Loading
Loading
The short version: your images are processed by your own browser and are not uploaded. ImageUtility records a small amount of anonymous information about which tools are used, so it can tell whether they work. That information never contains any part of your image.
29 of the 30 tools do all of their work inside your browser. Your file is read from your device into the page, decoded, changed and re-encoded there, and handed straight back to you. It is never sent to a server, because there is no server that does image processing.
This is not only a promise about our intentions. Every page is served with a Content Security Policy containing connect-src 'self', which your browser enforces: it blocks any network request - fetch, XHR, WebSocket or beacon - to a domain other than this one, including from a script that had been tampered with. You can confirm it in your browser's developer tools.
What that policy does not do, said plainly so the guarantee is not read as wider than it is: it does not stop this page from sending data to this domain, which is precisely how the one exception below works, and it does not govern where a page navigates. It is a bound on what code running here can quietly fetch elsewhere, not a proof that no byte can ever leave. The reason your image stays on your device is the first paragraph - none of the code sends it. The policy is what stops that from being changed without anyone noticing.
Nothing is stored. There is no account, no upload folder and no copy of your file anywhere but your own device.
AI Alt Text Generator is the only tool that sends your image anywhere, because describing a picture needs a model too large to run on your device. It asks first, every time, and shows you what will happen before anything is sent. If you decline, your image is never transmitted.
When you accept, a reduced copy - no more than 1024 pixels on its long edge, re-encoded and stripped of metadata - is sent to our server, which passes it to Anthropic (Claude). Your browser never contacts them directly, and we do not keep a copy.
Checked against their own documentation in September 2026: data retention and API data handling. We link them rather than only summarising them, so you can check the current wording rather than trusting ours.
When you open a tool, and when a job starts, finishes, fails or is cancelled, ImageUtility sends one small event to its own domain. This is how we can tell whether the tools actually work for people, rather than guessing. It is the complete list - there is no second analytics system, and no third party receives anything.
| Field | Example | What it is |
|---|---|---|
v | 1 | The version of this event format. It exists so that a change to what is collected has to be a deliberate act. |
tool | compress-image | Which tool. Checked against the list of tools that exist, so it can never be anything else - not a filename, not a path. |
action | succeeded | One of five words: opened, started, succeeded, failed or cancelled. |
errorCode | unsupported-format | Present only when something went wrong, and only ever one of our own short labels - never the text of an error, which could contain a file path. |
durationBucket | fast | How long it took, as one of five ranges rather than a number. A precise timing would be a weak way of recognising a device. |
deviceTier | high | low, medium or high - a rough capability band worked out from your browser, used to know whether slower devices are being served properly. |
browser | chromium | One of four words: chromium, webkit, firefox or other. Sent by the page; your full browser identification is not read. |
A complete event looks like this, and is about a hundred bytes:
{"v":1,"tool":"compress-image","action":"succeeded",
"durationBucket":"fast","deviceTier":"high","browser":"chromium"}Not as a policy we intend to follow, but because the event is built one field at a time from the list above. Anything else is discarded before it can be sent, and the receiving end rejects any event carrying a field it does not recognise.
ImageUtility sets no cookies and uses no local identifier, so there is nothing that links one event to another or to you. The collector does not read or store your IP address, and does not read your user agent - the four-value browser label above is sent by the page itself. There is no advertising, no third-party analytics and no tracking pixel.
One consequence, stated plainly: we cannot tell whether anyone comes back. That is a real gap in what we know, and it is the price of not identifying you.
If what is collected ever changes, this page changes with it - the tables above are generated from the same definition the software uses, so they cannot quietly fall out of date.