Encrypted in transit
All traffic to the website and API uses HTTPS. Uploads never travel in the clear.
Security
Your images, handled carefully
Compression needs your files for a moment — not forever. Here is how Comprestack treats uploads, accounts, and infrastructure. Full legal wording lives in the Privacy Policy.
Deleted within 1 hour
Processed files are temporary. We automatically remove uploads and outputs on a short timer — Comprestack is not a backup or CDN.
Not used to train AI
Your images are used only to compress or convert them for you. We don’t sell them or feed them into model training.
Metadata stripped by default
Hidden photo details such as GPS are removed unless you send keep_metadata for a specific job.
Least access for staff
Team members don’t browse customer uploads. Exceptions are rare: support you request, or legal investigation of illegal content.
Account & API hygiene
Signed-in sessions use secure cookies. API keys stay on your server — rotate or revoke them anytime in the dashboard.
How we run the product
API keys stay server-side
Keys begin with csk_live_ and belong in environment variables. Never ship them in a browser bundle, mobile app, or public repo.
Guests and accounts share one pipeline
Signed-out visitors get a small daily allowance. Signed-in Free, Pro and Business quotas are enforced by the API. Guest files still delete within 1 hour.
UK GDPR
Comprestack is the controller for account data, based in Belfast, United Kingdom. You can ask us for a copy or deletion at hello@comprestack.com.
Payments
Checkout is handled by our payment partner as merchant of record. We never store card numbers on Comprestack servers.
Who helps us process data
We only share what each provider needs to do their job. Same list as in the privacy policy.
Supabase
Sign-in, account database, usage and contact messages
Image processing
Compress and convert uploads on our servers (deleted within 1 hour)
Vercel
Website hosting and request logs needed to serve the site
Payment processor
Merchant of record for subscriptions and image packs
Common questions
- How long do you keep my images?
- Uploads and outputs are deleted automatically within 1 hour. Comprestack is not a backup or CDN.
- Do you train AI on my files?
- No. Images are used only to compress or convert them for you. We don’t sell them or use them for model training.
- Where should I report a vulnerability?
- Email hello@comprestack.com with enough detail to reproduce the issue, and give us a reasonable window to respond before public disclosure.
Report a vulnerability
Email hello@comprestack.com with enough detail to reproduce it. Please don't disrupt production, and give us a reasonable window before public disclosure.