Privacy

When you use the tools on this site, your file is read and processed inside your browser. It is not uploaded. There is no copy of it on a server, which means there is nothing for us to keep, examine, hand over, or lose.

You can verify this: open your browser’s developer tools, switch to the Network tab, and use the tool. Selecting a file produces no request. You can also disconnect from the network after the page has loaded: analysing, cleaning and editing keep working, batch included. Converting, HEIC decoding, MP3 encoding and the PDF preview each fetch their codec from this site the first time they are used — a request to us, not a transfer of your file — and without a network those four are exactly what fails.

Nothing, when you use the tools on this site. Analysis, cleaning, editing and batch processing all run as JavaScript in the page. Files are read with the browser’s File API, parsed there, and any result is handed back as a local download.

There is one exception, and it is deliberate rather than hidden: the HTTP API is a server-side service for integrations. If you or a product you use calls it, files are sent to our servers. The next section describes exactly what happens to them.

The distinction matters. We say “processed in your browser” about the website, not about every part of the product, because the API genuinely receives files.

It exists only in the memory of the process handling that single request. It is used to carry out the operation requested and nothing else.

• No temporary file is created. The bytes are never written to disk, so there is nothing to delete afterwards and no orphaned data to clean up after a crash.
• Files are never stored, never retained after the response, and never used to train anything.
• The uploaded filename is never used as a path. Responses derive a download name from a sanitised version of it.
• Responses are sent with Cache-Control: no-store, so they are not retained by intermediate caches.
• When the response has been sent, the buffer is released and the data is gone.

The application writes no log line containing anything derived from your file. Not the filename, not a metadata value, not a coordinate, not the contents. This is a property of the code: error paths deliberately discard detail rather than record it, because parser errors can contain fragments of file content.

A web server or hosting provider in front of the app will keep its own access logs — typically the time, the requested path, a response code and an IP address. That is standard infrastructure logging and records no file content.

The API is rate limited per client. The counter is keyed on a short hash of the address, held in memory only — never written anywhere, never logged, and discarded when the window expires. We do not call it non-reversible: it is 32 bits, and there are fewer IPv4 addresses than that. The protection is that it exists nowhere, not that it could not be undone.

An account is optional — every tool on this site works without one. If you create one, this is the complete list of what exists in the database. It is the schema, not a summary of it:

• Your email address, lower-cased, and the date the account was created.
• A hash of your password, produced with scrypt. The password itself is never stored and never reaches our logs.
• A hash of each sign-in token, with its expiry. The token lives in your cookie; the database has only its SHA-256, so a database disclosure yields no usable sessions.
• Aggregate counters — operations today, API calls this month — so plan limits can be enforced. Four numbers. There is no column in which a filename, a metadata value or a coordinate could be recorded.
• Your subscription, if you have one: plan, status, when the period ends, and the identifiers the payment provider uses for you.
• A hash of each API key, with the name you gave it and its first few characters so you can recognise it in a list. The key itself is shown once, at creation, and never again.
• Presets you save, if you save any. A preset holds the field values you typed in order to write them into your own files — an author name, a copyright line. That is your text, kept because you asked for it to be reusable. It is not metadata read out of a file by us: nothing read out of a file reaches a server at all.

And nothing else. No file, no filename, no metadata extracted from a file, no IP address, no name, no address, no payment details.

Sign-in tokens expire after 30 days and are deleted from the database when an expired one is next presented. Signing out deletes that session immediately.

Everything else — your email address, password hash, counters, subscription record, API keys and presets — is kept for as long as the account exists. There is no automatic expiry, because an account that quietly disappeared would be worse than one that stays.

This deployment stores accounts in a database that survives a restart.

You can delete your account autonomously at any time from your Dashboard. A single click is enough to remove your account and all associated data.

The database is built so that this is one operation rather than a hunt: every record above is tied to the account with a cascade, so deleting the account deletes the sessions, counters, subscription record, API keys and presets with it. Everything is removed instantly.

No payment can be taken on this site today: no payment provider is connected, and a production build refuses to start a checkout without one. When that changes, checkout will happen on the provider’s own pages, so card details will never reach this application — we would learn only your subscription status and when the period ends.

Who else sees anything

Nothing in this deployment contacts anybody else. No advertising, no tag manager, no error-reporting service, no embedded fonts, no map tiles, no content delivery network for scripts. The Content-Security-Policy served with every page admits no origin but this one, so a request elsewhere could not succeed even if something tried.

The contact form is not configured on this deployment and refuses messages rather than accepting them, so nothing is sent anywhere.

What is counted

No analytics of any kind. Nothing counts what you open or what you do here, on this origin or anywhere else.

Coordinates found in a photo are shown as text rather than plotted on a map, because rendering map tiles would disclose the location of your photo to a tile provider.

The site sets one cookie, and only after you sign in. Your file is never remembered between visits. Full detail is on the cookies page.

A file you clean or edit is produced in your browser and offered as a download. Where it goes then is up to you and your device. Nothing is retained by the page once you navigate away or close the tab.

The original file on your device is never modified. Cleaning produces a new file with a -clean suffix, so you always keep the original.

Removing metadata removes metadata. It does not anonymise the content of an image: a photograph can identify a location or a person through what it shows.

It also has no effect on what a platform learns when you upload something there — your account, your IP address, the time of upload. And if you have already shared the original file, cleaning your copy afterwards does not reach the copy you sent.

If you would rather not trust a description, run it yourself: the application needs no database for the free tools, no external service and no API key, and reading, cleaning and editing work with the network disconnected once loaded.

The supported formats page lists precisely which operations are implemented for which formats.