ImageFlow Privacy Policy
For version 0.17.17 · Maintained by azureskies
1. What ImageFlow accesses
ImageFlow reads accessible image URLs, alternative sources, bounded titles, dimensions, source types and the current page URL/title when you request a scan, use the image context menu, or explicitly enable automatic scanning. Sources can include image elements, CSS backgrounds, SVG, video posters, open Shadow DOM, safe Canvas, readable Blobs and loaded image resources. Some embedded or protected content remains inaccessible. It does not read your full browsing history.
Website authorization and automatic behavior are separate. You may grant broader HTTP(S) access for manual use without activating automatic scanning. Switching off automatic mode stops automation while retaining previously approved host permissions until separately revoked. Standard deep scanning temporarily scrolls and attempts restoration; dynamic detection lasts about 15 seconds.
Only process images you are entitled to access and use. The v0.17.11 GitHub Beta adds a separate user-created saved-task workspace. In v0.17.12, users may opt to skip byte-identical source files and reconcile interrupted downloads; neither feature involves general browsing surveillance.
2. Local processing and network requests
Resizing, conversion, ZIP creation, preview, visual-similarity and pixel-detail estimation run locally, not through cloud AI or a developer image-processing service. Similarity is not semantic recognition or a guarantee of image quality. Since v0.17.14, separate opt-in anonymous usage and error stats are available. They are OFF by default and require your explicit opt-in plus Chrome permission for one dedicated Cloudflare relay endpoint; see section 5 for the exact fields, prompt wording, incognito behavior and how to turn them off. As of October 26, 2026, the relay is authorized to remain available and was verified enabled on October 26, 2026. Even after activation, no extension event is sent unless an individual user opts in and approves the dedicated Chrome host permission. No images, page URLs or saved task records are uploaded.
In v0.17.12, optional source-byte deduplication computes SHA-256 only on already-fetched, authorized original image blobs up to 24 MiB, during the user's explicit download. The comparison makes no additional network requests; larger or unverifiable files are still downloaded. Similar-looking or differently encoded images are not treated as byte-identical.
Local processing does not mean offline use. Image hosts/CDNs can receive direct requests, IP addresses, source URLs with existing query parameters and ordinary connection metadata. Conversion/download requests use credentials: omit where implemented; thumbnail elements follow normal browser cookie behavior. HTTP origins may be unencrypted. The extension does not request cookies, history or webRequest permissions. Signed URLs themselves may contain access tokens, so inspect them before sharing.
3. Storage and retention
| Information | Storage and removal |
|---|---|
| Ordinary workspace image lists, previews and pixel features | Transient panel memory, refreshed or cleared by new scans, reload or closure. Explicitly saved capture tasks below are an exception. Browser network caching is independently managed. |
| Context-menu image handoff | Temporary chrome.storage.session, removed after handoff and subject to browser session clearing. |
| Preferences | chrome.storage.local until cleared or uninstalled. No storage.sync account synchronization. |
| Local quality history (v0.17.8 Beta) | Up to 120 operation summaries within 30 days, including results, counts, version, duration and classified error codes. No source URLs, hostnames, titles, filenames, image bytes or raw errors. Local quality history is never uploaded in bulk; a separate optional consent can permit only sanitized per-operation summaries through Cloudflare to GA4. Export or clear in Quality diagnostics. The stats opt-in setting and how often the invitation was shown are also kept in chrome.storage.local. |
| Continuous Capture tasks (v0.17.11+ Beta) | Created only after explicit per-task local-storage consent. Extension-origin IndexedDB stores full source-page and HTTP(S) image URLs (possibly including signed tokens), bounded titles/dimensions/types, selections, output format and task-generated download receipts (IDs, generated filenames, expected sizes and outcomes). With optional deduplication in v0.17.12, bounded original-source SHA-256 hashes and byte lengths are also stored locally. No image bytes, cookies or passwords are stored; no task upload or cloud sync. Up to 10 tasks and 20,000 metadata records per task. Tasks expire seven days after creation and are physically deleted on the next capture-workspace opening, not by an exact-time background deletion timer. Inspect URLs and delete a task at any time. Browser storage may also be cleared or evicted; this is not a backup guarantee. |
| Website access grants | Managed by Chrome/Edge until revoked, uninstalled or changed by browser policy. |
| Downloaded files and browser-owned download history | Separate from task storage. Deleting tasks does not delete downloaded files or Chrome history. Old v0.17.6 diagnostic reports may include source hosts; v0.17.8 removes them. Inspect reports before sharing. |
4. Permissions and controls
The six required permissions remain activeTab, scripting, sidePanel, contextMenus, storage and downloads. HTTP(S) host access is optional, not a permanent install-time grant. Permission denial does not prevent processing already authorized sources. ImageFlow does not bypass authentication, paywalls, licensing, Chrome internal pages or cross-origin restrictions.
