Privacy

A file you open is read by the browser into memory, worked on there, and written back out when you press save. It is never transmitted. It is never written to storage of any kind — not a database, not the browser's own local storage, not a cache. Close the tab and every trace of it is gone, including whatever settings you had reached.

Open the network panel in your browser's developer tools before you open a photograph. You will see the page load, the fonts load, and — the first time a HEIC arrives — a WebAssembly decoder load. You will not see a request carrying image data, because there is no code in this site that could make one. A build-time audit fails the release if any module that touches an image buffer references a network or a storage API, and a second audit fails it if a server route appears at all; this site is a set of static files with no server behind it.

If you prefer a stronger test: load the page, then disconnect from the network completely, then open a photograph and sharpen and save it. Everything works, because nothing in the operation needed the network in the first place.

Advertising here is Google AdSense, and it is not running. The domain has not cleared review, the master switch in the source reads false, and the placement component returns nothing at all — no script tag, no reserved band, no request to any Google advertising host. The network panel settles that in about ten seconds, which is worth more than this paragraph asserting it.

Once the account is approved that changes, so the disclosure is written now rather than after the fact. Three placements are already positioned in the layout, below the working surface and inside the reading material. The moment they begin serving, Google's code receives what advertising code receives anywhere on the web: the address of the page, your IP address, your browser's user agent, and whatever identifiers its own cookies and settings carry. It does not receive the photograph. The picture exists as an array of numbers inside this tab and is handed to no script that did not come from this origin, which is a property of the architecture rather than of the ad account.

There is no traffic counter here either. Cloudflare Web Analytics is what would go in — cookie-free, no profile, one beacon noting that a page was requested, roughly from where, and how quickly it rendered — but the token in the source is still the placeholder the scaffold shipped, and the layout emits no beacon while that is true. Nothing about your visit is recorded, by this site or on its behalf. A build gate reads the two switches and this page together and refuses the release if either side moves without the other.

This is a general-audience utility with no account system, so no personal information is collected here by this site under any lawful basis — there is no form to fill in and nothing to sign up to. No third-party script executes on these pages at present, so the only processing described above that has any subject today is none of it; when the advertising begins, Google's own policy governs its half, wherever its code appears.

If the architecture ever changes — if any feature is added that sends a file somewhere — it will be labelled where it appears, not only described on this page, and this policy will say so plainly on the date it happens. As it stands there is nothing of the sort in the build.