Privacy

No server sees this image. The PNG is decoded here, the matte is applied here, and the JPG is written straight to your downloads folder.

What happens to a file you open

• The browser hands this page a reference to the file. The first megabyte is read to walk the PNG chunks, and the rest is read to decode the pixels.
• Decoded pixels are held as an ImageBitmap and put nowhere else: not into local storage, not into session storage, not into IndexedDB. A build audit fails the release if any of those three names turns up in code that can reach an image buffer.
• The composite and the JPEG encode run on this machine, in a worker where the browser provides one and on the page itself where it does not.
• The result is a blob in memory. The download control hands that blob to the browser as a file.
• Nothing about the file — not its name, its size, its dimensions or its contents — is transmitted. There is no server behind this site and no endpoint that could accept one.
• Closing the tab discards all of it. There is no history, no recent list and nothing to clear.

What is measured

Nothing, today. No measurement property has been registered for this domain, so the pages ship without a beacon at all: read the source of any of them and there is no measurement tag, no request goes out to a measurement host, and no figure about a visit is written down anywhere. Shipping a beacon against an unconfigured property would add a third-party request to every page load and collect nothing from it, which on a site whose argument is that it sends nothing would be a poor trade.

If one is ever registered it will be a cookie-free product on a property belonging to this domain alone, never a shared identifier across several sites, and what it would see is a URL, a referrer, and coarse browser and country figures. What it could not see, before or after, is anything about a picture you opened: that never leaves the tab. This section is rewritten on the day such a script first ships, not afterwards.

What the advertising would see

This site is built to carry Google AdSense and there is no advert on it yet. The domain has not been approved for an account, the switch that renders a unit is off in the source, and nothing is drawn where a unit would go — so if you came to this section wondering what is watching you from a slot on the page, today the answer is that no slot is being drawn. The placements are already decided: one band below the questions on a converter route, three inside a note, and none above the picture or between the picture and the swatch row.

Once a unit does render, serving it hands Google the request information any web request carries — an IP address, a user agent, and the address of the page the unit sits on — and Google may use cookies or similar technology in line with its own policies, which you can review and adjust in its ads settings. What an advert will not have, then or now, is the picture. An advert is markup in the page; the picture is pixels in a worker; no path runs between the two.

What is not here

• No account, no sign-in, and no email address is asked for.
• No image is stored, queued, cached on a server or retained for any period, because none reaches one.
• No cookie is set by this site itself.
• No cross-site identifier, and no roll-up with any other domain.

Changes

If any of the above stops being true, this page changes on the same deploy as the code that made it stop being true. A privacy page that is updated afterwards has already been wrong for however long that took.