Privacy

When you drop or open a photo in Rovli without signing in, the file never leaves your device. Decoding, background removal, mask editing, adjustments, cropping, background replacement, and export all run inside your browser, using your device’s own CPU or GPU. As a guest, your photo, masks, and project settings are stored in your browser’s IndexedDB — private to this browser on this device, never transmitted anywhere by Rovli, and not recoverable if you clear site data or switch devices.

Background removal, edge refinement, and the interactive “Refine” tool all run through machine-learning models that execute locally in your browser — preferring your device’s GPU via WebGPU and falling back to WebAssembly when that isn’t available. Your photo is never sent anywhere for this processing; only the model files themselves (not your photos) are downloaded once, from the model providers’ own CDNs, and cached by your browser for future visits. Exactly which models are used and their licenses is engineering detail that changes as the editor improves, so it’s tracked in Rovli’s technical documentation rather than pinned here — reach out at rovlisupport@gmail.com if you’d like the current specifics.

Signing in is optional and only required for cloud features (saving projects across devices, a projects list). Rovli uses Supabase for authentication, which processes and stores what your sign-in method requires — typically your email address and a Supabase-issued account ID — plus your plan and display name in a linked profile record.

Nothing beyond account data leaves your device unless you explicitly choose it. If you sign in and turn on “Save to cloud” for a project, Rovli uploads what’s needed to continue editing that project elsewhere: the original photo, any custom background image you added, the current mask, the project’s settings, and a thumbnail. This only happens for a project you’ve explicitly saved — opening, editing, and exporting photos as a guest never uploads anything. Cloud-saved assets are stored in a private Supabase Storage bucket, access-controlled by row-level security policies tied to your account; nobody else can list or read your files.

Rovli is hosted on Vercel and backed by Supabase, both of which necessarily process standard operational data to serve requests — things like IP addresses in request logs, for reliability and abuse prevention. This is infrastructure-level logging common to any hosted web application, not photo or project data.

Rovli does not run analytics, advertising, or tracking scripts of any kind. The only cookies set are Supabase’s own session cookies, used solely to keep you signed in — nothing marketing-related is set, and nothing is shared with ad networks.

For privacy questions not answered here, contact rovlisupport@gmail.com.