← Back to ComfyDetective

Privacy Policy

Last updated: 15 August 2026

See also: About · Terms of Service

1. The short version

Your workflow file is read and analysed in your browser. Your images are never uploaded. Your prompt is not stored — it is sent once for an automated content check and is discarded when that check returns. The one exception, which section 2 describes in full, is that individual words are counted so we can find gaps in our own blocklist; a word is only ever kept once at least five separate uploads have used it, and nothing links the words back to each other or to you.

What we keep is the structure of the workflow: which nodes it contains, how they are wired, the generation settings, and the names of the model, LoRA, VAE and ControlNet files it references. Plus, if you have an account, your email address, and, for everyone, a hashed IP address and basic usage records.

The rest of this page says exactly what that means, how long we keep each thing, and the one case where a record deliberately outlives your account.

2. What happens to a file you analyse

3. What we store

We do not store your prompts as you wrote them, your images, your raw workflow file, or your payment details (there are none — the Service is free). We do not store your IP address in readable form in any table we write to — with the one exception of the sign-in records kept by our authentication provider, which section 5 sets out.

4. Model and LoRA filenames

We keep the filenames of the checkpoints, LoRAs, VAEs and ControlNets a workflow references. We need them so that a saved workflow can be reloaded and still make sense, and because the model and LoRA statistics are the point of the tool.

These names are chosen by whoever made the model, not by us, and they sometimes contain a real person's name. That makes them the most sensitive thing we retain, and we treat them that way: they are never shown next to your account, and they are not published in a form that ties them to an individual user. If a filename in our records names you and you want it removed, tell us through the Contact page.

5. Hashed IP addresses are pseudonymous, not anonymous

Our own tables do not store your IP address. They store a one-way hash of it, computed with a secret key. For IPv6 we hash only the /64 network prefix, because the rest of an IPv6 address rotates.

That sentence is deliberately about our own tables, because a flat “we do not store your IP address” would not be true of the whole system. If you sign in, the authentication service we use (Supabase Auth, section 10) records the IP address and user agent of a sign-in session in its own tables, in readable form, as part of issuing and revoking that session. We do not put it there and we do not use it for anything, but it exists and it is on infrastructure we control, so it is ours to declare. If you never sign in, there is no such record. Specifically, the session table holds the IP address and user agent of each active sign-in session, and the sign-in audit log can hold the IP address of sign-in events. Those rows exist for as long as the session does; we do not currently purge them on a separate schedule, and signing out ends the session.

Be clear about what that does and does not mean. The hash cannot be turned back into your IP address, but it is stable: the same address always produces the same hash. So we can tell that two uploads came from the same place, and we can enforce a block against that place. That is the whole reason it exists. It is pseudonymous data, not anonymous data, and where the law treats pseudonymous data as personal data, we treat it that way too.

We use it for exactly two things: counting daily uploads so the free limit can be enforced, and enforcing suspensions.

6. Content moderation

Every workflow is checked against our blocklists before it is analysed. If nothing matches, no moderation record is written at all.

If something does match, the record we write contains only closed-vocabulary data — values that come from our own lists and our own code, never a sentence you wrote:

The submitted prompt is not part of that record. Content that is blocked outright is not analysed and not stored.

One field on that record is not closed-vocabulary, and the list above would be misleading without it: if a person on our side reviews a flag, they can attach a note to it. That note is written by us about the decision, not by you, and it is free text. It is visible only to reviewers.

Separately, we run an internal scan that re-applies our current blocklist to workflows we have already stored, so we can see which of our own terms are matching things they should not and fix them. Each row of that scan records one of our terms, how many times it occurs in one stored workflow, and a reference to that workflow — so it is a per-upload moderation record, and we would rather name it here than leave it out because it is internal. It holds no prompt text. It is a snapshot rather than a log: each run deletes the whole previous scan before writing the new one.

If you think a decision was wrong, quote the reference code on the Contact page and we will review it.

7. Ban records survive account deletion

This is the one place where deleting your account does not delete everything, and we would rather state it plainly than bury it.

If your access has been restricted or banned for breaking the Terms of Service, the enforcement record — the ban, its reason, the violation counters and the hashed IP address it applies to — is kept after the account is deleted. Your account ID is removed from it, so the record no longer names you, but the block itself remains in force.

The reason is simple: if a ban disappeared when the account did, anyone could lift their own ban by deleting their account and signing up again. Keeping the record is what stops that. It applies only to accounts that were actually restricted or banned; if you were never subject to enforcement, there is no such record and nothing survives.

Moderation flags and appeal records are handled the same way: they stay, with your account ID removed, so that an enforcement decision can still be reviewed. Neither contains prompt text.

So is the trust record. Alongside the ban we keep a standing score for a session — how many uploads it has made, how many were clean, how many tripped the filter, the resulting status and why, and how many appeals were made and upheld. Like the ban, it loses your account ID when the account goes but survives keyed to the session, for the same reason: a reputation you can reset by signing up again is not a reputation.