Switching off automatic mode stops automation while preserving website access for manual use. Use Manage settings and the separate Revoke All-Sites Access control to revoke broad grants; individual hosts may require separate revocation in chrome://extensions or edge://extensions. This public website cannot control installed-extension grants or downloaded files.
Continuous Capture: Create a task, then explicitly start a batch or continuous collection. Work is pinned to the chosen source document; scroll or load more images yourself. No automatic scrolling, cross-site crawler or capture after the workspace closes. Incognito source tabs cannot create persistent tasks. Restoring a task does not start scanning, downloading or image requests. Thumbnails default off and contact original hosts only when enabled. Downloads require a separate click and cover selected unfinished items across all task pages, not just the visible page. Output format locks once a download receipt exists.
In v0.17.12, a duplicate copy is only persistently skipped after the canonical ZIP is confirmed by Chrome. If its receipt is missing, unknown or the file is no longer present, dependent skipped items become pending rather than being silently lost. The user may explicitly retry or choose to retain all identical files. Nothing automatically deletes previously downloaded files.
Recovery checks Chrome download history only for task-generated receipts. Matching extension ownership, native download ID (or a conservatively matched generated basename when the ID was lost), completion, existence signal and expected byte size are required to mark completion. Missing history, removed files and unknown outcomes are distinguished. Unknown retries require confirmation and may duplicate an existing file. Chrome metadata is not a permanent disk-presence or cryptographic-integrity guarantee. Expired source URLs may not be recoverable.
5. Optional anonymous usage and error stats (since v0.17.14; as of v0.17.17)
This setting is OFF by default and requires your explicit opt-in. Nothing is sent on a new install or until you turn it on. There are only two ways to turn it on, and both show the disclosure before you click:
- The switch at the bottom of the side panel (visible in Simple and Advanced mode, never pre-checked): "Share anonymous usage and error stats (opt-in)", with the description "Off by default. When on, operation types, outcomes, count and duration ranges, and the extension version go via Cloudflare to Google Analytics. No images, URLs, filenames, or user or device IDs, and nothing from incognito windows. Turn it off anytime; local features are unaffected."
- A one-time invitation card in Simple mode (only while stats are off): "Share anonymous usage and error stats to help us improve. No URLs or images.", with "Only operation types, outcomes, count and duration ranges, and the extension version are sent, via Cloudflare to Google Analytics. Off by default; turn it off anytime at the bottom of the panel." and the buttons "Turn on" and "No thanks". It appears after your first completed download, or when a download or scan fails; a permission you declined or a cancellation does not count as a failure. After "No thanks" it never appears on its own again; if you choose neither, it can appear once more later (at most two showings in total). The failure version also offers "Report this issue", which sends one anonymous event for that failure; if stats are off, the same click first runs the opt-in above, and nothing is sent if you decline.
Chrome permission prompt: turning it on requests only one site permission, imageflow-ga4-relay.akin624side731.workers.dev, inside your click. The switch and the card both warn beforehand: "When you turn it on, Chrome may ask to “Read and change your data on imageflow-ga4-relay.akin624side731.workers.dev” (usually only the first time). That only lets ImageFlow send stats to this stats server; it does not read the sites you visit." If you deny it, stats stay off and nothing is sent. The origin is used only to send stats (POST /collect) and is covered by the existing optional host permission, so no install-time permission is added.
