Privacy

Last updated October 6, 2026.

This page says what Collagic keeps, where it lives, and what each choice you make sends and to whom. Each choice has two sides, so each one is listed with what you gain and what you give up. If something here is unclear, that is our mistake. Tell us.

The short version

Your pictures are yours. We do not sell them, share them, show them to anyone else, or use them to train anything.
You choose where they live: only on your computer, in your Collagic cloud library, or both.
The website sets one cookie to keep you signed in, only after you sign in. If you sign in with Google, Microsoft or Apple it also sets a second one for up to ten minutes while that sign-in is under way. The birth-year question before sign-in sets a small cookie of its own (see Cookies, exactly). No advertising cookies and no analytics cookies.
Nothing leaves your computer for the public web or the cloud unless a choice below says so and you made it.

What each choice affords

Defaults are the most private option that still works. You can change any of these in Settings, Privacy, in the Mac app, and on your Account page on the web. Each one shows the same four lines there: what you gain, what you give up, what it costs, and what leaves your device.

Choice	What you gain	What you give up	What leaves your device
Keep everything on this computer (Private mode)	Nothing about your library is sent to us. Works offline.	No web wall, no phone, no sync with your browser saves.	Nothing about your library. Signing in is the only contact with us.
Cloud library	Your pictures from any browser, phone or computer, in one place.	Copies are stored on our servers (Cloudflare). They count toward your storage cap.	The pictures you save to the cloud, with their source and rights notes.
The Mac mirrors the cloud	Everything you saved on the web is on your Mac, searchable and usable offline.	Disk space on your Mac. "Originals when I use them" saves space but needs a connection to open a picture.	Nothing leaves. Pictures come down to you.
Send Mac pictures to the cloud (none, chosen, all)	Nothing leaves your computer unless you choose it. None is the default. Ones you choose, or All, put those pictures on the web and your phone.	Cloud space: the full picture counts against your cap, a small copy far less. All puts the most data online. Marking each picture is the work of choosing.	None: nothing. Chosen: only the pictures you mark. All: every picture, after a step that shows the count and size. Each goes as the full picture, or as a small copy and the details, as you choose.
Search this computer, the web, or both	"Both" finds more. "This computer" is fully private.	"The web" and "both" mean outside sites see your search words.	Your search words go to the public sources you chose (for example Openverse and museum collections), not through our servers on the Mac. On the website, Feeds searches pass through our servers to reach them.
Find a bigger version of a picture (on the Mac)	Looks for a larger copy of a picture you saved, on the page it came from and in the open collections, and offers one only after checking it is the same picture. It is saved as a new picture beside the original.	Each place you leave on is one more request to a site, spaced out and within size limits. The check needs the full-size file on this Mac. A found picture states its own license, or none. Reverse image search is off by default.	The picture's own source page is fetched, and the open collections get words from its title and creator. No picture is uploaded. A reverse image search link (Google Lens, TinEye or Bing), only for a provider you turn on and only when you click it, carries the picture's public web address to that provider in your browser.
Check where a picture came from (on the Mac)	Asks the page a picture was saved from whether it is still there and still shows the picture, so you know before you rely on it. A small record of what the page said (its title, site, creator and license wording) can be kept, so where the picture came from stays true after the link dies. If you turn it on, a check also looks for a copy of the page the Internet Archive already has, and keeps a link to it with its date; only when there is none can you ask the Internet Archive to save one. Dates are kept apart: when you saved the picture, when it was last checked, and when the Archive's copy was taken. For a picture that needs credit or is restricted, Collagic also looks for that copy by itself, in the background, when you save it; if the Archive has none, the picture goes on a list called Sources without a saved copy, where you choose whether to ask it to save the page. Nothing is ever saved to the Archive automatically.	A check is one page and a few pictures from that site, a second apart for each site, within size limits, and only when you click. The site's robots.txt is read first and obeyed. A page that builds its pictures with scripts can look empty. The record is a few hundred bytes. Looking at the Internet Archive from a click on Source check is off by default and never happens in Private mode. The background look-up is on by default for pictures that need credit or are restricted, and only for them: one or two small requests a page, one a second, at most 20 pages an hour and 100 a day (you can change both in Tune), only while the app is idle, never in Low Power Mode or on a phone hotspot, and it stops for the session if the Archive asks for fewer requests. The first time it would run, Collagic tells you and offers a one-click Turn off.	Nothing is uploaded to Collagic. A check requests the page you saved the picture from and a few pictures it lists. The record stays on your Mac. If you turn on the Internet Archive look-up, the web address of the page and your IP address (no picture) go to archive.org each time you click Source check, to ask whether it already has a saved copy; a second click, only when it has none, can ask it to save one, and that copy can be public. The background look-up does the same, by itself, for each page a picture that needs credit came from: the web address of the page and your IP address (no picture) go to archive.org in the background, once per page however many pictures came from it, and never in Private mode. Citation lists are made on your Mac and saved or copied by you; finished work never shows credits.
Check for updates (on the Mac)	A new version of Collagic is found for you, shown as a small banner with a Restart now button, and downloaded ahead of time so the restart is quick. Before anything is installed, the file is checked against a key built into the app.	The server that hosts Collagic's releases sees that something asked for its newest-version file, and when, a few times a day while Collagic is open. A new version is a file of tens of megabytes. Both are on by default, in Mac Settings: "Check for updates by itself" and "Download updates in the background". They run only while the app is idle, never in Low Power Mode or on a phone hotspot, and never in Private mode. Collagic never installs an update without your press on Restart now.	Your IP address, and the name of the updater software, go to the server that hosts our releases, never in Private mode. The request is for one small file that names the newest version; Collagic compares it on your Mac, so the version of Collagic you run is not sent. No picture, no library, no account and no usage information is sent. In Private mode the only request is the one you make by pressing Check for updates in Settings or the app menu.
Keep finding from the web without stopping	More finds without asking each time.	More requests to each web source, with no natural stopping point. A source you added with your own key can bill you for each one.	Your search words, again for every extra page, to each web source you have turned on. Off by default: you read a warning and confirm first.
A model you bring (your own key)	Use the model you prefer.	That provider sees what you send it, under their terms.	The request and your key go to the endpoint you typed. Local models send nothing.
Exported files carry an id (Mac Settings, and a choice in each export)	Nothing, Work id and tools, or Credit chain, and Credit chain is where it starts. Unless you lower it, a file you export or drag out carries its creators, titles, sources, licenses and content hashes along with a random id and the tools used, so lineage and credit travel with it and a file dragged back into the Mac app is recognized. You can lower it for one file in its export dialog, or for all of them in Mac Settings; a choice you already made stays.	Anyone who reads the file's metadata sees what was written, and by default that includes where each picture came from, who made it and under what license. Sites often strip it. The finished picture never shows credits. A signed Content Credentials record (C2PA), if you add one, is signed with a temporary key and does not prove who you are or who Collagic is.	Only inside the file you export, at the level you pick. Nothing is sent to us.
Browser extension saves	One right-click saves a picture with where it came from.	A copy of the picture is stored in your cloud library.	What you save (picture, note or screenshot), its page address and title, and your key, to the service you set.
Plugins looking in your cloud library	One list of your pictures inside Photoshop, Figma, GIMP or Inkscape, from your cloud library, this computer, or both.	With the cloud, your search words and your key go to Collagic Cloud. Searching the public web from a plugin: Coming soon.	Cloud and this computer, merged, is the default. This computer only: nothing leaves. Cloud: your search words, your key, and any picture you send back.

