layersmith

Privacy Policy

Last updated October 14, 2026

Layersmith is built so that for most of what it does, the honest answer to "what do you do with my images?" is nothing, because we never receive them. Where that is not true — where a tool really does send your picture to a server — the tool says so before you press it, and this policy names every one of them. Nothing is ever sent in the background.

Images

Local features — opening an image, AI grab, wand/lasso/brush selection, cutting one thing onto its own layer, subject separation on its in-browser engine, edge cleanup, shadow scaffold, manual colour separation, and every export (PSD, ORA, PNG) — run entirely in your browser. Your image is never transmitted to us or anyone else for any of them.

Remove background has two engines, and you choose which one runs. The chooser sits directly under the button and remembers your answer on this device. Sharper — the one selected unless you change it — sends your image to our server, which has the background removed by an external AI provider, Replicate (see below), and sends the result back. In your browser runs a model on your own machine and sends nothing at all. Both are free, neither needs an account, and the card shown after every run names the engine that produced it.

Automatic Split processes your image on our servers. When you press the one-credit Split button, a downscaled working copy is sent to our servers for object detection and photo-or-artwork routing. To identify objects and text when you split an image into layers, we send the image to Google's Gemini model through Cloudflare Workers AI. Google acts as our sub-processor for this image analysis only. Detection is one request. A second request sends the same image again, together with the boxes already found, so Gemini can read the words on each text line, the font, and any shadow. Cloudflare's DETR model also returns boxes that we keep. A photograph may then receive one box-guided precision pass through Replicate (SAM 3), for photographs and confirmed digital artwork alike. If Gemini does not answer, Replicate (Grounding DINO) names the objects, with Cloudflare's Moondream model as the fallback; on confirmed digital artwork, if Gemini did not answer, Grounding DINO runs beside Cloudflare's Kimi model, which reads the artwork. On a computer, a weak or missing mask can fall back to a model in your browser. On a phone — a mobile browser, a small screen, or a device with very little memory — detection, masks and fills all run on our servers. The in-browser models are not loaded. If you leave the tab, the work waits until the page is on screen again and a dropped mask is asked again. A mask that still fails is left empty rather than cut on the device. We do not write that working copy to our storage. Replicate's API policy removes prediction inputs, outputs, files, and logs automatically after one hour (their retention documentation). Manual editing stays in your browser. The file you export is assembled there too; checking a layered .psd allowance is the only part of export that contacts us, and that check sends no image.

Two things hold whichever tools you use. There are exactly two ways an image of yours can ever be stored by us, and you have to press a button for both. If a job goes wrong you may press “Didn’t work? Send us this image”, which uploads that one image so we can diagnose it. And when we ask you to rate how a job went, that card offers to keep the result as well — off unless you open the panel, read what it would send, and tick the box; if you ignore it, close it, or dismiss the card, nothing is uploaded. Either way what you send is deleted within 24 hours. And metadata (EXIF, including GPS) is discarded during import, because the image is re-encoded through a canvas.

Server AI features are opt-in, clearly labelled with what they cost, and only run when you click them. Most are metered in credits; Remove background's Sharper engine is free and unmetered, and is the only free feature that sends your image anywhere. When you use any of them, the relevant pixels are sent over HTTPS to our servers, processed, and returned — and not retained at all beyond processing. The only images that rest on our servers are the ones you deliberately send us — with the “send us this image” button, or by ticking the box on the rating card — and those are deleted automatically within 24 hours by a storage lifecycle rule. We never use your images to train AI models, and we never share them with third parties for their own purposes.

Server-processed images, in detail

When you use a single-image server feature (background removal on the Sharper engine, subject separation, occlusion fill, object detection, or automatic splitting), the pixels are streamed to server AI, processed, and streamed back — we store no copy, our logs contain no image content, and the pixels are processed transiently and never used to train models.

