Privacy

The picture never leaves this tab, so there is no copy of it to leak.

No picture you open here is transmitted, stored, queued, logged or kept. There is no server to send one to: this site is a set of static files, and the work happens in the tab in front of you. Closing the tab is the deletion step, and it is complete.

One request does go to another domain, and only if you ask for it. Pressing the face finder downloads a model file from cdn.pictureeditor.com — 224 KB, 229,738 bytes exactly, called face finder and licensed under MIT. That request asks for a file. It does not carry your picture, any part of it, or anything derived from it. The file then runs on your own processor.

• It is read by the browser into memory and drawn onto a canvas. It is never uploaded.
• Orientation is applied to the pixels at that point, so nothing rotates unexpectedly later.
• Regions you draw exist as four numbers each. They are not saved anywhere, on this device or elsewhere.
• Saving composites the picture at full size, runs every region against it, and encodes the result. The download is written by your browser, to wherever your browser writes downloads.
• Nothing is written to local storage, session storage or a database. The one exception is described below.

That exception: if you download the face-finding model, the browser’s cache keeps a copy so a second picture does not pay for it again. It is a model file and contains nothing about you or your pictures. Clearing this site’s storage in your browser removes it.

Advertising is not enabled on this site today. The placements are designed and reserved in the layout — three of them, all below the working surface, never above it or inside it — but nothing is requested and no advertising network is contacted, because the domain has not been through approval yet. This paragraph changes in the same release that switches it on.

When it is switched on it will be Google AdSense, placed by hand. What an advertising network would see then is what it sees on any page: the request for the advert, the address of the page, and whatever your browser already tells it. It would have no access to the canvas, to any picture you open, or to anything you drew on it — that data never exists outside the tab, so there is nothing to be shared. A content blocker stops such requests entirely without affecting the tool.

No measurement script ships with this site at the moment: the build carries a placeholder where a token would go, so nobody is counting and no beacon is loaded. When one is configured it will be a cookie-free script that records page addresses and referrers in aggregate, setting no cookie, building no profile and following you nowhere — and this paragraph will say so in the present tense rather than this one.

Whatever is measured, it will never include anything about the pictures you open. There is no mechanism by which it could: those pixels do not leave the tab.

• No accounts, no sign-in, no email address collected anywhere.
• No image storage of any kind, temporary or otherwise.
• No social widgets, embedded players or third-party fonts. The two typefaces are served from this domain.
• No cross-site tracking pixels.

Questions about anything on this page can go to the address published on the terms page. If something here is wrong or has fallen out of date, saying so is useful and it will be corrected in the same week.