An upload creates more than an output
A hosted tool may receive the image file, account and billing identifiers, IP address, device data, prompt, generated outputs, moderation signals, and support logs. Processing may create thumbnails, face or image embeddings, masks, caches, safety-review copies, and backups. The exact path depends on the service; do not assume any one platform performs every step.
A reference image can reveal identity, location, relationships, surroundings, or hidden file metadata. Adult or intimate context raises the consequence of a breach, employee misuse, unexpected training use, or account compromise.
Read for six concrete answers
- Purpose: Is the upload used only to provide the feature, or also for analytics, product improvement, or model training?
- Retention: Is there a stated period for inputs, outputs, logs, and backups?
- Access: Can employees, moderators, contractors, or vendors review content, and under what conditions?
- Sharing: Which processors receive the file, and can a project or gallery become public?
- Deletion: Can you delete the source, output, account, derived data, and backups? How long does completion take?
- License: What rights does the service claim over uploads and generations?
Look at the terms, privacy policy, safety policy, help center, and product UI together. A broad marketing statement such as “private” does not answer these questions.
Reduce exposure before upload
- Use synthetic adult characters where a real likeness is unnecessary.
- Upload the smallest crop and resolution that the feature needs.
- Remove location and camera metadata from a copy, while preserving your private original.
- Avoid faces, tattoos, documents, reflections, room details, and other identifiers unless essential.
- Use a unique password and multi-factor authentication where available.
- Confirm that a gallery, community feed, or sharing link is private by default.
- Never upload another person's intimate image without specific consent for this processing.
For recurring identity work, read likeness consent. Possession of a picture does not grant permission to sexualize, transform, or publish the depicted person.
Local processing changes (but does not erase) the risk
A fully local generation workflow can keep ordinary inputs and prompts on the machine. ComfyUI and InvokeAI can run locally, while hosted tools such as Runway, SoulGen, and Kindroid process service interactions remotely according to their own current terms.
Local is not the same as offline. Cloud API nodes, model downloads, telemetry, browser extensions, synced output folders, remote-access software, and untrusted custom nodes can transmit data. Device theft, malware, and shared accounts remain risks. Use encrypted storage, restricted user accounts, reviewed extensions, and backups.
After processing, verify and clean up
Delete failed uploads, project assets, and generations through the product controls; then verify whether a separate account or privacy request is needed. Revoke public share links. Download any records you need before closing the account. Keep a dated copy of the policy that governed especially sensitive work, because hosted terms can change.
If an identifiable intimate image is created or shared without consent, preserve evidence without redistributing the image, use the platform's reporting process, and seek appropriate local support. In the United States, the FTC explains that the TAKE IT DOWN Act covers certain real and digitally forged non-consensual intimate images and requires covered platforms to provide removal processes. Laws differ by location; this guide is a risk checklist, not legal advice.