Cookies, exactly

When you sign in on the website we set one cookie:

Name: __Host-collagic_session
Purpose: keeps you signed in so your pictures can load. Nothing else.
Kept in it: a random value. We store only a one-way fingerprint of it on our side, not the value itself.
How it is protected: HttpOnly (page scripts cannot read it), Secure (sent only over https), SameSite (not sent from other sites).
How long: up to 30 days.
Ending it early: "Sign out" revokes it on our side and clears it in your browser. On your Account page, "Sign out everywhere else" and "Sign out everywhere" end every sign-in at once (this browser's too, for the second), and "Remove" ends one device. Each takes effect the next time that device asks, and the device is told it was signed out.

If you sign in with Google, Microsoft or Apple, we set one more cookie while that sign-in is under way: __Host-collagic_oauth. It holds a random value, only so we can tell that the person who comes back from the provider is the browser that left. It is HttpOnly and Secure, it is removed when the sign-in ends, and it never lasts more than ten minutes.

Before you sign in, the website asks the year and month you were born (see Children, below). Answering sets one cookie, __Host-collagic_age. It holds a random value and nothing about you; on our side that value names a short-lived note of your answer, which your sign-in uses to record the answer on your account and which is then erased, or erased on its own after 30 days. If we cannot continue with an answer, we set a different cookie, __Host-collagic_age_hold, that holds only the word "held" for 24 hours, so changing the answer does not get past it. Both are HttpOnly and Secure. A refused answer is kept nowhere on our servers.

