Privacy Policy

Last updated: 29 September 2026

WatermarkNinja is built to need as little of your data as possible. This policy explains exactly what happens to your photos and the limited information we handle.

Who we are, why we process data, and for how long

WatermarkNinja is run by ShinobiTools, registered with the KvK (Dutch Chamber of Commerce) under number 42147182. You can reach us at info@shinobitools.com.

• Your photo and the mask you paint: used to remove the mark you asked us to remove. Legal basis: performing the service you ask for (art. 6(1)(b) GDPR). Your upload is deleted right after processing. The result is not kept at all: it goes straight back to your browser. This is the same on the free tool and with a pass.
• Limits, security and usage counts: used to apply the file-size limits, keep the site safe and see how much the tool is used. Legal basis: our legitimate interest (art. 6(1)(f) GDPR). The counts, including a shortened hash of your IP address, are deleted after 60 days.
• “Report a problem”, with an optional screenshot: used to see and fix the problem you report. Legal basis: our legitimate interest (art. 6(1)(f) GDPR). The screenshot box is ticked by default and you can untick it. Screenshots are deleted after 30 days. The text of a report may be passed to an AI service (Anthropic’s Claude) to sort it; it has no automatic deletion date yet, so ask us if you want it removed.
• If you tick “Also send my file and the result” in that window: the file you chose and the result of your job are stored for 30 days and used only to reproduce and fix the problem you reported. They are not shared, not included in our backups, and you can ask for earlier deletion at info@shinobitools.com. Basis: fixing the problem you reported (Art. 6(1)(f) GDPR); the box is ticked by default and you can untick it.
• Email you send us: used to answer you. Legal basis: our legitimate interest (art. 6(1)(f) GDPR). There is no automatic deletion date; ask us and we delete it.
• Email list (only if you leave your address): used to send you pass codes and news about new tools. Legal basis: your consent (art. 6(1)(a) GDPR). Kept until you unsubscribe, details below.
• Advertising cookies (Google AdSense) and Microsoft Clarity (a tool that shows how visitors use the page): only with your consent via the cookie banner (art. 6(1)(a) GDPR).
• Google Fonts: the typeface used on this site is loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com) as a page opens, so Google receives your IP address and browser details with that request. We use it to show the pages in the intended typeface. See Google's privacy policy.
• Stripe: if you buy a pass, you pay on Stripe's own checkout page, not ours. Your card details go to Stripe under its privacy policy, and we never see them. We receive confirmation that the order was paid, its order number and the e-mail address you entered.

Files you choose to send us

Next to a result, you can click “Share these 2 files” to help us find mistakes our tests don’t catch. This is entirely optional and off by default.

• What we ask for: the one file you uploaded and the result we gave you, and nothing else: only the part we need: up to 30 seconds of audio, one page of a PDF, or an image with the location data (EXIF/GPS) removed.
• Faces: a separate checkbox, off by default, where you confirm the file shows faces and everyone in it agreed, with no children in it. Without it, faces are blurred or the file is refused.
• Why: to find mistakes our automatic tests don’t catch, and turn real ones into new test cases.
• Legal basis: your explicit consent (Art. 6(1)(a) and, for special-category data such as faces, Art. 9(2)(a) GDPR). For other people who may appear in your file, our legitimate interest with strict minimisation (Art. 6(1)(f) GDPR).
• How long: at most 30 days, then it is deleted automatically.
• Withdraw any time: you get a one-time code on screen. Enter it whenever you like and we delete the pair, its label and the consent record immediately: as easy as giving it.
• Who sees it: one person on our team, and nothing else. A local AI model only adds a label for the kind of mistake, never a description of a person, and it never leaves our own computer.
• What we never do: we never store your IP address, filename or email with it; never train or fine-tune any model on it; never share it with anyone else, publish it, or offer it through the API; and never use it to identify or score anyone.

Where it runs: your photo travels to us through Cloudflare’s network, which connects this site to the internet, and is processed only on computers we operate ourselves. Some heavy jobs run on another of our own computers rather than on the web server.

