Your profile picture sits at the top of **Settings → Personal Details**. Click the avatar (or the small camera button at the bottom-right of it) to open the upload modal.
**What's supported** - JPG, PNG, or WebP - Up to 5 MB before crop - Drag to reposition, slider or pinch to zoom, what you see in the circle is what gets saved - Output is a 512×512 image, automatically re-encoded to WebP
**Source of truth**, when you sign in with Google, your Google avatar syncs into JustPayMe on every login. As soon as you upload a custom picture, that becomes the source of truth and Google won't overwrite it on subsequent logins. Click **Remove picture** to revert: we delete the custom file and re-sync the provider avatar on your next login (or leave it blank for password-only accounts).
**Privacy & security**, the file you upload never lands on disk untouched. We decode it through an image library, strip every byte of metadata (EXIF, GPS coordinates, embedded scripts in malformed files), resize to 512×512, and re-encode as a clean WebP. SVG uploads are rejected because they can carry executable script. The processed file is stored in private cloud storage; the avatar URL surfaced to your browser is short-lived and refreshed on every page load.
**Rate limit**, up to 10 uploads per hour per user. If you hit the limit, retry in a few minutes.
Your profile picture sits at the top of **Settings → Personal Details**. Click the avatar (or the small camera button at the bottom-right of it) to open the upload modal.
**What's supported** - JPG, PNG, or WebP - Up to 5 MB before crop - Drag to reposition, slider or pinch to zoom, what you see in the circle is what gets saved - Output is a 512×512 image, automatically re-encoded to WebP
**Source of truth**, when you sign in with Google, your Google avatar syncs into JustPayMe on every login. As soon as you upload a custom picture, that becomes the source of truth and Google won't overwrite it on subsequent logins. Click **Remove picture** to revert: we delete the custom file and re-sync the provider avatar on your next login (or leave it blank for password-only accounts).
**Privacy & security**, the file you upload never lands on disk untouched. We decode it through an image library, strip every byte of metadata (EXIF, GPS coordinates, embedded scripts in malformed files), resize to 512×512, and re-encode as a clean WebP. SVG uploads are rejected because they can carry executable script. The processed file is stored in private cloud storage; the avatar URL surfaced to your browser is short-lived and refreshed on every page load.
**Rate limit**, up to 10 uploads per hour per user. If you hit the limit, retry in a few minutes.