Privacy Policy
Last updated: February 2026
1. Introduction
KoalaPic ("we", "us", "our") operates koalapic.com and associated Telegram and Discord bots. This policy explains what data we collect, how we use it, and your rights.
2. What We Collect
- Images you upload: Stored temporarily for conversion only. Automatically deleted after 1 hour. We do not view, analyze, copy, or use your images for any purpose other than the conversion you requested.
- Conversion metadata: We log the input format, output format, file size, and timestamp of each conversion for aggregate statistics and service monitoring. This data contains no personally identifiable information.
- Bot interactions: When you use our Telegram or Discord bots, we receive your platform user ID and username as provided by the platform. We store this only to track your conversion count and preferences. We do not access your messages, contacts, or any other platform data.
- API usage: If you use our API, requests are logged with your API key (hashed) for rate limiting and abuse prevention. Request content (your images) is not logged.
- Web analytics: We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. We collect no cookies for advertising or tracking purposes.
3. What We Don't Collect
- We don't require accounts, emails, or personal information to use the web converter
- We don't use cookies for tracking (only essential cookies for CSRF protection)
- We don't run ads or share data with advertisers
- We don't train AI models on your images
- We don't fingerprint your browser
4. How We Use Your Data
- To perform the image conversion you requested
- To maintain aggregate service statistics (total conversions, format popularity, error rates)
- To monitor and improve service reliability
- To prevent abuse of the API
5. Data Retention
We retain your personal data only as long as necessary for the purposes described in this policy. Here are our specific retention periods:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Uploaded images | 1 hour | Automatic cleanup |
| Converted images | 1 hour | Automatic cleanup |
| Anonymous conversion metadata | 30 days | Legitimate interest (service improvement) |
| Authenticated conversion metadata | 1 year | Legitimate interest (user history) |
| User accounts | Active + 2 years inactive | Contractual necessity |
| API usage logs | 90 days | Legitimate interest (rate limiting) |
| Webhook delivery logs | 7 days | Legitimate interest (debugging) |
| Feedback submissions | 90 days | Legitimate interest (product improvement) |
| Error logs | 30 days | Legitimate interest (service reliability) |
| Cookie consent records | 3 years | Legal obligation (GDPR Art. 7(1)) |
| Aggregated statistics | 2 years | Legitimate interest (business analytics) |
When retention periods expire, data is permanently deleted through automated processes. You can request deletion of your data at any time through your dashboard settings or by contacting us.
Inactive accounts receive an email warning 30 days before scheduled deletion. Logging in cancels the deletion.
6. Your Rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access: Request what data we hold about you
- Deletion: Request deletion of your data
- Portability: Receive your data in a standard format
- Objection: Object to processing of your data
Since we collect minimal personal data and don't require accounts, most of these are automatically satisfied. For bot users, contact us to request data deletion.
Account Deletion
You can delete your account at any time from your account settings or via the DELETE /api/v1/account API endpoint.
When you delete your account:
- Your email address, login credentials, and account are permanently removed
- All API keys are immediately revoked and will stop working
- Conversion records are anonymized — the link between your account and conversion metadata (file sizes, formats, timestamps) is permanently severed. Anonymized metadata is retained for aggregate analytics
- A confirmation email is sent to your address as proof of deletion
- This action is immediate and irreversible. There is no grace period or recovery option
Cookies & Local Storage
KoalaPic uses essential cookies (CSRF, session) and local storage (dark mode, consent preferences) for core functionality. Optional functional storage (custom presets) and analytics storage require your consent. You can manage your preferences at any time using the consent banner or the footer's "Cookie Settings" link. For a full list of cookies and storage items, see our Cookie & Storage Policy.
Consent Records
When you make a cookie consent choice, we record your selection server-side to comply with GDPR Article 7(1). This record includes: the categories you accepted or rejected, the date and time, your IP address, and the consent banner version. These records are retained for 3 years and included in data export requests. They are anonymized (not deleted) if you delete your account, as they serve as legal evidence of consent.
7. Data Security
- All connections use HTTPS/TLS encryption
- Images are processed in sandboxed environments
- Files are stored temporarily on encrypted storage
- No staff member has routine access to user-uploaded files
Data Processing Agreement
If you use KoalaPic as a data processor under GDPR, our Data Processing Agreement details the technical and organizational measures we implement, sub-processor information, and breach notification procedures.
8. Third-Party Services
- Telegram Bot API: subject to Telegram's privacy policy
- Discord API: subject to Discord's privacy policy
- We do not share your data with any other third parties
9. Children's Privacy
KoalaPic does not knowingly collect data from children under 13. The service is a general-purpose image converter with no age-restricted content.
10. Changes to This Policy
We may update this policy. Material changes will be announced on the website. Continued use after changes constitutes acceptance.
11. Contact
For privacy inquiries: privacy@koalapic.com