Privacy

The short version. No part of your picture is transmitted — not the pixels, not the EXIF block, not the filename; and while no advertising or measurement runs here, the only bytes this site fetches at all are its own code and fonts.

What happens to a file you open

Choosing a file, dragging one in or pasting one hands the browser a reference to something already on your disk. This site reads it into memory in the tab, decodes it, draws it on a canvas, and — when you press save — writes a new file and hands it to the browser’s own download machinery. Every one of those steps happens on the machine in front of you. At no point is there a request carrying picture data, because there is no address for such a request to go to: the whole site is a set of static files and there is no server component that could receive one.

Nothing is kept. The decoded picture lives in the tab’s memory until you open another file, navigate away or close the tab, and then it is gone. There is no browser storage of image data, no cache of anything you opened, no account, and no history of files. Reloading the page gives you the empty panel again, which is the honest consequence of not storing anything.

What is fetched, and from where

• The page itself, its stylesheet and its scripts, from this site’s own domain.
• Two typefaces, self-hosted here and subset, so that reading this page does not tell a font service that you are on it.
• Decoders and writers, and three of the four only when they are needed: a TIFF decoder the first time you open a TIFF, a HEIC codec the first time you open a HEIC, and the EXIF writer the first time you save. The ZIP builder is not fetched separately — it is a few kilobytes written here rather than a library, and it arrives with the batch page itself. Each is code, all of it comes from this site, and none of it is given a picture to send anywhere because none of them can send anything.
• Nothing else at present. No advertising script and no measurement beacon is fetched by this site today; the two sections below say what each would do if one were, and neither could be handed anything about the picture, because the picture is handed to nothing.

Measurement

Nothing is measuring you here. The build reserves a place for a cookie-free counter — the kind that records that a page was opened, which page it was, roughly what part of the world the request came from and what sort of browser made it — but the property it would report to has never been created. The token in the source is still the placeholder the scaffold shipped, and the code that would emit the beacon checks for exactly that and leaves it out of the page rather than aiming a request every visit at somewhere that does not exist. So no count of this visit is kept anywhere: no cookie, no identifier, no log this site can read.

If a counter is ever switched on, it will be of that shape and no other — its own property, no identifier shared with any other site, and no way to observe anything that happens inside the tool, which file you opened, what angle you chose or whether you saved. This paragraph will be rewritten in the same change that switches it on, and a check in the build fails if the two ever disagree.

Advertising

This site is built to carry Google advertising, and no advertisement is served on it yet. The account has not been approved for this domain, so the placements in the layout render nothing whatever — no unit, no label, no band of held height. The disclosure is here anyway, because it describes the arrangement accurately once the domain is approved, and because the time to read what an ad script will be able to see is before it starts rather than after.

What it will see is the page, not the picture: the address you are on, the referring address if there is one, an approximate location derived from the network, and whatever cookies or identifiers Google itself sets for advertising. Its place in the layout is fixed — below the working surface, inside the reading matter, never above the tool and never within it — and it will never be handed a photograph or anything computed from one, because a decoded picture never leaves the canvas it is drawn on.

Google’s own controls decide what it does with what it sees; those settings live with Google, not here, and adjusting them at My Ad Center affects every site using AdSense, this one included — including this site, once it serves anything. A content blocker works too, and the tool is unaffected either way.

Children, and the rest of the boilerplate

This site is not directed at children, collects no personal information from anyone, and has no mechanism to collect any: there is no form, no login, no email field and no upload. There is consequently no data to request, correct or delete, and no data-retention period to state beyond the life of the tab.

If this policy changes, the change will be to this page and dated in the same breath. Last reviewed 10 September 2026.