Skip to content
Colour theme

Privacy

Your files and your text are never transmitted anywhere. That is a consequence of how the site is built, not a policy someone could change quietly. This site does carry advertising, and this page is specific about where it runs and what it collects, because a privacy page that omits the awkward part is worth nothing.

What happens to your file

When you drop a file in, the browser reads it into memory in the page you already have open. Every parser runs there: EXIF, PNG chunks, RIFF chunks, SVG, C2PA. The cleaned file you download is assembled in the same place. At no point is there a request carrying your data, because there is nowhere for it to go: this site has no backend, no database and no storage.

The same is true of text. Analysis and normalization are ordinary functions running on the string in your browser tab.

The workspace is sealed

Every page under /app is served with a second content security policy, on top of the site-wide one. Your browser enforces both at once and applies whichever is stricter for each request, so on those pages the effective policy is this:

script-src 'self';
connect-src 'self';
frame-src 'none';
img-src 'self' data: blob:

No third-party script can load in the workspace, no advertising runs there, and nothing can open a connection to another origin. That is not a promise about our intentions; it is a rule your browser applies before any of our code gets a say. You can check it: open developer tools on /app/text, look at the response headers, and you will see two Content-Security-Policy lines.

The certificate lists used to check Content Credentials ship with the site as static files for the same reason. Fetching them from a third party at the moment you inspect a file would leak the fact that you were inspecting one.

Advertising, and where it runs

The site is free and is paid for by Google AdSense. Advertising runs on the home page, on How it works, and on the three focused tool pages: /text, /metadata-remover and /provenance-inspector. It does not run in the /app workspace, and it does not run on this page.

Be clear about what that means on the focused tool pages, because they run the real tool. Your text and your files are still never transmitted by this site, and there is still no server to transmit them to. But a Google advertising script is present in that page alongside them. If you would rather work on something sensitive with no third-party code in the document at all, use the workspace at /app, where the second policy above makes that impossible rather than merely unlikely. It is the same tool.

What the advertising itself does is standard and not ours to change. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites on the internet.

You can opt out of personalised advertising in Google’s Ads Settings, or opt out of a third-party vendor’s use of cookies for personalised advertising at aboutads.info. In the EEA, the UK and Switzerland personalised advertising may only be served with your consent, and that consent has to be collected by a platform certified by Google. Withdrawing it must be as easy as giving it, so once that dialog is live this page will carry the control that reopens it. Until then, no personalised advertising is served here at all.

What is stored in your browser

By this site: two things, both trivial and both local. Your theme choice, under the localStorage key aaw-theme, and whether you dismissed the notice at the top of the page, under aaw-notice. Neither leaves your device and clearing site data removes both.

By Google, on the pages that carry advertising: cookies and local storage belonging to Google, subject to your consent choice. There are no analytics, no tag manager, no tracking pixels of our own, no fonts loaded from another domain, and no accounts. The advertising script is the only third-party code on this site, and the pages it is absent from are listed above.

What this tool expects of you

It is built for content you own or are authorised to process. Removing provenance metadata from someone else’s work, or stripping credentials to disguise where something came from, is not what this is for. The tool is deliberately incapable of forging a signature or making a modified file appear untouched.

Changes

Advertising was added on 12 August 2026, and this page was rewritten the same day rather than after someone noticed. If anything here stops being true, if some feature genuinely required a server, the interface would have to say so at the point of use, not only here.