The browser also keeps a small note that you are signed in (so the page can show the right buttons) and, for the browser board and the collections you kept only in this browser before, your own pictures, in your browser's own storage. We do not receive those boards or collections. Clearing your browser's data removes them. Collections you make in your library are different: they are part of your cloud library (below). There are no advertising, tracking or analytics cookies.

The Start card and the welcome on the Library page keep one small note in your browser, per person: which of its steps you finished or skipped, whether you hid the card or closed the welcome, and whether a save has worked from the Capture page here (so the offer to install waits for that). It stays in this browser and is never sent to us. Signing in as someone else starts a new note. Clearing your browser's data removes it. The example wall on that card is drawn in your browser from public-domain pictures that come with this site. It saves nothing to your library and sends nothing.

On a phone or an installed Collagic, your browser also keeps these on that device, and none of them is sent to us until you save:

The app itself (its pages and files), so it opens with no connection. It is replaced when a new version comes.
What you looked at in your library: the pages of picture details (titles, tags, where each came from) and the small thumbnails you saw, up to 40 pages and 500 thumbnails, oldest dropped first. Full-size pictures are never kept this way. This lets the library open offline. It is removed when you sign out, when someone else signs in on this device, or when you press "Remove the offline copy" on the Capture page or "Clear offline copy" on your Account page. The name you signed in as is kept beside it so it knows whose copy it is.
Saves waiting to send: pictures, links and notes you saved from the Capture page while offline or while sending, with their tags, kept until they are sent or you remove them. They are never dropped by themselves. If you share a picture to Collagic from Android, it waits here until you press Save.

Your browser may clear any of this when it needs room. Sign-in answers and anything you save are never kept in that offline copy. If you used an iPhone Shortcut with a key, that key is stored inside your Shortcut on your phone, not by us (we keep only a one-way fingerprint of it).

What we store, and where

Your cloud library (only if you use it): the picture files, small preview copies, and a record for each: where it came from (page address, title, creator, license note), tags, which collections it is in (and each collection's name and notes), and when it was saved. Files live in Cloudflare R2 and records in Cloudflare D1. Each person's pictures are kept separate and are never shown to another person.
Your account: a name you give or a label (for an email sign-in, the address itself), and a fingerprint of each key or sign-in. We never store the keys themselves. When you link the Mac app or the extension by approving it in your browser, we also keep one-way fingerprints of the two codes involved and which kind of device asked (Mac app or browser extension). The codes end after 10 minutes and the record is cleared out after that; it never holds your address, and Delete my account removes any that are tied to you. Your Account page also lists where you are signed in: for each Mac app or browser extension key and each browser, a name, the day it was added and the day it was last used (we note the last use at most once an hour). It shows no address, place or time of day, and you can remove any of them. A removed sign-in stays on record, marked removed, until you delete your account.
Your email address (only if you sign in by email): the address you type on the sign-in page, so a sign-in link can find your library, and the time it first opened a link. We store a one-way fingerprint of each sign-in link and of the short typed code in the same email, not the link or the code; each works once and ends after 15 minutes, and a code stops working after five wrong tries. All of it lives in Cloudflare D1. The sign-in email is sent through Cloudflare Email Service, so Cloudflare handles your address to deliver it. The email holds a link and a short code and nothing else: no images, no tracking, no marketing. There is no password. Delete my account erases the address.
Your birth year and month (when you sign in on the website): the year and month you gave on the age question, kept with your account only to record that you answered. Never the day. People who signed up before the question was added have no answer on record and are treated as adults. Delete my account erases it.
Reports you send: if you use the Report a problem page, we keep what you typed: the reason, the picture's address or id, your note, and an email address if you gave one. No account is needed and no picture is ever asked for. A report is read only by us and is not shown to anyone else. It is not tied to an account, so Delete my account does not remove it; write to us and we will.
Waitlist and feedback: an email address if you give one, and messages you send, in Cloudflare KV. Write to us and we will remove them.
Your Mac library: stays on your Mac unless you choose to send pictures to the cloud (above). It is never used to train anything.

Signing in with Google, Microsoft or Apple

These buttons appear on the sign-in page only once we have switched that provider on, and only for the ones we have. If you use one, this is everything it tells us and everything we do with it:

Google tells us your name, your email address and an account number. We ask for nothing else.
Microsoft tells us your name, your email address and an account number. For a work or school account we trust the address only when Microsoft says the organization owns its domain.
Apple tells us your email address and an account number; we do not ask for your name. If you choose Hide My Email, the address is a private one that forwards to you, and we treat it as its own address.

We keep your email address and the account number, so that the same account finds the same library next time. We do not keep your name, your picture or anything the provider could use to act for you: no key or token is stored. We do not read your contacts, calendar, files or mail, and we never post anything. We use their login only to prove who you are.

