Privacy

• Photographs are read by the page and never transmitted. There is no server here to transmit them to: the whole site is static files on a content network.
• Nothing about a picture is stored — not the pixels, not the file name, not the dimensions, not the region you painted. Closing the tab ends it.
• There are no accounts, no sign-in and no email address to give.
• Nothing counts a visit. The measurement identifier in this build is still the scaffold placeholder, so no beacon element is emitted, no request goes out, and no page view is recorded anywhere.
• Advertising is not running here yet. Google AdSense is how this site is meant to be funded and that is disclosed whether or not an advert has ever been served; what a third-party script would be able to see is set out below.

Picking a file hands this page a reference to it. The bytes are read into memory, the front of the header is parsed to establish what kind of file this actually is and what the camera recorded about rotation, and the pixels are decoded into a canvas. From that point the picture exists as arrays of numbers inside the tab. The region you paint is another array. The fill is arithmetic over both. What you save is assembled in memory and passed to whatever the browser uses to put things in a downloads folder.

None of those steps involves the network. The audit that runs before this site is published fails the build outright if a module that touches image data acquires the ability to make a request. A check a machine runs is worth more here than a sentence somebody wrote.

One deliberate exception exists and is worth naming precisely. If a HEIC photograph from an iPhone is opened, a WebAssembly decoder of roughly one and a half megabytes is pulled down, because no browser reads that container on its own. That request asks for a fixed static file and carries nothing about your picture. It happens only when such a file is actually opened, never on a plain page view.

Every EXIF field in the original — camera, lens, exposure, the date, and the location if your camera recorded one — is absent from the file this page saves. None of that is a feature added on top: it falls out of the way a browser writes a canvas into a file, and it is the right outcome regardless. The pixels have been rewritten, so carrying forward a capture record that describes a photograph nobody took would be a small lie. If you need that data, keep the original, which this page never modifies.

No traffic counter ships in this build. The measurement identifier in src/lib/analytics.ts is still the placeholder the scaffold arrived with, and the layout tests it before rendering anything at all: a placeholder means the beacon element is never written into the page, so no third-party request leaves your browser and no view of any address here is recorded — not by this domain, not by anyone it hands off to, not in aggregate. The number of people who have read this sentence is genuinely unknown to us.

What is intended, and what this section will be rewritten to describe on the day it ships, is a cookie-free counter logging the address requested, the address the visit arrived from, and a country at about the resolution of a pin on a continent. It would write nothing to your device, assemble no history across visits or across domains, and stay walled off from the working surface, so that whether a photograph was ever opened would not be something it could observe. None of that is happening today. The build gate reads that file and this page together and refuses to publish if the two ever disagree in either direction.

Google AdSense is how this site is meant to be paid for, and it is disclosed here whether or not a single advert has yet been served. None has. Advertising is not running on this page as you are reading it: the domain has not been approved, the master switch in src/lib/ads/slots.ts is off, and each placement renders literally nothing rather than an empty band with a label over it.

Once Google approves the domain that switch flips and their script begins to load, so the rest of this belongs here in advance rather than after the fact. A third-party advertising script sees what any script on a page sees: the address you are on, your browser and the language it asks for, an approximate location derived from the connection, and whatever their own record of this device already holds. It does not and cannot see your photograph. The picture exists only as numbers in this page's own memory, behind a boundary the build audit enforces by refusing to publish an image module that has acquired the means to make a request, and there is no path that would hand those numbers to anybody.

Google's own advertising settings govern what is used to choose adverts, once there are adverts to choose. Blocking the script changes nothing whatever about the tool — which is easy to say today, with nothing to block, and will still be true then.

Should any statement above cease to be accurate, this page is edited before anything ships, and the edit is spelled out rather than buried under a version number. A site whose whole proposition is that nothing leaves the device does not get to alter that quietly.