The server receives the uploaded .avatar file for decryption. On save, it receives the edited data for encryption. These routes process the file contents in memory.
Loading also sends decrypted avatar data to the statistics service. That service retains extracted outfit and appearance configuration, an upload hash, and a hash derived from the request IP address. It does not simply store anonymous item counts.
See the Privacy Policy for a fuller description and contact information.