Release Privacy Tools 0.1.0

2026-09-01 02:39:44 +02:00
commit bfd6422149
79 changed files with 13485 additions and 0 deletions
@@ -0,0 +1,59 @@
+# Privacy and security
+
+## Data handling
+
+Files are read with browser file APIs and transferred to an in-page worker.
+There is no upload endpoint, account, telemetry, analytics, remote metadata
+lookup, or automatic persistence. Temporary object URLs exist only for the
+legacy image-element decode fallback and are revoked immediately after decode.
+Download object URLs are created and revoked by the shared helper. Refreshing or
+closing the page discards application state.
+
+Service-worker support may fetch and cache the same-origin application shell;
+it does not cache imported files, metadata findings, reports, or generated
+images. Metadata URLs and XMP/XML markup are inert text and are never fetched or
+rendered as HTML.
+
+## What is inspected
+
+Every file receives byte-signature inventory and SHA-256. Static JPEG, PNG, and
+WebP receive project-owned deep container parsing plus ExifReader. TIFF,
+HEIC/HEIF, AVIF, and JPEG XL receive best-effort ExifReader inspection only.
+GIF and document/archive formats receive inventory only. Exact per-format
+fields are listed in the README support table.
+
+All parsers are bounded, but a “complete” scan means complete for implemented
+structures—not proof that no steganographic or novel carrier exists. Unknown
+private chunks and trailing bytes are surfaced. ExifReader failures and format
+limitations remain visible in coverage.
+
+## Re-encoded outputs
+
+Only complete, static, dimension-bounded JPEG/PNG/WebP project scans are
+eligible. The application decodes pixels, normalizes display orientation, and
+uses Canvas to encode a new file of the detected type. It does not selectively
+strip GPS while copying everything else, because duplicated values can live in
+multiple namespaces and embedded previews. It copies no source metadata block.
+
+The output is always scanned and hashed again. Sensitive or provenance findings,
+partial project coverage, or an oriented-dimension mismatch produce a failed
+gate. Secondary-parser limitations and provenance invalidation produce explicit
+warnings. JPEG and lossy WebP may change pixels; profiles, resolution metadata,
+thumbnails, comments, and application history may be lost. PNG is expected to
+preserve decoded pixels, subject to browser colour management.
+
+C2PA/JUMBF carries authenticity/provenance claims. Re-encoding normally removes
+or invalidates those claims. The tool reports that effect rather than describing
+it as an ordinary privacy win.
+
+## What this cannot promise
+
+No result promises anonymity or safe publication. The tool does not remove or
+detect visible faces/text/locations, steganography, invisible watermarks,
+camera-pattern or image fingerprints, reverse-image matches, sidecar files,
+filesystem metadata, clipboard/history records, application caches, backed-up
+originals, or cloud/recipient copies. Review the visible output, destination,
+report, and surrounding files yourself.
+
+The JSON report is sensitive by design: it can include original filenames,
+hashes, timestamps, and metadata values. Share or retain it only intentionally.