Understanding Privacy & Security in AI Image Generation
Uploading a photograph of your own face to an internet service is not a trivial act, and it deserves more than a reassuring sentence. This article explains what UPretty does with your data, what questions to ask any AI image service before you upload to it, and which risks no privacy policy can remove.
The four questions worth asking any AI image service
Before uploading your face anywhere, find the answers to these. If a service does not answer them in plain language somewhere public, treat that as the answer.
1. Is my uploaded photo retained after the image is generated, and for how long?
2. Are my photos or generated images used to train models?
3. How long are generated images kept, and can I delete them myself?
4. Who else can see my images — is anything public or shared by default?
Everything below is UPretty's answer to those four, followed by the parts that apply no matter which service you use.
What happens to your uploaded photo
Your photo is sent to the generation pipeline, used to produce the requested image, and not written to permanent storage. It exists for the duration of the request. There is no upload archive to browse, and no copy retained after the generation completes.
How long generated images are kept
Images you generate are held in your personal gallery for thirty days so you can come back and download them. After thirty days they are deleted automatically and permanently. This is a hard deletion, not an archive — once the retention window closes, the image cannot be recovered by you or by us. If an image matters to you, download it the day you make it.
Your gallery is private to your account. Nothing you generate is published, featured, or shown to other users by default.
Training
UPretty does not use your uploaded photos or your generated images to train AI models. This is worth stating precisely because it is the point on which services differ most, and the difference is usually buried in terms rather than stated up front.
Payment data
UPretty is free — every signed-in user gets ten generations per day at no cost — so the platform processes no payments and stores no card, bank or other financial details. There is simply no financial data to protect, which is the strongest form of protecting it.
Account security
Sign-in runs through Auth0, an established identity provider, which means UPretty never handles your Google password. Auth0 provides encrypted credential storage, brute-force protection and support for multi-factor authentication. The practical implication for you: the security of your UPretty account is the security of the Google account you sign in with, so that is where two-factor authentication is worth enabling.
Content safety
The generation pipeline applies safety filtering intended to prevent harmful, sexualised or abusive output. Themes are curated rather than open-ended, which narrows the space of what can be produced in the first place. No filter is perfect; if you encounter output that should not have been generated, reporting it through the feedback page is genuinely useful.
Your rights
You can request deletion of your account and all associated data at any time by contacting support, and the request will be processed in line with applicable data protection law. You do not need to give a reason.
The risks a privacy policy cannot remove
This part applies to every AI image service, including this one, and it is the part most articles leave out.
Your face is biometric data. A photograph of your face is not like a password you can change. If it is ever exposed, it stays exposed. That argues for uploading to few services rather than many, and for preferring services that delete uploads rather than retain them.
Generated images of you can be reused by whoever holds them. Once you download and share a generated image, it is subject to the same reality as any other image on the internet. Consider where you post it.
Other people in your photos have not consented. If you upload a picture containing a friend, a child or a stranger in the background, you have made a decision on their behalf. Crop them out before uploading.
Policies change. A service that does not train on your data today can change its terms tomorrow. Recheck the policy of any service you use regularly, and treat a change in ownership as a reason to recheck immediately.
A reasonable default posture
Use recent photos you are comfortable having in circulation. Crop out other people. Download what you want and let the rest expire. Enable two-factor authentication on the account you sign in with. And read the retention and training sections of any AI service before the first upload rather than after — they are usually two paragraphs, and they tell you most of what you need to know.