How to verify a “private” photo tool uploads nothing

Every photo tool on the internet says something reassuring about privacy. “We respect your privacy.” “Files are deleted after one hour.” “We never share your data.” For most tools these sentences describe policy — a promise about what their server does with your photo after receiving it. You can’t verify a promise.

But there’s a stronger claim some tools make, this one included: the photo never leaves your device at all. That claim isn’t policy — it’s an architectural fact about where the computation happens, and architectural facts can be checked by anyone in about two minutes, with tools already built into your browser. Here’s how. Run these checks on this site, and run them on any competitor before trusting it with something sensitive — the checks are the point, not our word.

Check 1: the Network tab (one minute)

Every desktop browser ships developer tools that show each network request a page makes.

1. Open the tool’s page. Press F12 (or right-click → Inspect) and select the Network tab.
2. Clear the request list (the ⊘ icon), so you’re looking at a clean slate.
3. Load a photo into the tool and use it — blur, detect, export.
4. Watch the list. On a genuinely local tool you’ll see either nothing, or only GET requests fetching the site’s own files (scripts, the detection model). What you must never see is a POST/PUT request carrying data away — an upload. Size gives it away too: an upload of your 4 MB photo is a 4 MB request.

On this site, the requests you’ll observe during first use are GETs for the page’s own assets — including the face-detection model (/mediapipe/…), fetched from this site so your browser can run it locally. Your photo appears in no request, because there is no request that could carry it: the site is static files with no server application behind it.

An upload-based tool run through the same check shows a POST the moment you drop the file — before you’ve clicked anything. That’s not evidence of bad faith (their architecture requires it; their deletion promise may be perfectly honest) — it just means their privacy is a policy you’re trusting, not a fact you’ve verified.

Check 2: the offline test (one minute, and more intuitive)

The Network tab convinces developers; the offline test convinces everyone else.

1. Load the tool’s page normally and give it a few seconds — this site uses idle time to fetch the detection engine so everything needed is on your device.
2. Now cut the network: airplane mode, Wi-Fi off, or unplug the cable. The stronger version on desktop: DevTools → Network tab → throttling dropdown → Offline, which cuts the connection for that page alone with no ambiguity.
3. Use the tool: load a photo, let it find faces, redact, download.

If it works with no connection, the processing is happening on your device — there is nowhere else it could happen. This site passes this test, and it’s our own release check: the automated test suite loads the page, disconnects the simulated network, and requires detection and export to still succeed.

A subtlety worth knowing: a tool could in principle work offline and then upload your photo when the connection returns. That’s why the checks complement each other — the Network tab after reconnecting would show any such delayed send. (A site that never receives your photo also can’t do this; static hosting has no endpoint to send to.)

What “static site” means and why it matters

This site is a folder of files — HTML, CSS, JavaScript, a WebAssembly detection model — served by a content-delivery network. There is no application server, no database, no upload handler. The distinction matters because it converts a privacy promise into a property: a server that doesn’t exist can’t receive photos, can’t be breached for them, can’t be subpoenaed for them and can’t quietly change its retention policy. The browser is the app.

The same architecture is why the tool can be installed as an offline app (Add to Home Screen on mobile; your browser caches the site’s files), and why it keeps working in a dead spot. The cache holds the tool, never your photos — nothing you process is written anywhere unless you save the download.

Questions worth asking of any tool

• Does anything in the page’s network activity scale with my file? (It shouldn’t.)
• Does it keep working offline — including the “AI” parts?
• Does the export contain what the original contained? Metadata is part of the file; a re-encoded local export should be stripped clean, and you can check with your OS’s file-properties panel.
• Is the privacy claim written as an architectural fact (“no upload endpoint exists”) or as a policy (“we delete after processing”)? Both can be legitimate; only one is checkable.

Trust built on verification beats trust built on tone. Two minutes, two checks — and you never have to take a photo tool’s word for anything again, including ours.