What happens to your image

Your image is held in memory for the duration of a single HTTP request. It is never written to disk: there is no upload directory, no temporary file, no object-storage bucket and no database. The cleaned image is returned as the body of the response itself, which means no download URL is created and there is nothing that could be visited, guessed or shared later.

Buffers are overwritten and released in a finally block, so the release happens on the success path and on every failure path — a rejected file type, a corrupt image, a decoder error, a timeout. A background sweeper additionally force-releases anything that outlives its configured lifetime, five minutes by default.

The metadata report you see after choosing a file is produced in your browser, by the same parser the server uses. Nothing is transmitted until you press Clean Image. If you change your mind at that screen, your image never left your machine at all.

• Uploaded images are never used to train models, ours or anyone else's.
• Image data is never sold or shared with data brokers.
• Images are never sent to a third-party AI or vision API. Processing is done locally on the server with libvips (via sharp), a conventional image library.
• There is no image gallery, no history, no account and no public image URL of any kind.

To tell you what is in your file, the parser identifies which metadata segments exist and how large they are. It records categories, not values. When an image contains GPS data, the report says “Location metadata detected” and stops there — the coordinates are never read into the report, displayed on screen, or sent anywhere. The same applies to camera serial numbers, timestamps and captions.

Categories that may be detected: EXIF, location, camera and device, software, date and time, XMP, IPTC, embedded thumbnails, comment blocks, C2PA provenance manifests, AI generation declarations, and colour profiles.

An ICC colour profile is not information about you — it describes how the pixel values should be rendered. Discarding it silently would visibly shift the colours of a wide-gamut image. By default the image is converted into standard sRGB and a generic sRGB profile is attached, so the file looks the same as before while carrying no device-specific colour data. This is reported as “preserved” rather than “removed”, because that is what happened.

No image bytes, filenames, metadata values, image hashes or image URLs are written to any log. If an unexpected error occurs, the log line contains a random job identifier and an error class name — nothing derived from your file. Your hosting provider will still keep its own standard HTTP access logs, which typically include IP addresses and request paths; that is outside this application's control.

To keep the service available, requests are counted per client address in a short rolling window. The address is reduced to a non-reversible hash before being used as a counter key, the counter holds only a number and an expiry, and entries are discarded as soon as the window closes. Nothing about the request or its contents is retained.

Analytics are disabled by default and the deployment must explicitly enable them. When enabled, only event names and coarse technical properties can be sent — which format was processed, a size bucket rounded to the nearest 100 KB, a duration, or an error code. Image contents, filenames, metadata values, GPS data and image hashes cannot be transmitted: the analytics interface has no field that would accept them.

The application sets no cookies and does no cross-site tracking. Your theme preference is stored in your browser's local storage and never leaves your device.

The default build loads no third-party scripts, trackers, advertising or embedded content. The interface font is served from the application's own domain rather than a font CDN. The only third party involved is whoever hosts the deployment you are using.

AI Remove Pilot cleans embedded image metadata and supported provenance information. Social platforms may use additional signals to determine whether an image is AI-generated, so cleaning an image does not guarantee removal of an AI-generated-content label.

Removing embedded metadata is a real and useful privacy improvement. It is not the same thing as controlling a third-party platform's classification of an image, and we do not claim it is. See the FAQ for a fuller explanation.

Maximum image size is 3 MB by default and is configurable per deployment. Supported formats are JPG/JPEG, PNG and WebP.