422 Lab
Privacy Policy
This Privacy Policy explains what information 422 Lab handles when you use this website and its tools.
Last updated: October 7, 2026
Introduction
This policy applies to the 422 Lab website and the browser-based tools available through it.
Information We Collect
Using the site does not require an account. If you choose to create one, we collect the information described under Accounts and Sign-in. We do not intentionally collect the image or text content you process in the browser tools. Hosting providers may process ordinary technical request data needed to deliver the website.
Accounts and Sign-in
Accounts are optional. When you sign in with Google or GitHub we receive your account identifier, email address, whether it is verified, your profile name and avatar URL. When you sign in by email we store your address, and we keep a hashed one-time code for up to 10 minutes to verify it. You choose a public display name, which may appear on leaderboards; your email address is never shown publicly. You can change your display name or permanently delete your account and its linked data at any time from your account page. If you take part in a leaderboard, your display name, best score and the drawing behind it are shown publicly.
Files and Content You Process
Image Compressor decodes, resizes, and encodes images in your browser using a Web Worker. AI Image Upscaler loads its ONNX model and runs inference in your browser using WebGPU when available or WASM as a fallback. Neither image tool uploads your source image to this site's application backend.
Temporary Transfers and Relay Handling
Secure Transfer exchanges text and files between two browsers through Tailcat's WireGuard-encrypted transport. A direct path is not guaranteed; browser traffic may use DERP relay connectivity. The site does not provide cloud file storage or a transfer history, and payloads are not uploaded to this site's backend.
Local Browser Processing
The image tools create local object URLs and temporary processing data needed for the current page. Secure Transfer keeps the invite in the URL fragment and does not use localStorage, sessionStorage, IndexedDB, or analytics for transfer content.
Data Retention
The image and transfer tools do not create a server-side content history. Temporary in-memory data is released when the page or connection is closed, subject to normal browser behavior. Account data is kept until you delete your account. Technical delivery logs may follow the retention practices of the relevant hosting and relay providers.
Logs and Technical Information
The hosting and delivery layers may receive standard technical information such as an IP address, user agent, request time, and requested resource. This information is used for security, reliability, and delivery operations according to the relevant provider's policies.
Cookies and Local Storage
We do not set analytics cookies or use browser storage to build a user profile. If you sign in, we set an encrypted session cookie that keeps you signed in for up to 30 days and a small cookie that only indicates a session exists. Some features store data such as scores in your browser's local storage on your device. Browser-managed temporary data may also be created while a tool is running.
Analytics
No product analytics is enabled in the current MVP. If this changes, this policy will be updated before the service is enabled.
Advertising and Google AdSense
Advertising is not enabled in the current MVP. The site may use Google AdSense in the future. If enabled, Google and its partners may use cookies, local storage, or related technologies for advertising, measurement, and personalization as permitted by applicable policy and consent choices.
Consent Management
If advertising is enabled for regions that require consent, the site will use an appropriate consent flow and update this policy to describe the final configuration.
Third-party Services
The site is hosted on Cloudflare, which also stores account data and verifies sign-in requests with Cloudflare Turnstile. Google and GitHub process sign-in if you use them, and sign-in emails are delivered by our email provider. The site also relies on static browser assets, including the Tailcat runtime and an ONNX image model; Secure Transfer may use Tailcat DERP relay infrastructure. These services receive only the data required for their function.
Security
We use browser-side processing where practical and encrypted transport for Secure Transfer. No internet service can guarantee absolute security, so do not use the tools for content that must never be exposed.
Children's Privacy
The tools are not directed to children under the minimum age required by applicable law, and we do not knowingly collect personal information from children.
International Users
The website may be accessed from different countries. Technical delivery and relay infrastructure may process network information across borders where necessary to provide the service.
Changes to This Policy
We may update this policy as the tools or third-party services change. The date above identifies the latest version.
Contact
For privacy questions, please use the contact details on our Contact page.