Backups: Uploads and results are never included in our backups. Other data on this page, such as the daily counts and the email list, is included in our encrypted backups, which we keep for up to 12 months.

Your rights: you can ask us for access to your data, or for it to be corrected or deleted, ask us to limit or stop using it, and withdraw your consent at any time. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the supervisory authority in your own country.

Your photos

• The image you upload and the mask you paint are used only to remove the watermark you selected.
• Processing happens on computers we operate ourselves; some heavy jobs run on another of our own computers rather than on the web server. Short-lived working copies are deleted as soon as the job is done, and your image is not used to train any model.
• The cleaned result is sent back to your browser. We do not keep a copy.
• Uploads and results are never included in our backups.
• If you use “Report a problem”, the form can attach a screenshot of the page, and that screenshot can show your photo. The box is ticked by default; untick it if you don’t want to send one. Screenshots are deleted after 30 days.
• There is no account, so your images are never tied to an identity.

Visitor statistics

We count page views and uses of the tool to understand how many people use it. To count unique visitors we keep a shortened hash of your IP address per day, not the address itself. Such a hash is pseudonymous rather than fully anonymous, so we delete it, together with the rest of the daily counts, after 60 days. Your full IP address is never written to disk for these statistics.

To protect the service, if one address sends many rejected uploads in a short time (20 files over the size or format limit within an hour), we block uploads from that address for 24 hours. For this we keep a scrambled form of the address (a different code from the daily one, because the block must outlast the day) for at most 24 hours, and it is never used for anything else.

Email list

You can leave your email address, for example to get money off a pass. That puts you on the ShinobiTools email list: we email you when there is a free pass code and when a new tool comes out. That is the only reason we ask for it. The tools work without it: nothing here needs an account, and nothing is hidden behind giving us your address.

We store the address, when you signed up, which site you signed up on, the IP address you used, and the exact sentence that was shown next to the button when you signed up. That last part is the proof that you asked for this, which is what the law expects us to keep. There is no separate confirmation click. Every email has a one-click unsubscribe link that deletes the address, so if someone else entered yours, one click removes it. The 10% code sets one cookie (shinobi_korting) for 48 hours, only so the checkout knows the discount applies.

The emails themselves are delivered by Resend (Resend, Inc.), which sees the address in order to deliver the message and nothing else. We keep your address until you unsubscribe.

Every email has an unsubscribe link that works in one click, without logging in. Use it and you are off the list at once: your signup is deleted, and all that stays behind of it is a one-way hash of your address, so we can show that we honoured it. Copies of emails we already sent you stay in our send log; if you want those gone too, just ask. We never sell, rent or share the list, and we don't use it to follow you around the web. Want to know what we hold, or want it gone without waiting for an email? Write to info@shinobitools.com.

Advertising

When ads are shown here, third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on those visits. You can opt out of personalised advertising in Google’s Ads Settings, and opt out of some other vendors’ advertising cookies at www.aboutads.info.

This site shows ads through Google AdSense to keep the tool free. Google may use cookies and similar technology to serve and measure ads. You can review and control this through Google's ad settings. We do not sell any data.

Cookies

WatermarkNinja itself sets no tracking cookies other than the statistics cookie described below. Your dark-mode preference is stored locally in your browser only. Third-party services such as AdSense may set their own cookies as described above.

To count returning visitors and understand how the tools are used over time, we set one first-party cookie with a random number. The number is not derived from your IP address or your device, and the cookie lasts 13 months. We store it only in a scrambled form that we cannot link back to the cookie without a secret kept on our own server. It is used for our own statistics only, never shared and never used for advertising or any other purpose. We do not set it if your browser sends Do Not Track or Global Privacy Control. You can stop it at any time by clearing your cookies or with the opt-out button below. Data of individual visitors is deleted after 13 months; aggregated counts without any identifier are kept. Nothing changes in the short daily code made from your IP address that we use for our other usage counts: those counts are still deleted after 60 days.

Switch statistics off for this browser

Contact

Questions about privacy? Write to info@shinobitools.com, use the feedback button on any page, or reach us through the ShinobiTools hub.