Privacy policy
This policy explains what we collect (the photos and inputs you provide while using a tool — no name, email, or account), what we do with them (improve our own tools, and only that), which third-party AI providers process your inputs in the request loop, how advertising works on our site (contextual only, no behavioral targeting), and the rights California residents have under the CCPA/CPRA.
Information we collect
We do not require an account, login, or signup to use our tools. We don't ask for your name, email address, or phone number. The only data we hold about you is the photos and inputs you provide while using a tool, which we keep tied to an anonymous session ID rather than to you. Standard server-side request metadata (your IP address, user agent, and request timestamp) is processed for rate-limiting and abuse prevention. Rate-limit counters keyed to your IP expire automatically within 25 hours and are not used for any other purpose.
When you use a tool, your inputs (photos, descriptions, condition selections, and damage notes) are uploaded to secure storage on Cloudflare and bound to a randomly generated, anonymous session ID. That session is not linked to you in any way — there is no account, no email, and no identifier that could connect the data back to a specific person. Your active session expires automatically one hour after your last action.
How we handle your uploads
Before any photo leaves your browser, it is normalized in the browser itself: HEIC files are converted to a standard format and oversized images are resized down. Only the normalized version is uploaded. Those files are then stored on Cloudflare R2 under a session-scoped path. Item identification is sent to Google Gemini (with a Google Lens fallback for hard cases); the listing draft is generated by OpenAI. The result is returned to your browser.
The posture for everything you upload, plainly:
Stored 6 months, inputs and outputs, only to improve accuracy — then deleted. Never sold. Never shared with anyone beyond the AI providers needed to run the tool — and they never get your name, email, or location, because we never asked for it.
During that window the deletion is automatic, enforced by a Cloudflare R2 lifecycle rule. Because there is no account or identifier connecting your inputs to you, retained data is not linked to a person.
Cookies & tracking technologies
icandothat.ai itself does not use cookies for tracking or analytics. Google, our advertising partner, may set cookies for the basic mechanics of showing an ad — frequency capping, fraud prevention, and counting impressions. Because every ad request from this site carries Google's Restricted Data Processing signal (see Third-party advertising below), those cookies are not used to build an advertising profile of you or to pick ads based on your prior visits to this site or others. Choosing "Reject" on the cookie banner denies the ad cookies as well; the tools work the same either way.
To understand how often ad blockers stop our ads from loading — which directly affects whether we can keep these tools free — we run one small, first-party measurement of our own. A couple of seconds after a page loads, we record whether our ad scripts loaded or were blocked, along with a coarse device type (mobile or desktop), a broad browser family, and a page category. That is the entire record. It sets no cookies, uses no identifiers, and is never tied to you or to a session — the entries cannot be connected back to a person, and your IP address is not stored with them. It changes nothing about your visit: the site works exactly the same whether or not you block ads.
Third-party advertising
We use Google AdSense and Google's Interactive Media Ads (IMA) SDK to display advertisements on our site. We have enabled Restricted Data Processing in Google AdSense for every ad request, from every visitor, not only where the law requires it. This means Google serves only non-personalized, contextual ads on this site — matched to the topic of the page you are reading — and does not use visitor data for behavioral ad targeting or build advertising profiles based on activity here. In the terms of California law, we do not sell or share your personal information with Google for cross-context behavioral advertising.
Google still processes the ad request itself (the page URL, your IP address, and your browser's user agent) to pick a contextual ad, count the impression, and prevent fraud, under its own policies. You can read how Google handles that data at Google's Privacy & Terms, and manage your Google-wide advertising settings at Google Ads Settings. Neither is required to get contextual-only ads here; that is the default for everyone.
AI-powered analysis
Our tools use third-party AI services, split by task. The data handed to each provider is limited to what that provider needs for its step.
- Google Gemini — Item identification (figuring out what your photo shows). Receives the photos you upload plus the condition and damage notes you enter. See Google's privacy policy.
- SerpAPI (Google Lens) — Image-search fallback used when Gemini's confidence is low. We send only your first uploaded photo to SerpAPI's reverse-image-search API to look for matching products on the open web. SerpAPI receives only that single image's bytes; no other photos, no condition notes, no account info (we don't have one to send). See SerpAPI's privacy policy.
- OpenAI — Listing-draft generation (the title and description text). Receives the identified item details and your condition notes; does not receive your raw photos. See OpenAI's privacy policy.
None of these requests include your name, email, or any account identifier — because we don't collect those in the first place. Each provider processes your data according to its own privacy policy linked above.
Your California privacy rights (CCPA/CPRA)
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below. Because we run no accounts and hold nothing that identifies you, most of them are satisfied by design — but they are yours, and here is how each one works on this site.
- Right to know. What we collect, why, and who receives it is set out in full on this page: the photos and inputs you provide, the request metadata used for rate limiting, and the AI providers that process each step.
- Right to delete. You can ask us to delete personal information we hold about you. We hold no information tied to a person, and the anonymous inputs from a session are deleted automatically within six months. If you tell us which session to remove sooner, we will.
- Right to correct. You can ask us to correct inaccurate personal information. Because nothing we store is linked to an identity, there is no record of you to correct; the inputs you provided can be deleted on request instead.
- Right to opt out of sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Every ad request already carries the Restricted Data Processing signal described above, so there is nothing to opt out of — the opt-out state is the only state. If your browser sends the Global Privacy Control signal, Google receives it directly with the ad request and applies the same restriction on its side. This site also acts on that signal itself: if your browser sends it, the cookie banner does not appear and the ad cookies are denied, the same as choosing "Reject" on the banner.
- Right to limit use of sensitive personal information. We do not collect sensitive personal information.
- Right to non-discrimination. Exercising any of these rights never changes what you can use here. There is no account to restrict, no paid tier to withhold, and the tools work the same for everyone.
To exercise any of these rights, email info@icandothat.ai with "California privacy request" in the subject line. We respond within 45 days. Because we hold nothing that identifies you, we will not ask you to prove who you are; if your request concerns a specific session, include the approximate date and what you uploaded so we can find it.
Children's privacy
Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children. Since we do not collect personal information from any users, this applies broadly to all visitors.
Related policies
For more information about how our site operates, please also review our Disclosures page, which covers advertising, affiliate relationships, AI-generated content, and accuracy disclaimers. Our Terms of Service govern your use of the site.
Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
Contact
If you have any questions about this Privacy Policy, please contact us at info@icandothat.ai.