Privacy

You open a scan. Your browser decodes it, reads it for damage, fills what you approved and writes a repaired copy to your downloads folder. Every one of those steps happens inside the tab, on the device in front of you. There is no upload, because this site has no server that receives files — it is a set of static pages, and a check in the build refuses to publish it if any code path that could transmit a picture ever appears.

Two things travel towards you rather than away from you, and only if you ask for them. A decoder, when you open a HEIC file. And two model files plus the runtime that executes them, when you press the control on the repair panel that offers to redraw wide damage and states its size. Those are programs arriving here. Your photograph is not part of any of it and has nowhere to go.

No part of the file — not its pixels, not its name, not its dimensions, not the fact that you opened one — is included in any request this page makes. Nothing about it is written to local storage, to IndexedDB or to a cookie. The one thing this site does put in a browser cache is the model weights, which came from the network and are not your picture.

This is the part worth being exact about, because a page that says “nothing is uploaded” and quietly opens a connection to somewhere else has told the truth in a way designed not to be checked. Here is every request this site can make beyond its own pages, stylesheet, scripts and typefaces.

cdn.pictureeditor.com is this network’s own object storage rather than a public model hub, and that choice is deliberate: a request to somebody else’s content delivery network would tell them which of this site’s visitors is repairing a damaged photograph, which sits badly beside the rest of this page. It is still a second host, it still sees an ordinary HTTP request from your browser for a file, and calling it anything softer than that would be evasive. The request carries nothing about your picture, and it goes in one direction: a download.

A model running here is a file of numbers being multiplied by a square of your photograph inside this tab. It is not a service, it has no other end, and there is no round trip in which anything could be retained. It is shown one 512-pixel square at a time, cut around damage you marked, with the marked pixels blanked before it sees them.

Nothing is computed from your picture that outlives the tab. No embedding, no descriptor, no hash of a face, no identity, no age or demographic estimate, no classification of the scene or of the people in it. The pass produces replacement pixels for the region you marked and a count of how many it wrote, and both are discarded with the page. What the model invents in a hole is invention, and the page says so where the control is rather than only here.

Nobody is counting you here. No measurement token has been configured for this domain, so no beacon is written into the page and no request is made to any analytics host — the layout refuses to render that script for as long as the token in the source is a placeholder, which makes the absence a thing the build enforces rather than a thing somebody remembered. There is no visit tally, no referrer log and no country breakdown.

If it is ever reversed it will be reversed towards a cookie-free counter on a property belonging to this domain alone, and this section will be rewritten in the same commit rather than a month afterwards. Until both of those have happened, take the paragraph above literally: how many people have opened a scan on this page is not known to anyone, the person who keeps it included.

This site is meant to be paid for by Google AdSense, and the domain is still pending that approval. So there is no advertising on the page you are reading: no unit is requested, nothing is drawn, and no space is held for one. No advertising network has yet received a request from this page, and no third party of any kind receives one unless you ask for the model — in which case the request is for a file of weights and carries nothing about you beyond what any request for a file carries. What follows is written in advance, because a disclosure that appears at the same moment as the thing it discloses is worth very little.

Once Google approves the domain, advertising appears in bands below the working surface, never above the tool and never among its controls. Google may set its own cookies to decide which advertisement a given visitor sees, under its policies rather than anything written here, and visitors in Europe meet its consent dialogue before that happens. The boundary does not move either way: an ad frame is a separate document with no reach into the canvas, the file input, the model, or anything the repair is holding in memory, and blocking every part of it leaves the repair working exactly as it works now.

None of it has to be taken on trust. Open your browser’s network panel, repair a scan and save it, and count the requests. Apart from this page, its stylesheet, its scripts and its typefaces — every one of them from this domain — you will see the HEIC decoder if you opened a file in that format, and, if you pressed the control that offers the model pass, one request to this domain for the runtime and one or two to cdn.pictureeditor.com for the weights. The count matters less than the arrow beside it: not one of those requests leaves carrying your scan.

If this policy changes materially the date below changes with it and the change is described rather than merely dated. There is no account system, so there is nothing to delete and no request to make — closing the tab has already done it, and the one thing this site can leave behind has a delete control on the panel that put it there. Last reviewed on 13 September 2026.