Privacy Policy

Last updated: October 27, 2026

This Privacy Policy describes how Image to Text ("we", "us", or "our") collects, uses, and protects information when you use our free online OCR service at imagetotext.my (the "Service").

By using the Service, you agree to the data practices described in this policy.

1. Information We Collect

We collect a minimal amount of information to operate, secure, and improve the Service:

• Visitor logs — IP address (truncated to 45 chars), User-Agent string, HTTP Referer, and timestamp of each page request, stored in our internal analytics database. We use this data to detect abuse, count unique visitors, and diagnose issues. We do not link this data to your identity.
• Authentication cookie — A non-personalised identifier stored in your browser's cookie jar (named login) used solely for client session continuity. It is encrypted with our server-side secret and cannot be used to identify you across sites.

We do NOT collect: the images you upload, the OCR text you extract, your email address, your name, your phone number, your address, or any personally-identifying content from your files. Image files you process are handled by the upstream OCR service and are not stored on our servers.

2. How We Use Information

The limited information we collect is used only for:

• Operating, securing, and debugging the Service.
• Generating aggregate, non-identifying usage statistics.
• Detecting and blocking abusive traffic (rate limiting, bot mitigation, IP banning).

We never sell, rent, lease, or trade your information to third parties for marketing purposes.

3. Cookies & Local Storage

The Service uses:

• Essential cookies — login cookie for session continuity; expires in 30 days.
• Local storage — theme preference (light/dark mode) and last-known client-side UI state. No personal data.

You can disable cookies in your browser settings; this will not break the OCR functionality but may reset your theme preference.

4. Data Sharing

We do not share your data with advertisers, data brokers, or analytics companies. The only third parties that may receive data are:

• Cloudflare — for DDoS protection and edge caching; they may see IP and User-Agent headers. See Cloudflare Privacy Policy.
• Our upstream OCR service provider — when you submit a file for OCR processing. They receive the file and your client-side metadata to perform recognition. They retain files for the period stated in their privacy policy (typically short-lived).
• Law enforcement — only when compelled by valid legal process.

5. Data Retention

• Visitor logs: retained for up to 90 days, then aggregated or deleted.
• Login cookie: 30 days from last activity, then expires.
• Uploaded images: not retained on our servers. Upstream OCR service retains uploaded files according to its own policy.

6. Security

We implement industry-standard security measures to protect the limited information we hold:

• HTTPS / TLS encryption for all traffic.
• Encrypted session cookies (AES-256-CBC with rotating IVs).
• Restricted access to logs (server-side only, never exposed to the public web).
• Regular patching of PHP, web server, and dependent libraries.

No method of transmission over the Internet, however, is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Request access to the data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict processing of your data.
• Request portability of your data.
• Lodge a complaint with a supervisory authority.

Since we collect only non-identifying operational data (no accounts, no profile, no personal files), most of these rights are moot — but if you have a specific request, contact us (see Section 11).

8. Third-Party Services

The Service depends on these third parties. Their privacy practices apply when they process data:

• Cloudflare R2 — encrypted file storage during the OCR pipeline.
• Cloudflare Turnstile — bot/abuse mitigation on form submissions.
• Our upstream OCR API — performs the actual text recognition.

9. Children's Privacy

The Service is not directed to children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted on the homepage for at least 30 days.

11. Contact

If you have any questions about this Privacy Policy or your data, please contact us through the feedback form on our homepage or via the disclaimer page contact details.