Privacy Policy
The complete version. The plain-language summary is shorter and says the same thing.
Everything below is accurate about how the product behaves today, but the controller details are unset and this has not been reviewed by a lawyer. Both are required before payments are enabled.
The short version
Your photos are never sent to us. Everything else on this page is about the small amount of data that is involved in serving you a web page.
Who is responsible
The data controller is [legal entity: not set],[registered address: not set]. For anything on this page, or to exercise any right below, write to [email protected].
Your photos
We do not receive them. Reading a photo's metadata, writing GPS coordinates, removing metadata and preparing the download all happen inside your browser, on your device. The image file is never transmitted to us. There is no server-side copy to store, leak, disclose, or hand to anyone.
This is not a policy commitment we could quietly change. It is how the software is built, and you can verify it in about thirty seconds: open your browser's developer tools, select the Network tab, and drop a photo in. No request carries your image. Or load a page, disconnect from the internet, and watch it keep working.
It follows that we cannot delete your photos on request, produce them in response to a legal demand, or use them to train anything. We do not have them.
What we do receive
Place searches
When you type in the location search box, that text is sent to our server, which forwards it to OpenStreetMap's Nominatim service to turn it into coordinates. We proxy it so no API key is exposed and so the rate limits are respected. We cache results briefly to avoid repeat lookups. Your photo's own coordinates are never sent, only what you type.
A usage counter
The free tier has a daily limit. To count it we store a number against a one-way hash of your IP address, salted with a secret only the server knows. We do not store the raw IP, and the counter is not linked to your photos, because we do not have your photos. It resets daily.
Ordinary server logs
Our web server records requests as web servers do: a timestamp, the page requested, and technical information sent by your browser. This is used to keep the service running and secure.
Map tiles
Maps are drawn using tiles from OpenFreeMap. If a photo you open has GPS coordinates, the map is centred there, which means OpenFreeMap's servers can infer the rough area of that photo (roughly a two-kilometre square, not the exact point, and not the photo). The coordinates themselves are read on your device. We mention this because it is the one place where using a map reveals something, and you should not have to find it in the network tab yourself.
Accounts and payments
The free tier requires no account, and we hold nothing about you.
If you buy a paid plan, payment is handled by Paddle as merchant of record. Card details go to Paddle and never reach us. We are told only that a payment succeeded, and we store a record that your subscription or credits are active. If you create an account, authentication is handled by Clerk, who hold your email and login credentials on our behalf.
Advertising
We do not run ads. There is no ad network on this site, no ad cookie, and no advertising profile of you. The free tools are free because the work happens on your own device, which costs us almost nothing to serve.
Nothing here can see your photos in any case. The image is never transmitted, and it is never placed in the page in a form a third-party script could read, so the claim stays exactly as narrow as it should be: your photos never leave your browser.
Analytics
Product analytics run without cookies until you consent, and never receive image data or coordinates. You can decline and use every tool fully. Three providers are enabled:
- PostHog counts page views and a few product events. Autocapture is off, session recording is off, and until you accept the banner it keeps nothing on your device at all.
- Microsoft Clarity shows us where a page confuses people. Every part of the page that can hold your data (the coordinate readout, the metadata table, the filename, anything you type) is masked before it is recorded.
- Sentry receives crash reports. Coordinates and filenames are stripped out of the error text in your browser, before it is sent.
PostHog stores its data in the United States, and Microsoft Clarity in the United States. If you are in the UK or EU, that transfer relies on the providers' standard contractual clauses. Sentry stores in the EU. None of the three can receive your photo, because your photo is never transmitted anywhere.
Who we share with
We do not sell your data. The third parties involved each do one job: OpenStreetMap (turning your typed search into coordinates), OpenFreeMap (map tiles), Paddle (payment), Clerk (login, if you make an account), PostHog and Microsoft Clarity (analytics), Sentry (crash reports). We will disclose data if the law compels us, but for your photos, there is nothing to disclose, because we never had them.
How long we keep things
- Photos: never held, so never kept.
- Usage counter: resets daily.
- Search cache: about an hour.
- Server logs: a short rolling window for security and debugging.
- Analytics and crash reports: kept by each provider under their own retention settings, and none of it identifies you by name.
- Payment and account records: as long as the account exists, plus what tax law requires.
- Ad cookies: set and kept by Google under their policies, not ours. Declining consent means none are set.
Legal basis (UK/EU)
We rely on legitimate interests for the usage counter, the search proxy and server logs. Each is necessary to run the service and none builds a profile of you. We rely on contract for payment and account data, and onconsent for advertising and analytics, which you may refuse or withdraw at any time. Refusing costs you nothing: every tool works identically.
Your rights
You can ask for access to, correction of, or deletion of the data we hold, object to processing, and ask for a copy in a portable form. Write [email protected]. In practice, for a free-tier user there is usually nothing to return: a salted hash of an IP is not something we can link back to a person, which is rather the point.
You can also complain to your data protection authority if you think we have got this wrong.
Children
The service is not directed at children, and we do not knowingly collect anything about them. Since no account is needed and no photo reaches us, there is very little that could be collected.
Changes
If this policy changes materially, the effective date at the top changes, and we will say what changed rather than quietly re-publishing it.