What this site can see

When you open a picture, the browser decodes it into memory in this tab and hands the pixels to a shader running on your own graphics hardware. There is no request that carries them anywhere, because there is nowhere for such a request to go: this site is a set of static files with no server behind it and no route that accepts data. You can confirm that yourself — open the network panel in your browser’s developer tools, grade a photograph, save it, and watch that nothing leaves.

Nothing about the picture is written to your device either. No copy is cached, no thumbnail is kept, no name is recorded, and the look you chose is not stored between visits. Closing the tab frees all of it. That is also why there are no favourites and no saved presets here: both would mean writing something down, and this page would rather be able to say plainly that it does not.

A photograph from a phone usually carries the coordinates of wherever it was taken, and those coordinates travel with the file to anyone you send it to. When you save a JPG from a JPG here, the camera body, the lens, the focal length, the exposure and the date are copied into the saved file and the location tags are removed, with no setting to keep them. That is true of every route that saves a single photograph, which is now all of them — the LUT route used to write a bare JPG with no capture data at all, and since 2026-09-19 it saves through the same path as the rest. The batch route is the exception and carries nothing: forty files go out with pixels only, which is a stronger privacy outcome and a weaker one for anybody who wanted their exposure data. Saving as PNG or WebP carries nothing across at all.

The removal is done by overwriting the bytes of the location block inside the copy that gets written, rather than by unlinking it and leaving it in place. The original file on your device is not modified in any way by any of this.

Cloudflare Web Analytics records aggregate use of these routes. Its cookie-free beacon reports the requested page, referring site, coarse country, browser and device type, and page-load performance to a property belonging only to this domain.

It writes nothing to your device, sets no identifier and does not recognise you on a later visit. The filter surface sends it no photograph, metadata, preset choice or saved result.

There is no advertisement on this page as you are reading it. The account these placements would draw from has not come back from Google’s review, and until it does every one of them renders nothing whatsoever — no band, no label, not even a gap held open for one.

This site is built to carry Google advertising and means to: one unit under the reading on each tool route, three at the pauses of a long written piece, all of them below the working surface. Once they arrive, fetching an advertisement is a request made to Google, and whatever Google makes of the address, the browser and the connection behind that request is decided by Google rather than by anything written on this page. The part this site does decide: nothing sits above or beside your picture, nothing about the photograph itself is handed to anyone, and every placement holds its height before it fills, so the words under your cursor stay where you left them.

There are no accounts, so there is nothing to sign into and nothing to delete. There is no contact form, no newsletter, no comment field and no upload. One piece of code from somewhere else does run here, and it is the measurement beacon described above: it is fetched from Cloudflare on every page of this site, this one included. Saying otherwise two paragraphs after describing it would be the kind of sentence that makes the rest of this page worth less. Those two arrangements are the only ones that are ever meant to run. If a future change to this site meant a photograph had to leave the device for any reason, the honest thing would be to say so in large letters on the page rather than in an amendment here — and the simpler thing would be not to make that change.