; it requires a Google sign-in, sends one compressed portrait only when you press “Create my headshot”, and ID Photo Box does not keep the image.

1. Local document photo tools

When you use the passport, visa or ID photo editor, the image is read directly by your browser. Cropping, face detection, background cleanup, colour adjustments and print-sheet layout all happen on your device. No image data is sent to ID Photo Box or to a third party.

Two vision models — a face detector and a portrait cutout — are downloaded to your browser the first time they are needed and cached on your device. Those downloads are requests for model files, not uploads of your photo. You can use the editor without the cutout by framing the photo manually and keeping its original background.

2. AI headshots

If you choose to create an AI headshot, your browser rotates, resizes and compresses the portrait, re-encodes it as a JPEG and strips embedded metadata such as EXIF. The prepared image (at most 1024 pixels on its long edge), plus a locally prepared close-up crop of the same face, are sent through our Cloudflare Worker to Cloudflare’s AI models — currently Google Nano Banana 2.1 through Cloudflare AI Gateway — for a single edit. To make the identity close-up, your browser may download a small local face-detection model and cache it on your device; the crop itself is created locally. A headless copy of the selected template, with its head, face and hair removed, is also sent to guide body pose, clothing, background and lighting. No template face or hair is sent.

The Worker holds the style prompt, the headless template reference and the model credentials. It does not write your uploaded portrait, face crop or generated image to a database, object store or log. The result is returned to your browser as image data. Cloudflare processes the request as the infrastructure and model provider. The underlying models are provided by Google, OpenAI and Black Forest Labs depending on the configured model; their privacy terms may also apply to that processing.

Do not upload a photo of someone else unless you have permission. Do not use the AI studio to impersonate a real person, create deceptive identity documents or produce unlawful content.

3. Accounts and sign-in

The document photo tools do not require an account. To use the AI headshot studio you sign in with Google. Google returns your account identifier, verified email address, name and optional profile picture; we store those in Cloudflare D1 so we can show your credit balance and keep your purchases together. ID Photo Box never receives your Google password.

Sign-in uses a signed, HttpOnly session cookie that lasts up to 30 days. Signing out clears it. We do not sell accounts or use Google data for advertising.

AI credits require an account because they are a paid balance. One successful headshot uses ten credits. If a generation fails, the credits are returned automatically. Credits are not free on signup and do not reset monthly.

4. Payments, purchases and advertising

AI credit packs are one-time purchases. Checkout, payment processing, tax and invoices are handled by Creem as merchant of record. ID Photo Box does not receive or store card details. We store a purchase record with the Creem order id, the email on the account, the product id and the number of credits granted and remaining.

The Worker and Creem may use a short-window rate limiter to stop automated abuse. The account database stores the credit balance, not your photo. No advertising networks, tracking pixels or session-recording tools run on this site. Cloudflare may add its privacy-first Web Analytics beacon to page views; it counts visits without cookies, cross-site profiles or access to photos or account data. Your browser may keep a theme preference and cached vision models on your device.

5. Email and support

If you email support, we receive the address and the contents of your message. We use them to answer you and keep a record only as long as needed for support. Do not attach a passport or ID photo to a support email unless we specifically ask for it.

6. Children

ID Photo Box is intended for adults applying for documents or creating professional profiles. It is not directed at children under 13. The AI studio is not designed for use with photos of children.

7. Your choices

• Use the document tools without any network request for face detection by framing manually.
• Clear the theme preference through your browser’s site-data controls.
• Use only the document tools if you do not want an account or a portrait sent to Cloudflare.
• Sign out from the account menu at any time.
• Email support@idphotobox.com to ask for a copy of your account data or for account deletion. Purchase records may be retained where required for tax and accounting.

8. Changes

If this policy changes, the updated date at the top of this page will change. Material changes that affect how photos are handled will be described here before they take effect.

9. Contact

ID Photo Box · support@idphotobox.com
Website: www.idphotobox.com