What this site can see

When you open a picture, the browser decodes it into memory in this tab and hands the pixels to a shader running on your own graphics hardware. There is no request that carries them anywhere, because there is nowhere for such a request to go: this site is a set of static files with no server behind it and no route that accepts data. You can confirm that yourself — open the network panel in your browser’s developer tools, grade a photograph, save it, and watch that nothing leaves.

Nothing about the picture is written to your device either, unless you ask for it (see “Keep the photo” below). No copy is cached, no thumbnail is kept and no file name is recorded; closing the tab frees all of it. What is written is your own shelf in the look library: recipes you save, looks you star, collections you name, and a short list of the looks you applied most recently. That lives in this browser’s local storage as look names, recipe names and numbers — never a pixel, a thumbnail or a file name — and it is never sent anywhere. The “Clear my library from this browser” button on the My recipes shelf removes it, as does clearing this site’s data in your browser settings.

If you tick “Keep my work if this tab reloads” in the inspector, the current recipe — numbers and a name, never the picture — is also kept in this tab’s session storage, so a reload can offer it back. It goes when the tab closes. A recipe link holds the same kind of numbers in the address itself, and an imported .cube used as a base look stays in the tab’s memory only.

Keep the photo (off unless you tick it). If you also tick “Also keep the photo itself for 24 hours”, the file you opened is stored in this browser’s IndexedDB — on this device only, never sent anywhere — so an accidental reload can offer it back. It is the file as you opened it, at its own size (files over 60 MB are not kept), together with the time it was kept. It expires 24 hours later and is removed the next time this site looks for it; it is replaced by the next photo you open while the option is on; and “Clear now” on the start screen, unticking the option, or the button below removes it at once.

The camera filters page asks the browser for your camera only when you press Start camera, never when the page loads. The video is drawn into a canvas in this tab and nowhere else: no video is kept until you press the shutter, a capture is one still kept in this tab, and no frame is ever sent anywhere. A “Camera on” indicator shows while it runs, and the stream stops when you press Stop camera, leave the page or hide the tab. This site’s headers allow the camera to this site only and to no embedded page.

Two helpers in the workspace use small models: one finds the people in a photo so a look can be held back on them (PP-HumanSeg, 5.9 MB, Apache-2.0), and one finds faces so the skin guard can centre on that person’s skin (YuNet, 0.2 MB, MIT). The batch page can use the same face model to level a set by faces. All are off until you press their button or tick their box, next to which the download size is shown. The model file is fetched once from our model file server and the runtime that runs it (ONNX Runtime Web, about 13 MB, MIT) from this site; each is checked against its recorded checksum and kept in this browser’s Cache Storage so the next use needs no download. The photo, the mask and the face boxes are made and used in this tab and are never sent anywhere — the download is a plain file fetch that carries nothing from you. “Clear everything” above also removes the cached models.

A photograph from a phone usually carries the coordinates of wherever it was taken, and those coordinates travel with the file to anyone you send it to. When you save a JPG from a JPG here, the camera body, the lens, the focal length, the exposure and the date are copied into the saved file and the location tags are removed, with no setting to keep them. That is true of every route that saves a single photograph, which is now all of them — the LUT route used to write a bare JPG with no capture data at all, and since 2026-09-19 it saves through the same path as the rest. Since 2026-10-24 the batch route does the same for every JPG it writes from a JPG: capture data kept, location removed. Saving as PNG, WebP or AVIF carries no capture data across at all, and a photo captured from the camera has no capture data to carry. Since 2026-11-01 every JPG also carries a small sRGB colour profile and every PNG an sRGB tag, so viewers show the colours as graded; that label describes the colours and says nothing about you.

The removal is done by overwriting the bytes of the location block inside the copy that gets written, rather than by unlinking it and leaving it in place. The original file on your device is not modified in any way by any of this.

This site uses Cloudflare Web Analytics to count how its pages are used. The beacon is cookie-free and reports to a property that belongs to this domain alone. For each page view it records the page path, the referring site, a coarse country, the browser and device type, and how quickly the page loaded.

It sets no cookie, writes nothing to your device, assigns no identifier and does not recognise you on a later visit. It is never given a photograph, its file name, its metadata, the look you chose or anything you saved. The beacon is only added when the page is served from picturefilters.com itself; a local copy, a preview build or a copy served from any other address loads nothing from Cloudflare at all.

Advertising on this site is served by Google AdSense; the ad script loads on the page but never receives your images, file names or anything you do in the tool. Advertising on this site is served by Google AdSense; the ad script loads on the page but never receives your images, file names or anything you do in the tool.

There are no accounts, so there is nothing to sign into and nothing to delete. There is no newsletter, no comment field and no upload. One piece of code from somewhere else runs here, and it is the measurement beacon described above, fetched from Cloudflare on the live domain. Together with the contact form below and the optional model download described above (a file fetched to you, with nothing sent), that is the only arrangement that ever talks to another server. If a future change meant a photograph had to leave the device for any reason, the honest thing would be to say so in large letters on the page rather than in an amendment here — and the simpler thing would be not to make that change.

There is one form on this site, on the contact page. It sends nothing until you press its send button; then it posts the name, email address and note you typed, along with this site’s domain, to a Google Form, where they are kept so someone can read and answer them. The page loads nothing from Google beforehand, it has no way to attach a photograph, and no tool on this site sends anything to Google.