Privacy policy

Last updated: October 12, 2026

Graviton is an image compression and conversion tool at www.gravitonimages.com, run by Răileanu Emanuel-Alin PFA. It is built so that your images stay on your device. This policy explains exactly what we collect, why, and the choices you have.

1. Who we are

Graviton is run by Răileanu Emanuel-Alin PFA, a sole trader registered in Romania (“Graviton”, “we”). We are the controller of the personal data described in this policy: we decide why and how it is used.

• Operator: Răileanu Emanuel-Alin Persoană Fizică Autorizată
• Registered office: Bd. Bucureștii Noi nr. 136, parter, ap. 5, Sector 1, București, Romania
• Trade Register number: F2025037722000
• Fiscal code (CUI): 52621558, not registered for VAT
• Email: support@gravitonimages.com

2. Your images

Your images are never uploaded. Graviton compresses, converts, crops and resizes images inside your web browser, using encoders that run as WebAssembly on your own device. Neither the images nor their file names are sent to us or to anyone else. You can check this yourself: open your browser’s developer tools, go to the Network tab and compress an image. No request contains it.

Nothing is sent to us while you compress, convert or preview images. When you download an image, the browser sends us only a one-way SHA-256 fingerprint of the file, which cannot be turned back into the image. It is used to approve the download and, on the Free plan, count it against your daily limit, then discarded. File names, sizes and formats are not sent.

Graviton keeps no fingerprints, no records of your images and no lifetime statistics. On the Free plan, the only thing we store is one counter per account per UTC day, how many images were downloaded that day, deleted within 48 hours. On the Pro plan, downloads are not counted, so we store nothing at all. Your browser keeps a download pass for each image you downloaded on this device until midnight UTC, so downloading the same image again that day, on the same device and in any format or size, doesn’t count again. By default, every image you download is saved without its location, camera and other metadata, unless you choose to keep some of it; HDR photos keep the brightness data HDR screens need. We never use images or fingerprints for training, advertising or any purpose other than counting and approving your downloads.

3. Information we collect

Account information

You can compress and preview images without an account; you need a free account to download them. Our authentication provider, Clerk, collects your email address, name and profile picture, either from the sign-up form or from the provider you sign in with (for example Google or GitHub).

Usage information

• your plan (Free or Pro), held by Clerk with your account;
• on the Free plan only, one number per account per UTC day: how many images were downloaded that day, deleted within 48 hours. It holds no images, files or fingerprints. Pro has no limit, so not even this number exists.

Payment information

If you subscribe to Pro, payment is handled by Clerk Billing and its payment processor, Stripe. We do not see or store your card details.

Automatically collected information

Vercel Analytics and Speed Insights collect anonymous, aggregated data such as page views, referrers, general region and page performance. It cannot be used to identify you.

4. How we use information

We use personal data only for these purposes, each with its legal basis under the GDPR:

• Your account and downloads: approving downloads, counting them against the Free plan’s daily limit and showing how many are left. Basis: our contract with you (Art. 6(1)(b)).
• Pro subscriptions: taking payments and managing your plan. Basis: our contract with you (Art. 6(1)(b)), and Romanian tax and accounting law for keeping payment records (Art. 6(1)(c)).
• Support: replying to your emails. Basis: our contract with you if you have an account, otherwise our legitimate interest in answering you (Art. 6(1)(f)).
• Statistics and security: anonymous visit statistics and keeping the service secure. Basis: our legitimate interest in running a reliable website (Art. 6(1)(f)). You can object at any time; see section 9.

You need an email address to create an account, and an account to download images. Without one you can still compress and preview them. We make no decisions about you by automated means alone, and we don’t profile you.

We do not sell, rent or share personal information with advertisers or data brokers, and we don’t run targeted ads.

5. Storage on your device

• Theme preference: your choice of light or dark theme is kept in your browser’s local storage.
• Images while you sign up: if you click Download before signing in, Graviton keeps your images in your browser’s own storage (IndexedDB) while you create an account, so they are ready when you return. They are removed as soon as you come back, are never sent to us, and are ignored after 30 minutes.
• Download passes: your browser keeps a pass for each image you downloaded on this device until midnight UTC, so downloading the same image again that day, on the same device and in any format or size, doesn’t count again. A pass holds only the image’s fingerprint and its expiry, signed by Graviton; it contains no image and is deleted from your browser once it expires.
• Metadata choice: which metadata you choose to keep, such as the date taken, is remembered in your browser’s local storage and never sent to us.
• Space saved: the usage meter’s running total of how much space you’ve saved is counted on your device, in local storage, and never sent to us.
• Session cookies: Clerk sets cookies that keep you signed in. They are required to use an account.

We don’t use advertising cookies, tracking pixels, remarketing tags or cross-site tracking.

6. Where your data is stored

Using Graviton never sends your images to any of these services.

• Clerk (United States): authentication, user management and billing (privacy policy).
• Stripe (United States): card payments for Pro subscriptions, through Clerk Billing (privacy policy).
• Convex (United States): the database that stores only the daily download count of each Free account, with no settings or email (privacy policy).
• Vercel (United States): hosting, served from data centres worldwide, and anonymous analytics (privacy policy).
• Hetzner (Germany): hosts our own mail server, which keeps the emails you send to support (privacy policy).

Clerk, Stripe, Convex and Vercel are based in the United States, and Graviton’s database at Convex is stored there. When they receive personal data from the European Economic Area, the UK or Switzerland, they protect it with the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework, as their data processing terms set out.

7. Data retention

• Images: never received, so never retained.
• Fingerprints sent when you download: never stored.
• Daily download count: on Free, one counter per account per UTC day, deleted within 48 hours, or as soon as you delete your account. On Pro, none is kept.
• Account and plan: kept by Clerk while your account exists. Deleting your account deletes them.
• Payment records: for Pro, kept by Stripe and by us for as long as Romanian tax and accounting law requires, even after you delete your account.

8. Data security

• All traffic is encrypted with HTTPS/TLS.
• Authentication is handled by Clerk, a SOC 2 compliant provider.
• Because images never leave your device and no image records are stored, there is nothing about your images that could be exposed in a breach.
• The Free plan’s daily download count is kept in Convex, and database access goes through Convex’s authentication layer.

No system is perfectly secure, but keeping images on your device removes the largest risk entirely.

9. Your rights (GDPR & CCPA)

Under GDPR (European Economic Area)

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data, or delete your account yourself.
• Restriction: ask us to limit how we use your data.
• Portability: request your data in a machine-readable format.
• Objection: object to the processing of your personal data.

Under CCPA (California)

• Right to know: what personal information we collect and how it is used.
• Right to delete: your personal information.
• Right to opt out: we don’t sell personal information, so there is nothing to opt out of.
• Right to non-discrimination: we will not treat you differently for exercising your rights.

To exercise any of these rights, email support@gravitonimages.com. We reply within 30 days. In the European Economic Area and the UK, you can also complain to your local data protection authority. Ours is Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

10. Children’s privacy

Graviton is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, email support@gravitonimages.com and we will delete it.

11. Changes to this policy

When we change this policy, we update the date at the top of this page. Using Graviton after a change means you accept the updated policy.