One-Time-Use by Design: Why We Removed Saving and Collaboration

Most feature announcements are about something we added. This one is about something we removed, deliberately, after deciding it made the product better: the editors no longer save your work anywhere — not on our servers, and not in your own browser. You open a tool, do the edit, download the result, and when you close the tab, the session is gone. We call it one-time-use, and we think it is the honest shape for a privacy-first tool.

Here is what changed, and why we chose it over the alternative.

What we removed

Three things, all of which used to live in the image editor:

• Named projects. You could save an edit-in-progress to your browser's storage and reopen it later.
• Session restore. If you refreshed or came back, a banner offered to "Continue your previous session."
• Live collaboration. A peer-to-peer mode let a teammate join your edit over WebRTC.

They were real features, and some people used them. We took them out anyway.

The privacy argument for storing nothing

The core promise of these tools has always been that your images never leave your device. Everything runs locally: the AI, the encoding, all of it. That promise was already true. But "your files never leave your device" and "your files are never stored anywhere" are two different guarantees, and we were only making the first one.

Session restore and named projects meant your images — and the masks and layers derived from them — were being written to your browser's IndexedDB so they could come back later. That is genuinely local; it never touched a server. But it is still storage. On a shared computer, a library machine, or a work laptop that gets handed to the next person, "the tool remembered your last session" is not a feature. It is a leak.

The strongest version of a privacy tool is the one that has nothing to leak because it kept nothing. When we asked ourselves "what is the most defensible thing we can tell a user about their data," the answer that needed no asterisk was: we store nothing. You cannot recover what was never written down, and neither can anyone else.

The collaboration argument is about honesty

The collaboration mode was clever engineering — edits streamed peer-to-peer, and only descriptions of operations crossed the wire, never pixels. But it required a signaling server to introduce the two peers to each other, which meant the app was no longer purely client-side. It was one small server endpoint, but it was a real one, and it sat awkwardly next to a product whose entire pitch is "there is no server in the loop."

Removing collaboration let us delete that endpoint. The app is now genuinely static: the only server-side code left is the one that renders social-share preview images. "No server touches your work" went from mostly true, with a footnote to true, full stop. We would rather have the clean sentence.

"But now I can't save my work"

Correct — and we want to be direct about the trade-off rather than pretend it costs nothing. If you were relying on session restore, this is a real change to your workflow. The mitigation is simple and it is the same discipline that has always applied to any download-based tool: finish your edit and export the file. The exported PNG, WebP, or MP4 is the durable artifact. It is the thing you own, on your disk, that no browser-cache clear can take from you.

We think this is actually the healthier model. Browser storage was never a safe place to keep work that matters — a cache clear, a "free up space" prompt, or a different browser profile would wipe it without warning. Treating the tool as one-time-use makes that reality explicit instead of letting you build a false sense of permanence on top of ephemeral storage.

What we kept

We did not remove everything. Two things still persist locally, and both earn their place:

• Downloaded AI models. The background-removal and upscaling model weights are cached after the first download so you are not re-fetching tens of megabytes every visit. They contain no personal data, and you can delete them anytime from Downloads & storage.
• Your preferences. Theme choice and cookie-consent decision live in local storage. Small, non-sensitive, and yours to clear.

We also kept the share button, because sharing an exported result is not the same as storing your working session — you are choosing to send a finished file, deliberately, in that moment.

The principle underneath

There is a design idea called data minimization: collect and retain the least you can while still doing the job. Usually it is framed as a compliance chore. We think it is also just good product design for a certain kind of tool. A background remover does not need to remember you. It needs to do one clean job and get out of the way. Every byte it doesn't keep is a byte that cannot be lost, leaked, subpoenaed, or sold.

So the editors forget you the moment you leave. That is not a limitation we are apologizing for. It is the feature.

Try it — open the background remover or the image editor, do your edit, download the result, and close the tab with the confidence that you left nothing behind.