隐私说明
最后更新：2026-07-26 · 版本 2026-07-26
一句话版本：我们会抽样保存一小部分上传图片和少量请求元数据，用于评估清理效果。 不保存处理结果，不要求注册，不记录原始 IP，不使用追踪 Cookie。你可以随时在首页点 "删除我的图片"把本浏览器上传过的副本全部删掉。
1. 我们保存什么
- 上传的图片（抽样）。只有一小部分会被保存，被自动分类器判定为成人内容的 不保存。也就是说你上传的图片绝大多数根本不会落盘。
- 请求元数据（新图片才记录）：时间戳、图片尺寸与字节数、使用的清理力度、 处理耗时、会话标识、国家代码、以及 IP 的加盐哈希值。
- 会话记录：一个随机会话标识、创建时间、你同意的条款版本号。
- 浏览器本地（不会发给我们）：语言与主题偏好、会话令牌、本浏览器上传过的 图片哈希列表——最后这项只是为了让"删除我的图片"能精确工作。
2. 我们不保存什么
- 不保存处理结果。结果随时可以由原图重新算出，存它没有意义。
- 不保存原始 IP 地址。IP 经过一个只有我们持有的密钥做 HMAC 后截断存储， 用于统计和限流。没有这个密钥无法还原。
- 不要求也不收集邮箱、姓名、账号或任何注册信息。本服务没有账号体系。
- 不使用追踪 Cookie，不接入第三方分析。
3. 为什么保存图片
唯一目的是评估和改进清理模型。伪影去除的效果只能靠真实输入来衡量，而实验室 里挑的样本和用户实际上传的东西分布并不一样。抽样而不是全量保存，是因为评估需要的是 有代表性的样本而非全部——保存更多既没有额外价值，也只会扩大我们需要负责的范围。
4. 怎么保存的
保存的图片加密后存储：每张图片的加密密钥由该图片自身的内容哈希、经 HKDF 从一个 只存在于我们服务端配置中的主密钥派生而来，采用 AES-256-GCM。承担推理的 GPU 服务器 不持有主密钥，也不持有存储凭据。
诚实说明这层加密防的是什么：它防的是存储凭据泄漏或存储桶被误配置为公开。它防不住 掌握主密钥的人，也就是我们自己。
5. 保留多久
- 图片：保留到你要求删除为止，或到我们不再需要该评估集为止。
- 请求元数据：180 天后自动删除。
- 限流计数：30 天后自动删除。
6. 谁能接触到
- 我们的基础设施供应商：提供网络、计算、数据库和对象存储。
- 第三方 GPU 算力供应商：推理运行在租用的机器上。图片在处理期间存在于该机器 内存中，处理完即释放。该机器不持有归档、主密钥或存储凭据。
- 没有其他第三方。我们不出售也不共享数据。
7. 你的选择
- 删除：首页左下角的"删除我的图片"会删除本浏览器上传过的、且确实被我们 保存了的所有副本。如果你清空过浏览器数据或换了设备，请按下方地址联系我们。
- 完全不上传： 开源的本地版本在你自己的机器上运行，功能相同，不上传任何东西。如果你对图片 的隐私有任何顾虑，这是更好的选择。
8. 联系方式
contact@lumitools.cc
Privacy Notice
Last updated 2026-07-26 · version 2026-07-26
In one paragraph: we keep a small sample of uploaded images plus a little request metadata, to evaluate how well the cleanup works. We do not store results, require no account, never record raw IP addresses, and set no tracking cookies. "Delete my image" on the main page removes every copy we kept of anything this browser uploaded.
1. What we keep
- Uploaded images, sampled. Only a small proportion is kept, and anything an automated classifier reads as adult content is not. In practice the large majority of what you upload never reaches disk.
- Request metadata, for new images only: timestamp, image dimensions and byte size, the strength used, processing time, a session identifier, a country code, and a salted hash of your IP address.
- Session record: a random session identifier, when it was created, and which version of the terms you accepted.
- In your browser only, never sent to us: language and theme preference, the session token, and the list of image hashes this browser has uploaded — the last of these exists solely so that "delete my image" can work precisely.
2. What we do not keep
- Not the results. A result can be recomputed from the input at any time, so storing it would serve no purpose.
- Not raw IP addresses. Addresses are HMAC'd under a key only we hold and truncated, for counting and rate limiting. Without that key they cannot be recovered.
- No email, name, account or registration of any kind is asked for or collected. There are no accounts.
- No tracking cookies and no third-party analytics.
3. Why we keep images
One reason only: to evaluate and improve the cleanup model. How well artifact removal works can only be measured against real input, and images chosen in a lab do not have the same distribution as what people actually upload. We sample rather than keep everything because evaluation needs a representative set, not all of it — keeping more would add no value and would only enlarge what we are responsible for.
4. How they are stored
Kept images are stored encrypted: each image's key is derived by HKDF from that image's own content hash under a master secret that exists only in our server configuration, using AES-256-GCM. The GPU server that runs the inference holds neither the master secret nor any storage credential.
To be straight about what this protects against: it defends against a leaked storage credential or a bucket accidentally made public. It does not defend against whoever holds the master secret, which is us.
5. How long
- Images: until you ask for deletion, or until we no longer need the evaluation set.
- Request metadata: deleted automatically after 180 days.
- Rate-limit counters: deleted automatically after 30 days.
6. Who can reach it
- Our infrastructure provider — network, compute, database and object storage.
- A third-party GPU compute provider — inference runs on a rented machine. Images exist in that machine's memory while being processed and are released afterwards. It holds no archive, no master secret and no storage credential.
- Nobody else. We do not sell or share data.
7. Your choices
- Deletion: "Delete my image" at the bottom of the main page removes every copy we kept of anything this browser uploaded. If you have cleared browser data or changed device, use the address below.
- Upload nothing at all: the open-source local version does the same thing on your own machine and uploads nothing. If you have any concern about the privacy of your images, that is the better option.
8. Contact
contact@lumitools.cc