Legal
Open FantasticFrameOpen app
Contents
  1. 1. Overview
  2. 2. Data Controller
  3. 3. What Data We Process and How
  4. 4. Purposes and Legal Basis
  5. 5. Data Transfers and Third Parties
  6. 6. Data Retention
  7. 7. Your Rights (GDPR)
  8. 8. Children’s Privacy
  9. 9. Changes to This Policy
  10. 10. Contact Us

FantasticFrame Privacy Policy

Effective date: 2026-10-30

1. Overview

FantasticFrame is an online tool for adding borders and EXIF information to photos. This policy explains how we handle your photos and related information when you use the service.

Core principle: Your photos are processed in your browser, for single and batch export alike, and are not uploaded. Only if your browser cannot render an image itself does that one photo go to our server as a fallback, where it stays in memory for the duration of the request and is then discarded. We do not store, sell, or use your photos for any other purpose. If you choose to show a photo’s location, only its approximate position (rounded to about 1 km) is used to look up the city name, as described in Section 3.2.

2. Data Controller

  • Operator: itzdrli
  • Contact: me@itzdrli.cc
  • Server location: Germany, European Union

3. What Data We Process and How

3.1 Photo Files

  • After upload: photos are held in your browser’s memory only, used for preview and editing. They are not uploaded.
  • Single and batch export: rendered in your browser via WebAssembly (WASM), in a background worker. For batch export the images are packaged into a ZIP file in your browser as well. Photos never leave your device.
  • Fallback rendering: if your browser cannot render an image (for example WASM is unavailable or the device runs out of memory), that photo, together with your border and EXIF settings, is sent to our server over HTTPS and rendered there. The server works in memory only and discards the photo as soon as the response has been sent; photos are never written to disk, never stored in a database, and no copies are retained. Photos larger than 25MB or 80 megapixels are rejected by the server.

3.2 EXIF Metadata

EXIF data (camera make/model, shooting parameters, capture time, GPS, etc.) is read locally in your browser. It leaves your device only together with the photo in the fallback rendering case described above, and is handled exactly like the photo — with the one exception below.

Location lookup: the “Location” caption field can show the city a photo was taken in. Only when you use this field on a photo that contains GPS data (by enabling the field in the caption, or by clicking “Use the GPS location”) does your browser send that photo’s GPS position to our server, rounded to two decimal places (roughly 1 km) — the exact spot is never sent. Our server forwards these rounded coordinates to the OpenStreetMap Nominatim service (see Section 5) and returns the place name, e.g. “Kyoto, Japan”. Your IP address, the photo and its other EXIF data are not passed on. If you never use the Location field, no coordinates leave your device. You can also type a place name yourself; that text stays in your browser.

3.3 Information We Do Not Collect

  • No accounts: we do not collect names, email addresses, phone numbers, or any identity information;
  • No cookies, no ads, no third-party tracking or analytics scripts.

3.3.1 Preferences stored in your browser

Your chosen theme and language are saved in your browser’s local storage so they are remembered on your next visit. This stays on your device and is never sent to us; you can clear it at any time in your browser settings.

3.4 Server Logs

The server only records request paths, timestamps, and status codes for troubleshooting and security monitoring. Logs do not contain photo content, EXIF data, or request bodies.

To protect the fallback rendering and location lookup endpoints from abuse, the server keeps a request counter per IP address in memory for up to one minute. It is not written to disk or logs and is not used for anything else.

Location lookups are not logged with their coordinates. To avoid asking Nominatim twice for the same area, the server keeps a cache in memory that maps rounded coordinates to place names (at most 5,000 entries, cleared whenever the server restarts). The cache is not linked to an IP address or any other information about who asked.

  • Purpose: to provide the photo border/EXIF framing and export service — the service you requested — including the location lookup when you ask for it.
  • Legal basis: Article 6(1)(b) GDPR (performance of a contract or steps taken at the data subject’s request) — photos are processed solely on your instructions; server logs are processed under Article 6(1)(f) (legitimate interest: security and stability of the service).

5. Data Transfers and Third Parties

  • Fonts and other assets are self-hosted. All fonts, scripts and styles are served from our own server; your browser does not contact Google Fonts or any other third-party font, analytics or emoji service when you use the site.
  • Content Delivery Network (CDN): only static assets (JavaScript, CSS, fonts, etc.) are distributed through CDN edge nodes for faster loading. All API requests (including fallback photo uploads) bypass the CDN cache; photos never enter the CDN cache.
  • OpenStreetMap Nominatim (operated by the OpenStreetMap Foundation, United Kingdom): receives the rounded coordinates of a location lookup (Section 3.2) from our server, so it sees our server’s IP address, not yours. The United Kingdom benefits from an EU adequacy decision (Art. 45 GDPR). See the OSMF Privacy Policy. Place names © OpenStreetMap contributors (ODbL).
  • Apart from the above, we do not share your data with any third party and do not transfer it outside the European Union.
  • All data transfers are encrypted with TLS/HTTPS.

6. Data Retention

  • Photos in browser memory: disappear when you close or refresh the page;
  • Photos sent for fallback rendering: held in server memory only while the request is processed, then discarded;
  • Location lookups: rounded coordinates and place names are cached in server memory (not linked to you) until the server restarts or the entry is displaced, and never written to disk;
  • Theme and language preferences: stay in your browser’s local storage until you clear them;
  • We retain no copies of your photos.

7. Your Rights (GDPR)

You have the right to request access to, rectification, erasure, restriction of processing, data portability, and to object to the processing of your personal data. Because this service does not store any of your personal data, erasure requests are automatically satisfied — we have no copies to keep. To exercise your rights or if you have any questions, contact us via Section 2. You also have the right to lodge a complaint with your local or the server-location data protection supervisory authority.

8. Children’s Privacy

This service is not directed at children under the age of 16 (or the lower applicable age in your jurisdiction), and we do not knowingly collect personal data from children.

9. Changes to This Policy

If we make material changes to this policy, we will publish an updated version at legal.itzdrli.cc and update the “Effective date” at the top of this page.

10. Contact Us

  • Email: me@itzdrli.cc
  • Last updated: 2026-10-30 (October 30th of 2026)