Skip to content

Privacy Policy

Privacy without the fog. What HotIMG collects, why we need it and what control you keep.

Last updated: August 1, 2026

What we collect

  • Account data: email, username, password hash (or Google account ID for Google sign-in), optional profile fields (bio, website, location, avatar).
  • Images and metadata: the files you upload, their technical properties, titles and descriptions you add. Images may contain EXIF metadata you chose to keep; use our EXIF remover tool to strip it before upload.
  • Usage data: upload IP addresses, sign-in events (IP, browser), view counts, likes, follows and reports. We use IPs for abuse prevention and rate limiting.
  • Cookies: a session cookie for sign-in, a CSRF token, and an anonymous-uploads token that lets guests manage their own files. Ads on the site may set their own cookies subject to the ad network's policy.
  • Analytics: we use Clicky (Roxr Software) to measure traffic and see which pages are useful. It records page views, referrers and rough location in aggregate, and sets its own cookies. See the Clicky privacy policy.

What we use it for

Operating the Service (serving your images, showing your profile), safety (moderation, ban enforcement, rate limiting), and product statistics in aggregate. We do not sell your personal data.

Who can see what

Public images and your profile are visible to everyone. Unlisted images are visible to anyone with the link. Private images only to you. Moderators see reported and gallery-submitted content, including the automatic scan verdicts. Gallery submissions are additionally processed by an AI moderation model to detect prohibited content.

Retention and deletion

Expired images are deleted permanently, including derivatives. Deleting an image or your whole account removes the data immediately from the live system; residual copies in backups roll off within 30 days. Sign-in event logs are kept up to 12 months for security.

Your rights

You can access, correct and delete your data at any time from your dashboard, including full account deletion. For data requests you cannot self-serve, email [email protected]. EU/EEA and UK users have GDPR rights (access, rectification, erasure, portability, objection); California residents have CCPA rights.

Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

Changes

We will announce material changes to this policy on the site before they take effect.