One detail about background removal in particular, because it is the busiest of these and the only free one. First, Cloudflare's Moondream model on our own infrastructure decides whether the picture is a photograph or artwork. The cutting-out is then done by one BiRefNet model (BiRefNet for photographs, ToonOut for artwork) running on Replicate, an external AI provider that processes the image for inference only and automatically removes API prediction data after one hour. The same prediction also cleans the colours of the soft edge. If Replicate is unavailable, or its model takes more than about a minute and a half to start (we tell you when that happens), the subject cut-out is done instead by Cloudflare Images, our own infrastructure provider. We never write your image to our storage, and the reply we send back carries Cache-Control: private, no-store, so neither your browser nor any shared cache keeps a copy of the cut-out. When the Cloudflare fallback runs, Cloudflare bills these transformations once per calendar month per unique image, which means that if you run the same picture twice in one month their own processing cache may answer the second time without redoing the work. If you would rather that never happen, the In your browser engine is one click away under the Remove background button and sends nothing.

Images you deliberately send us are the one place images rest on our servers. If you press “Didn’t work? Send us this image”, the before-and-after pair is held in storage with an automatic lifecycle rule that deletes it within 24 hours, and is used only to work out why the tool failed. Batch processing, which previously uploaded whole folders, was withdrawn in August 2026 and no longer exists.

The rating card can send a result too, and only if you tick the box. After an export we may ask once how the job went. You can answer that with a score and a note and send nothing else; the rating never depends on the file. The card also carries an optional panel which, when you open it, shows you the two pictures it would send — the image as it was before the last tool ran, and the result on screen — each shrunk to 1600px on the long edge. Sending them requires you to open that panel and tick a box that is never ticked for you. Ignoring the panel, closing it, or dismissing the card all send nothing.

If you send a report or tick it, the two pictures go to the same storage and are covered by the same rule: deleted automatically within 24 hours, used only to test and improve the tools, never used to train AI models and never shared. Alongside them we keep your score when present, your note, and a short set of facts about the job — which tool ran, what our own telemetry recorded as the outcome, which file format you exported, which background-removal engine was selected, the pixel dimensions, layer and candidate counts, applied processing limits, stage timings, text-recognition outcome, and the per-tab analytics id described under Analytics. Those facts and your note are text, not pictures, and they stay in our records after the images themselves are deleted — they are what lets us re-run and score a case later. They contain no file name and no part of the image.

Some paid tools send your image off your device

The in-browser tools never upload anything on their own (see above — the one exception is the “send us this image” button, which only acts when you press it). Two kinds of tool do send image data off your device, and each only when you press it: the paid, credit-metered ones, and Remove background on its Sharper engine, which is free. Most run on our own infrastructure (Cloudflare) — subject detection, routing, the standard fill, and text scanning. Object detection sends the image to Google's Gemini model through Cloudflare Workers AI, once to find the objects and again, with those boxes, to read text, font and shadow. Background removal, the object-naming step when Gemini does not answer, and one precision mask batch in automatic splitting use Replicate, as listed below.

A few opt-in tools, each labelled on the button (with its credit cost where it has one), additionally send image data to an external AI provider, because no model we run in-house matches their quality yet:

We call every provider through their API — inference only, to run the model on your image. We never train any model on your images, and we don't permit our providers to either. Replicate, OpenAI and Pruna AI process for inference and delete their copies per their policies (the OpenAI fallback retains data up to 30 days, for abuse monitoring only). Our own 24-hour rule still applies to everything on our side. If you'd rather nothing leave your device, stick to the in-browser tools, switch Remove background to its In your browser engine, and use the standard (non-HD) fill. On a phone, Split into layers cannot stay on the device: its detection, masks and fills are processed on our servers.

Illegal content

Child sexual abuse material (CSAM) and any content that sexualizes minors are prohibited — see our Terms. We want to be precise about how that is enforced today: we do not currently run automated hash-matching against CSAM databases on images processed by our servers. Automated hash-checking at upload is planned, and this policy will be updated to describe it once it is actually in place. Until then, enforcement is report- and review-driven: we act where we become aware of apparent CSAM, whether through a report, a notice from a payment or infrastructure provider, or our own investigation of an account. Abuse investigation is the only purpose for which a server-processed image may be examined by a person.