The Apple button is Apple's own picture, and the sign-in page asks Apple's server (appleid.cdn-apple.com) for it each time the page shows that button. That request tells Apple that a browser at your internet address opened our sign-in page, and your browser's usual headers (its type, your language); we send Apple no account, no address of yours and no page address from us, and the request is made only on a page that shows the Apple button, before you press anything. If the picture cannot load, or you block it, the button still works as a plain "Sign in with Apple" button. Google's and Microsoft's buttons are drawn by our own page, with no request to them until you press one.

The provider learns that you signed in to Collagic, and when; what it does with that is in its own privacy policy. Their sign-in screens are theirs, not ours.

An address is matched to a library only when the provider says it has confirmed that address. Otherwise we refuse and change nothing. We never merge two libraries for you. While Collagic is invite-only, an address that has not been invited is refused the same way for everyone. Delete my account erases the address and the account number.

The browser extension

The extension reads the picture from the page you right-clicked, using the permission your browser gives it for that one tab. It does not ask to read every site. If a site blocks that, it can send the picture's address to our server to download instead; then our server sees that address. If both fail, it can offer to ask your browser for access to that one site, which you can allow or refuse, and remove later in Options. A save sends the picture, its page address and title (or the note, selection or screenshot you chose to save), and your key to the service address you set.

Plugins and other apps

Photoshop, Figma, GIMP and Inkscape plugins can list and open your pictures from this computer, from your cloud library, or both (see the table above for what each sends). Searching the public web from a plugin: Coming soon.

Storage, deleting and leaving

Cloud storage has a cap per person. At the cap you choose what to do; we do not delete anything on our own.

Archive hides a picture. You can restore it, and it still uses your cloud space.
Remove from cloud takes the cloud copy away and never touches the copy on your Mac. Delete everywhere takes the cloud copy away and leaves a note for your Mac. Your Mac never deletes its own copy on its own: it asks you first, with Keep here or Delete here for each picture or for all of them. Keep here leaves it on your Mac as a picture that is no longer in the cloud. Delete here moves it to your Mac's Archive, where you can restore it.
Both start in your Archive. Nothing is erased until you delete from the Archive for good, and that cannot be undone. Erasing removes the file, its small copy, and the picture's details (where it came from, tags, license, title). A bare note that the picture existed (an id and a time, no content) stays so your other devices learn it is gone.
Export your library, on the Account page, gives you a zip of every original with where it came from, its creator, license, rights note, tags and dates, as plain files.
Delete my account, on the Account page, erases every picture, small copy, detail and sign-in we hold for you, after a step that tells you how many pictures and how much space. It cannot be undone, and it does not touch copies on your Mac.
If you cannot use these, write to us and we will do it for you.

What we don't do

No advertising or tracking cookies, and no analytics scripts on this site. If that ever changes, this page will say so first.
No training of anything on your pictures, local or cloud.
No selling or sharing of your data.
No showing one person's pictures to another. Share by link: Coming soon.

Third-party image and feed sources

Discovery feeds fetch openly licensed and public-domain images from sources such as Openverse and museum collections. On the Mac those requests go from your device to those services; on the website's Feeds page they pass through our servers. Either way, the services' own terms apply. Attribution stays attached to every picture; finished work you make never shows credits unless you choose it.

Mature pictures. Every search of Openverse asks it to leave mature pictures out. Openverse has a setting for that and we send it each time. The other sources, Wikimedia Commons, Wellcome Collection and the museum and library collections, have no such setting, so they can still show nudes, medical pictures and war pictures; we do not call any source safe. On the Mac, an optional wider web search (Search the wider web, results are not filtered by Collagic) is off until you turn it on and add your own key; when it is on, your search words go to that web search service and what comes back is not filtered by us.

Children

Collagic is a tool for making collages and is not directed to children. For now it is open to adults only, by invitation. Before you sign in on the website we ask the year and month you were born, and we keep an answer with your account only to record that you gave one. If we cannot continue with an answer, we keep nothing about it on our servers and ask you nothing more; a cookie holds that browser off for a day. This is a question, not a check: we cannot know that an answer is true. We do not knowingly collect information from anyone under 18. If we learn that we have, we close the account and delete the information, except what the law requires us to keep. We do not sell data, show ads or send marketing email. If you think a child is using Collagic, or you see a picture that shows a child in a sexual way, use Report a problem; the page also says where to report to the National Center for Missing and Exploited Children. Counsel has not read this section yet.

Questions

Use the Feedback button in the app, or email hi@weirdlittle.studio. See also Terms.