Privacy

Choosing a photograph here hands this page a file. The page decodes it into pixels in the browser’s memory, draws those pixels into the layout you picked, and — when you press save — writes a new file straight to your downloads. At no point in that sequence is anything sent anywhere. There is no server behind this site to send it to: the whole thing is a set of static files and the code that runs in your tab.

It is read from disk, its orientation flag is resolved so a portrait does not arrive sideways, and it is reduced to a working copy small enough that a dozen of them will fit in a phone’s memory at once. The full-size original is released immediately. The only time the original is read again is at the moment you save, when each photograph in turn is decoded at full size, drawn into its slot, and released before the next one opens.

None of that is written down anywhere. There is no local storage, no database, no cache of your pictures and no draft — close the tab and the arrangement is gone along with every copy the page was holding. The files on your device are never altered; everything the tool does happens to copies in memory.

One exception is worth naming precisely. If you open a HEIC photograph — the format recent iPhones use — the page downloads a decoder from its own host the first time, because no browser can read that format on its own. That download is code coming to your device. Your photograph still does not leave it.

Advertising is how a free tool like this one is meant to pay for itself, and the plan here is Google AdSense and nothing besides. It has not started. The domain is still in front of AdSense for review, so as this build stands no ad script is fetched, no ad frame is drawn on any route, and no advertising company has learned a thing from your being here.

When it does start, the units will sit in the reading matter underneath the working surface, never beside the canvas and never above it. Google will then get what an ad network gets anywhere: your IP address, which page of this site you opened, and whatever its own cookies and identifiers already knew about you before you arrived. What it will not get, then or ever, is a photograph. Pictures you open exist as pixels in this page’s own memory and are handed to no other script.

Nor is your visit counted. No measurement property has been set up for this domain, so this build ships no beacon, sets no cookie and keeps no record that the page was ever opened — there is no account system and no email capture to keep one in. If a counter is added later it will be a cookie-free one, with no cross-site identifier and no property shared with another site, and this paragraph gets rewritten the same day. A privacy page describing yesterday’s configuration is worse than no privacy page at all.

This is a general-audience tool and nothing here is directed at children. No personal details are collected, so there is nothing to request a copy of or ask to have deleted — the honest answer to a data request would be that the site holds nothing about you.

If this page changes, the change will be to describe something the site does differently, not to quietly widen what it collects. The one commitment that will not change is the first one: your pictures are not uploaded, because there is nowhere to upload them to.