Privacy

Your photos

The photos you pick or take are read and framed in your browser. They are never sent to a server of ours: we have none.

If you save a sheet, its photos are re-encoded on your device (so hidden data such as location doesn’t survive) and stored in your browser’s storage (IndexedDB), encrypted with a key created on your device that can’t be extracted. Delete them any time from the sheet list or with “Delete everything” in Settings.

The JPG, PDF and backup files are files you download or share yourself. The backup file is not encrypted: keep it somewhere private.

Copy cat doesn’t recognise faces or build any biometric data: you frame the photo yourself with on-screen guides. The optional plain background uses a model that only outlines the person in the photo, on your device; it doesn’t identify anyone and keeps nothing.

Google Drive sync (optional)

If you turn it on in Settings, the app saves an encrypted copy of your sheets and their photos in your own Google Drive, in a hidden folder only this app can see (Google’s drive.appdata permission: it can’t see any of your other files). It is compressed and encrypted on your device (AES-256) with a random sync key before it leaves, so Google stores only unreadable data; without the key nobody can open it, not even Google or us. Each device keeps the key encrypted like your data.

To add another device, the app shows the key as a QR code and a recovery code. The QR opens the app with the key in the part of the address after “#”, which browsers never send to any server; the app reads it on arrival, keeps it only for that browser tab until you connect, and removes it from the address bar.

Google gives the app a short-lived access token (one hour) that stays in your browser’s memory; we never receive it. Your browser’s local storage notes, unencrypted, whether Drive is connected and when it last synced. Disconnect any time in Settings, and delete the Drive copy in Google Drive → Settings → Manage apps.

This app’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The app uses Drive only to store and read back your own encrypted copy: no ads, no AI training and no sharing with anyone.

Your choices

The app remembers your country, document and paper in your browser’s local storage, so they are ready next time. They never leave your device.

Hosting

Cloudflare hosts the site. Like any web host it processes your IP address and technical details of each request to deliver the pages and protect them from attacks (https://www.cloudflare.com/privacypolicy/). It doesn’t see your photos: the app sends it nothing.

Visit statistics

We use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

Advertising

The site may show Google AdSense ads, which use cookies or identifiers to serve and measure ads and, if you allow it, to personalise them. Google asks for your consent where the law requires it; change your choice any time with “Privacy and cookies” at the bottom of the page. Ads never see your photos. More at https://policies.google.com/technologies/ads.

Your rights

We don’t keep your data, so there is nothing for us to look up, correct or delete: you control it all in your browser, and “Delete everything” in Settings removes it. Questions: write to us through nubuza.com. The site is run by nubuza.