Where we identify apparent CSAM we report it to the appropriate authorities — the Canadian Centre for Child Protection (Cybertip.ca) and/or the National Center for Missing & Exploited Children — as the law requires, together with associated account information, and we preserve related evidence for law enforcement. The legal basis is our legal obligation and the overriding public interest in child safety.

Account data

If you create an account we store: your email address, session records, your credit ledger (grants and usage), and per-job metadata (counts and timestamps — not image content). Payment details are handled by Stripe; we never see your card number. Purchases are sold through Link, a Stripe company, acting as merchant of record, so Link receives the billing details you enter at checkout — including the name and billing address it needs to calculate tax — and sends your receipt. We receive the fact of the purchase and your credit balance, not your payment details. Their handling is described in Stripe's privacy policy.

Cookies

We set exactly one cookie: rl_session, an HttpOnly authentication cookie that keeps you signed in for up to 30 days. No advertising cookies and no cross-site tracking. The one other thing we store on your device is the per-tab analytics id described under Analytics — sessionStorage, not a cookie, gone when the tab closes.

Analytics

For product analytics we use INSG, a cookieless, privacy-first tool we build ourselves. It sets no cookies, uses no client-side storage, stores no IP addresses, and records only aggregate behavioural signals (scroll depth, clicks, performance) — never your image content. It is served from our own subdomain, stats.layersmith.app, so the analytics request never leaves our domain. It runs on every page, the editor included. What it measures there is the page — which screen you opened, what you clicked, how fast it loaded — and never the picture you are working on: your image is not read, not sampled, and not sent by it. The editor's images still leave your browser only when you press a control that says so.

We also record our own product usage: which page you opened, which tool you pressed, whether a job finished, and how long it took. No image, no pixels, no file names. When you use Split into layers, that also includes a coarse visual classification such as photograph, poster, comic or document; text and object density as none, low, medium or high; and the classifier’s confidence. We do not keep the model’s prose, any words read from the picture, or any object labels. This is how we learn which splitting method works for each kind of image instead of treating every picture alike.

To avoid analysing the exact same bytes repeatedly, we keep that coarse classification for up to 30 days under a one-way content fingerprint. The fingerprint is used only to find an identical input again; it is not the image, cannot recreate the image, and is not used to connect different pictures or people. The uploaded pixels themselves remain transient and are not stored.

To make those events readable as one visit rather than a pile of unconnected counts, each browser tab is given a random id, stored in that tab's sessionStorage. It is not a cookie, it is never sent anywhere but to us, and it is derived from nothing about you or your device — it is a random number. Closing the tab ends it permanently; open the site again tomorrow and you are a new, unrelated visit to us. We cannot use it to recognise you, to follow you across sites, or to build a profile, and we do not try to.

While a job is actually running we give that job a second random id, so the events it produces can be read as one job rather than as scattered counts. This one is not stored anywhere at all — it is held in the page's memory for as long as the job takes, it is discarded the moment the job ends, and a reload starts from nothing. It is shorter-lived than the per-tab id above and, like it, a random number derived from nothing about you or your device.

We also record which site sent you here — but only its domain name, such as google.com, never the full address of the page you came from, which could carry someone else's search terms or identifiers. If you arrive from a link we published with campaign tags on it (utm_source and similar), we keep those three tags too. That is the whole of it: a domain and, at most, three short labels we wrote ourselves. It is recorded once when your tab first reaches us, it is discarded when the tab closes along with the id above, and it tells us which of our efforts actually bring people here.

Two other requests do leave our domain on marketing pages, and neither touches your images: Google Fonts serves a webfont, and Cloudflare — who host this site — receive a page-view beacon from their own analytics. Both see the ordinary information any web request carries, such as your IP address and the page URL.

Emails

We send sign-in links and receipts, and — if you opt in — occasional product updates you can opt out of with one click. Transactional email is delivered via Resend.

Your rights

We operate from British Columbia, Canada, and handle personal information in accordance with PIPEDA and BC PIPA. If you're in the EU/UK, the practices above are our GDPR posture too: data minimisation by architecture, no profiling, no automated decision-making about you.

Contact

Privacy questions: contact us. We aim to respond within 7 days.