Fields sent (at most one event when a scan, dynamic scan, visual grouping, preview or download/export finishes; the field set is fixed and the relay rejects anything else):
| Field | Content |
|---|---|
operation | Operation type: scan, dynamic_scan, visual, preview, export |
result | Outcome: success, partial, failure, cancelled, empty |
mode, format | (Optional) scan mode normal/deep/dynamic/automatic/manual; output format original/png/jpeg/webp |
code | (Optional) an error category from a fixed list, such as NETWORK, DECODE, FORMAT, SCAN_TIMEOUT; never the raw error text |
attempted, succeeded, found | Counts, bucketed inside the extension (capped at 350 first); only the lower bound is sent: 0 → 0, 1 → 1, 2–5 → 2, 6–20 → 6, 21–100 → 21, 101 or more → 101 |
durationMs | Duration, bucketed inside the extension (capped at 120000 ms first): 0–999 ms → 0, 1–4.999 s → 1000, 5–14.999 s → 5000, 15–59.999 s → 15000, 60–119.999 s → 60000, 120 s or more → 120000 |
downloaded | Whether a file finished downloading (true/false) |
version | Extension version, for example 0.17.17 |
No exact number leaves the browser. The relay converts the values to range labels (for example 21_100, 1_4s) for GA4. We do not send image bytes, source/image URLs, domains, filenames, page titles, raw errors, cookies, account identities, stable device/user identifiers or your local quality history.
Relay and GA4: Processing route: ImageFlow → Cloudflare Worker → Google Analytics 4 (GA4). The purpose is aggregate feature counts and error/reliability improvements, not advertising or user-level tracking. The relay creates a new random client_id and a current-time session_id for every event, so events are not linked to a user, and it always sets the ad consent fields (ad_user_data, ad_personalization) to DENIED. User retention, DAU/MAU and cross-operation funnels are therefore not reliable.
IP address: the relay code uses the connection IP (CF-Connecting-IP) only as the key for Cloudflare rate limiting (one per-IP and one global limit) while handling that request. The relay code does not store or log the IP and does not forward it to GA4 (the request to GA4 comes from the relay server, and the event contains no IP of yours). Cloudflare and Google, as service providers, may still process ordinary connection metadata and service logs under their own policies. See Cloudflare Privacy Policy and Google Privacy Policy.
Incognito: nothing done in an incognito window is sent, stats cannot be turned on there, and the invitation card is never shown there. ImageFlow has no incognito manifest key, so Chrome runs one shared background; the side panel therefore attaches its own window ID to every event, and right before each send the background checks it with chrome.windows.get (plus chrome.tabs.get when the tab is known). It sends only when the window is positively a normal window; an incognito or closed window, a missing ID or any lookup error means nothing is sent.
Limits: the extension sends at most 40 events per hour with at most 6 waiting, and never retries persistently. The relay is also rate-limited and may pause collection for maintenance or safety. "Relay accepted" (HTTP 204) in the side panel only means the relay received the event, not that GA4 recorded it or shows it immediately.
How to turn it off: you can opt out at any time: uncheck the switch at the bottom of the side panel at any time. Unsent events are dropped and any in-flight request is aborted. The same click also removes Chrome's permission for the stats server origin (only that origin; other sites and "Allow all sites" are untouched, and if "Allow all sites" is on it still covers that host, but nothing is sent because stats are off). Turning it back on requests the origin again inside that click; Chrome may grant it again without showing the prompt. Revoking "Allow all sites" in ImageFlow does not turn stats off and keeps the stats server permission; if a change in Chrome's settings removes that permission, stats pause and the panel shows "Turn back on". Removing the extension also removes the setting.
As of October 26, 2026, the relay has been verified enabled server-side. Relay activation is separate from your consent: deploying or updating the relay never turns stats on for anyone. Only users who opt in and grant the dedicated Chrome host permission send stats; the relay is authorized to remain available.
6. Purpose and sharing
Information is used only for the disclosed user-facing image workflow, not advertising, data brokerage, credit decisions or sale. Direct source-host requests are not uploads to the developer. Google API information is handled under the Chrome Web Store User Data Policy, including Limited Use.
If you contact support, your submitted email is processed by the email service to answer and investigate the issue. Do not submit passwords, cookies, access tokens or unnecessary private images.
7. Contact and changes
Maintainer: azureskies (AmpCub). Contact akin624side731@gmail.com for support or privacy questions.
Local quality history was disclosed October 21, 2026. The October 23, 2026 updates disclose v0.17.11 Continuous Capture and v0.17.12 optional SHA-256 source-byte deduplication and recovery behaviors in GitHub Beta. A GitHub Beta does not imply a Chrome Web Store update; use the actual installed version to determine available features. The October 25, 2026 update describes default-off opt-in v0.17.14 Beta operation statistics, Cloudflare/GA4 destinations and activation gates. The October 29, 2026 update applies this policy to v0.17.17 and later and details the stats consent, prompt wording, fields and buckets, incognito behavior, IP use for rate limiting only, and how to turn stats off; for the Chrome Web Store, use your actually installed version. Material processing changes will be reflected in the public policy and Store disclosures.