# Privacy and security

## Data handling

Files are read with browser file APIs and transferred to an in-page worker.
There is no upload endpoint, account, telemetry, analytics, remote metadata
lookup, or automatic persistence. Temporary object URLs exist only for the
legacy image-element decode fallback and are revoked immediately after decode.
Download object URLs are created and revoked by the shared helper. Refreshing or
closing the page discards application state.

Service-worker support may fetch and cache the same-origin application shell;
it does not cache imported files, metadata findings, reports, or generated
images. Metadata URLs and XMP/XML markup are inert text and are never fetched or
rendered as HTML.

## What is inspected

Every file receives byte-signature inventory and SHA-256. Static JPEG, PNG, and
WebP receive project-owned deep container parsing plus ExifReader. TIFF,
HEIC/HEIF, AVIF, and JPEG XL receive best-effort ExifReader inspection only.
GIF and document/archive formats receive inventory only. Exact per-format
fields are listed in the README support table.

All parsers are bounded, but a “complete” scan means complete for implemented
structures—not proof that no steganographic or novel carrier exists. Unknown
private chunks and trailing bytes are surfaced. ExifReader failures and format
limitations remain visible in coverage.

## Re-encoded outputs

Only complete, static, dimension-bounded JPEG/PNG/WebP project scans are
eligible. The application decodes pixels, normalizes display orientation, and
uses Canvas to encode a new file of the detected type. It does not selectively
strip GPS while copying everything else, because duplicated values can live in
multiple namespaces and embedded previews. It copies no source metadata block.

The output is always scanned and hashed again. Sensitive or provenance findings,
partial project coverage, or an oriented-dimension mismatch produce a failed
gate. Secondary-parser limitations and provenance invalidation produce explicit
warnings. JPEG and lossy WebP may change pixels; profiles, resolution metadata,
thumbnails, comments, and application history may be lost. PNG is expected to
preserve decoded pixels, subject to browser colour management.

C2PA/JUMBF carries authenticity/provenance claims. Re-encoding normally removes
or invalidates those claims. The tool reports that effect rather than describing
it as an ordinary privacy win.

## What this cannot promise

No result promises anonymity or safe publication. The tool does not remove or
detect visible faces/text/locations, steganography, invisible watermarks,
camera-pattern or image fingerprints, reverse-image matches, sidecar files,
filesystem metadata, clipboard/history records, application caches, backed-up
originals, or cloud/recipient copies. Review the visible output, destination,
report, and surrounding files yourself.

The JSON report is sensitive by design: it can include original filenames,
hashes, timestamps, and metadata values. Share or retain it only intentionally.