Photo Processing

1. You must sign in and select an owned project.
2. The browser performs basic file checks. The backend records explicit versioned consent before issuing a short-lived private upload capability.
3. The backend downloads the uploaded object, validates its real image format and dimensions, removes metadata by re-encoding it, stores a sanitized JPEG, and removes the original upload object.
4. If external AI processing is enabled, the sanitized image and a server-controlled style instruction are sent to the configured OpenAI image endpoint.
5. Validated outputs are stored privately in Supabase Storage and returned through short-lived owner-checked links.

The record stores the authenticated user and project, consent-document identifier photo-processing-consent-v1, this notice identifier photo-processing-notice-v1.0.0, privacy identifier privacy-policy-v1.1.0, processing purpose, timestamp, locale, AI-provider involvement, whether the subject is identified as a child, guardian confirmation, and withdrawal state. Checkboxes are not preselected.

Supabase stores the private source and output objects. OpenAI receives the sanitized photo and instruction only when the external image provider is enabled. The application does not intentionally place photo bytes or signed storage URLs in analytics or exported logs. Site analytics providers still receive ordinary technical/usage data from pages where their scripts load.

Incomplete uploads are cleanup-eligible after 24 hours by default; child-subject successful source and output assets after 30 days by default; rejected uploads immediately; failed-generation assets after seven days; and storage orphans after a 24-hour grace period. Successful source and completed output assets do not yet have a fixed automatic expiry and remain until deletion or withdrawal applies. Cleanup is queued and retried, so storage deletion may take time.

Withdrawing consent marks the record withdrawn, stops future related processing, cancels queued descendant generations, tombstones associated upload and output rows, and queues applicable source and output objects for deletion. Withdrawal does not undo processing already completed or erase records that must remain for integrity, security, or legal reasons.

You must separately assert guardian authority. RangToonz does not infer authority from account age. Do not upload the image if you cannot make the assertion truthfully. The current product does not independently verify guardianship; acceptance criteria and verification requirements remain subject to qualified legal review.

Read the versioned Privacy Policy for account data, analytics, observability, security, international-access limitations, and the proposed contact channel.