Privacy

Pictures are not transmitted. There is no account to make, no file is stored, and the site has no server that could receive one. Advertising and traffic measurement are both described below, and neither of them is running on this build: no advert is requested and no measurement script is loaded. When either is switched on it will see the ordinary parts of a web request — a page address, a rough location derived from that address, a browser string — and never the contents of anything you open in the tool.

Choosing, dropping or pasting a picture hands the browser a reference to bytes on your own device. The page reads those bytes, asks the browser to decode them, resolves the orientation flag, and holds the result in memory as a bitmap. The reflection is drawn onto a canvas. The export is produced by asking the browser to encode that canvas, and is handed to you through the same download mechanism any link uses.

Nothing in that sequence writes to disk, to a database, to local storage or to a cookie, and nothing in it sends the picture anywhere. Closing the tab discards all of it. If the page is left open, the decoded bitmap stays in memory until it is replaced or the tab is closed, which is the ordinary behaviour of anything you have opened in a browser.

The one file that is fetched on demand is the HEIC decoder, and only when a HEIC picture is opened. That is a request for a code library from this site, not a request that carries your picture. The picture is decoded after the library arrives, here, in the tab.

Nothing counts page views here today. The measurement chosen for this site is a cookie-free one, and the property token it needs is still the placeholder the project was scaffolded with, so the page renders no script tag for it and no request goes to anyone. There is no beacon on this page to block.

When a real token replaces the placeholder, the script will record the address visited, a referrer where one exists, and coarse device and country information derived from the request. It will set no identifier, follow no one between sites, and have no way of knowing that a picture was opened, let alone which one. This paragraph is rewritten on the day that switch is made, not after it.

This site is built to carry Google advertising, and none is on it yet. Four positions are reserved in the source — two in the reading material under the tool, two in the guides, none above the working surface and none inside it — and the master switch for all four is off, because the domain has not been through AdSense review. While it is off a position renders nothing whatsoever: no band, no label, no script and no request to Google.

Once that switch is thrown, Google receives the request for each advert, which carries your address, your browser string and the page it appeared on, and it may set or read cookies for advert selection and frequency capping under its own policies and whatever choices you have made in your region. What it will not receive is the picture, or anything about it: a slot sits below the working surface and has no access to what happens inside it.

A content blocker will remove the slots whenever they do start appearing, and the tool will carry on working, because nothing about the operation depends on them.

No picture, no file name, no dimensions, no metadata read out of a file, no export, and no record that any of those existed. There is no account system, so there is no email address, no password and no profile. Nothing on this site asks you to identify yourself and nothing on it would have anywhere to put the answer.

If this policy changes in a way that affects what leaves your device, the change is described on this page rather than summarised as an update to terms. The two paragraphs above are the ones most likely to change, and each of them says what it will say when it does. This site publishes no contact address of its own, and the PictureEditor credit in the footer is plain text rather than a link, so there is nothing here to write to.