Privacy Policy

Last updated: June 25, 2026

ICEHAMBURG INC. ("we") sets out how personal data is handled in karufoto ("the Service"). The Service is built privacy-by-design: image optimization happens entirely on your device, and when you share, only the optimized image is stored — minimally and for a short time. The Service is currently provided primarily for users in Japan and is not actively directed at residents of the EEA/UK.

1. Information we process

Download: loading, resizing and re-encoding all happen inside your browser. The image itself is never sent to our servers.

Share: only when you create a share link, we store the following.

The optimized image file (the original is never stored)
File name, original size, optimized size, format and dimensions
The creation time and expiry (7 days from creation)
The capture date (EXIF) is preserved. Location data (GPS) is removed by default and is only included if you choose to keep it.

2. Server logs, cookies & analytics

To provide and protect the Service, technical information such as IP addresses may be processed temporarily by our processors (below).

The Service uses Google Analytics (cookie-based analytics) to understand usage. Google Analytics measures usage in aggregate via cookies and is not used to identify you personally.

If you prefer not to be measured, block cookies in your browser settings or install Google's "Google Analytics Opt-out Browser Add-on".

3. Purposes

Providing image optimization, sharing and receiving
Operating the Service, preventing abuse and ensuring security
Complying with law and protecting rights

4. Legal bases (GDPR Article 6)

Providing the share feature: performance of a service you request (Art. 6(1)(b))
Operating and securing the Service, and analytics: our legitimate interests (Art. 6(1)(f))
Choosing to keep location (GPS): your consent (Art. 6(1)(a)), which you may withdraw at any time

5. Retention

Shared images and their records are deleted automatically 7 days after creation (via a daily cleanup job). The download feature stores no data at all.

6. Processors & disclosure

We use the following processors to the extent necessary to provide the Service, under data processing agreements (DPAs). We never sell your data or share it for advertising.

Supabase (storage, database, serverless functions)
Vercel (application hosting)
Google (Google Analytics)

7. International transfers

Shared images are stored in Japan (Tokyo). Transfers from the EEA to Japan are covered by the EU's adequacy decision for Japan.

The processors above (Supabase, Vercel, Google) are US companies; where transfers to the US occur, they rely on appropriate safeguards such as the Standard Contractual Clauses (SCCs) or the Data Privacy Framework.

8. Your rights

If you are in the EEA/UK, you have the rights to access, rectify, erase, restrict and object to processing, and to data portability, as well as to lodge a complaint with a supervisory authority.

Shared data is deleted automatically after 7 days. For earlier deletion or other requests, contact us with the share ID at the address below.

9. Security

Share links use hard-to-guess IDs, storage is private, and images are accessible only via short-lived signed URLs.

10. Children

The Service is not directed at children under 16. If you are below the applicable age in your region, please do not use the Service without parental consent.

11. Changes

We may revise this policy. Significant changes will be announced within the Service.

12. Operator & contact

Operator: ICEHAMBURG INC.
Address: 12-16-101 Inari-cho, Hanno-shi, Saitama, Japan
Privacy contact: info@karufoto.com
EU representative: Not designated, as the Service is not currently directed at residents of the EEA/UK. We will reassess if we expand to the EEA/UK.