Privacy

When you drop, choose or paste a picture, the browser hands this page a reference to the bytes on your own disk or clipboard. Those bytes are decoded into an image the page can draw, measured, and painted onto a canvas element. When you press save, the canvas is encoded into a JPG, PNG or WebP and passed to your browser's own download machinery.

No step in that sequence involves a network request carrying your picture.

There is nowhere for it to go. This is a set of static files — HTML, CSS and JavaScript — served from a content network. It has no server-side code, no upload endpoint, no database and no storage of any kind. A file closed or a tab refreshed takes the working copy with it; there is no draft kept anywhere, including in your own browser.

One exception is worth naming precisely. If you open a HEIC file from an iPhone, the page fetches a decoder — a WebAssembly module — the first time it meets one, because browsers cannot read that format on their own. That request downloads code to you. It sends nothing of yours anywhere, and it never happens for any other format.

A JPG from a camera or a phone usually carries an Exif block: shutter speed, lens, the date, and frequently the exact coordinates where you were standing. Canvas encoding discards all of it, so by default the file you save is clean — which is the right default for a picture going onto the internet.

The Output panel has a checkbox that keeps it, for the cases where you want the camera information preserved. Ticking it lifts the original block out of your file and splices it into the new one, with the rotation tag reset to upright because the pixels already are. That operation happens on your device like everything else, and we never see either version.

Nothing is, today. There is no measurement property configured for this domain, so the beacon that would report a visit is left out of the HTML rather than shipped with a placeholder that collects nothing. Look at the source of this page and you will not find one. No cookie is set here either, by us or by anybody, and nothing about you is stored in the browser between visits.

The intention is Cloudflare Web Analytics, which needs no cookie and keeps no identifier that follows a person between visits or between sites. If it is ever switched on, this paragraph is the one that changes, and what it would then record is the page address, the referrer if there was one, and a coarse idea of the device.

What no counter here would ever see is your picture. Not its name, not its size, not its format, not the shape you asked for, not whether you saved it. The tool has no line back to a counter of any kind, and building one would be a change to this page as much as a change to the code.

This site is built to carry advertising from Google AdSense, an ordinary third-party ad network, in bands below the working surface. It is not carrying any at the moment: the domain has not been through AdSense review, no ad code is requested, and no band is drawn on the page you are reading. This section is here in advance because a disclosure written before the fact is worth rather more than one added quietly afterwards.

When the domain is approved and those bands begin to fill, what Google sees is what any embedded advertisement sees: the address of the page it sits on, your IP address, and whatever your browser and your own Google settings hand it. Those practices are Google's, governed by Google's policies, and what it personalises can be changed through your own Google ad settings.

What it is never given is any part of your photograph or any part of what you did with it. The placements sit outside the working surface in frames of their own, and there is no code on this site that passes a file name, a shape, a fill or a saved export into one. Nor may anything advertising sit above or inside the tool, which is a rule the layout enforces rather than an intention.

This site is not aimed at children and asks nobody for personal details, because it has no way to store them. If this policy changes, the changed version replaces this page — there is no mailing list to notify, since we do not have your address. Questions about what happens here can go to the parent site named in the footer.