One thing to be plain about, because “your account ID is removed” does not cover it. If you appealed a decision, the appeal keeps what you put into it — the reasons you wrote and the contact address you gave us. We keep the address because that is where the outcome gets sent; an appeal we cannot answer is not an appeal. Removing your account ID does not remove either of them. If you want a decided appeal erased, ask us on the Contact page and we will delete it.

8. Saved workflows

If you are signed in you can save a workflow to your account. Saved workflows are:

9. How long we keep things

10. Who else processes your data

We do not sell your data and we do not share it for advertising. We use these providers to run the Service:

We may also disclose data where the law requires it, in response to a valid legal request, to investigate a Terms of Service violation, or to protect someone's safety.

We operate from the United States (section 14), and the providers above are US companies. So if you are in the UK or the EEA, your data is transferred to the United States and handled there.

The site is hosted on DigitalOcean in the United States (New York) and served through Cloudflare's global network; the database is in the United States (Ohio). We have not put a formal transfer mechanism such as Standard Contractual Clauses in place with these providers. If that matters to you, the two things that send personal data to them are signing in and accepting analytics; you can use the analyser without doing either.

11. Cookies and local storage

We use no advertising cookies.

12. How the analytics consent works

Analytics is off until you turn it on. Declining is the default, and doing nothing counts as declining.

One choice covers two things, and we would rather list them than let “analytics cookies” imply only the first:

What still happens if you decline. Analysing a file still writes the structural workflow record described in section 3 — the node classes and links, the generation settings, and the model, LoRA, VAE and ControlNet filenames — and still updates the aggregate totals in section 9. We keep that on the basis set out in section 8, not on your consent. When you have declined, it is written with no session identifier and no campaign parameters, so nothing joins one of those records to another, to a visit, or to you, and nothing about it is stored on your device. The content check in section 2 and the abuse records in sections 5 to 7 are likewise not part of this choice; they are how the Service is kept lawful to run, and they are described where they occur.

The essential cookies and the remaining local storage above are not part of this choice either. Signing in, remembering your theme, remembering that you accepted the Terms and counting your free uploads are what the Service needs to function, and there is no version of it that works without them.

13. Your rights and how to use them

You can ask us to:

You can delete your account yourself: open the account menu in the app, choose Delete account, and confirm by typing the word it asks for. Deletion happens immediately and cannot be undone — your sign-in, saved workflows, Terms acceptance and profile are removed in the same step. Section 7 lists the enforcement records that are kept with your account ID removed. If you cannot sign in to do it yourself, ask us through the Contact page or the address in section 17 and we will do it within 30 days. The same route covers everything else on the list above.

We answer those requests from anyone, wherever you are, whether or not a law obliges us to.

Two honest limits. First, most of what we keep is either not linked to any identifier for you, or is linked only to a hashed IP address — where we cannot tell that a record is yours, we cannot single it out to hand over or delete. Second, enforcement records are kept as described in section 7.

If you are in the UK or the EEA. We are in the United States and have no establishment in the UK or the EEA, but the UK GDPR and the GDPR can still apply to us because of where you are — they follow the visitor, not the company. We work on the basis that they apply. On top of the list above you have the right to object to or restrict processing, the right to a copy of your data in a portable form, and the right to withdraw consent at any time. For analytics, withdrawing consent is the cookie settings link in the footer (section 12); withdrawal is as easy as agreeing was, and it does not affect anything collected before you withdrew.

You can also complain to a supervisory authority, and you do not have to come to us first. In the UK that is the Information Commissioner's Office, ico.org.uk. In the EEA it is the data protection authority of the country where you live, where you work, or where the problem happened — you complain to your own national authority, not to one of ours, because we have none. We would rather you told us first so we can fix it, but that is a preference, not a requirement.

We have no office, no staff and no appointed representative in the UK or the EEA, and we are not going to claim otherwise.

If you are in the United States. We operate from Wyoming, which has no comprehensive consumer privacy statute, so there is no Wyoming law giving you statutory data rights against us, and we are not going to pretend there is. Some other states have such laws; whether one reaches us depends on that state's own thresholds, most of which turn on revenue or data volume we do not have. Either way the list at the top of this section is open to you as a matter of policy.

14. Which law applies, and where we are

ComfyDetective is operated from the State of Wyoming, in the United States. The legal entity behind it is the data controller for everything on this page, and it is identified in section 17.

This policy is governed by the laws of the State of Wyoming and the United States, without regard to their conflict-of-law rules, and the state and federal courts of Wyoming are where a dispute about it would be heard.

That is our jurisdiction, not a limit on yours. The Service is reachable worldwide, so laws other than Wyoming's can apply to us because of where a visitor is — that is why section 13 sets out UK and EEA rights and why analytics is consent-gated (section 12). If the law where you live gives you the right to bring a claim locally, or to complain to your own regulator, this section does not take that away and is not meant to.

15. Children

The Service is not for anyone under 18 and we do not knowingly collect information from children. If you believe a child has used the Service, contact us and we will delete what we hold.

16. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and say so in the Service. Continuing to use the Service after a change means you accept the updated policy.

17. Contact

© 2026 ComfyDetective. All rights reserved.