Privacy & Security

theimgapp is built with privacy as a core principle. Whether an image operation runs directly in your browser or through our stateless API, your files are never permanently stored, never logged, never used to train AI models, and never seen by anyone but you.

How Image Processing Works: Our Architecture

To give you maximum performance and complete privacy, theimgapp uses a transparent, dual-architecture model:

1. In-Browser (Client-Side) Processing

Whenever an operation can be performed efficiently inside the browser, it runs completely on your device using client-side JavaScript, Web Workers, and the HTML5 Canvas API:

• Your browser reads the image directly into local memory.
• The transformation runs locally using your computer's CPU/GPU.
• Your image files never leave your device.
• These tools continue to work even if you lose internet connectivity after loading the page.

2. Stateless Server-Side Processing (Sharp & libvips)

Certain image operations genuinely benefit from or strictly require server-side computing power. For instance:

• Format decoders: Browsers do not natively decode formats like Apple HEIC/HEIF or certain TIFF and RAW variants.
• High-fidelity libvips algorithms: Tools like batch conversion, high-speed multi-file resizing, palette quantization, and complex image filtering utilize Sharp (powered by libvips), which is significantly faster and higher fidelity than browser canvas renders.
• AI Background Removal & Advanced Operations: Specialized segmentation and multi-layer rendering require dedicated compute pipelines.

Here is what happens during a server-assisted operation:

1. Your image is streamed over an encrypted HTTPS connection to a stateless API endpoint (e.g., /api/resize or /api/convert).
2. The file is received in ephemeral memory and passed directly through the Sharp/libvips processing pipeline.
3. The transformed binary result is streamed straight back to your browser as a downloadable file.
4. The memory buffer is immediately released and any temporary scratch files are purged via automated cleanup handlers.
5. No database record is created, no file is written to cloud storage (like AWS S3), and no logs of your image content are kept.

Technology We Use

theimgapp leverages modern open-source and web standards:

• Sharp (libvips) — High-performance, memory-efficient image processing engine running in stateless serverless environments.
• HTML5 Canvas API & Web Workers — For responsive client-side image manipulation and rendering.
• PDF.js & pdf-lib — For rendering and generating PDF documents.
• File & Blob APIs — For handling file transfers directly in browser memory without persistent URLs.
• JSZip — For bundling batch-processed files into a single ZIP archive client-side.

How This Compares to Other Tools

What We Collect (And What We Never Collect)

Transparency is essential. Here is exactly what is and isn't collected when you visit theimgapp:

• Google Analytics: We collect aggregate, anonymized traffic statistics (such as tool visit counts and browser types) to understand which utilities are popular and improve site performance. No image content or filenames are ever sent.
• Third-Party Advertising: theimgapp is intended to be funded through display advertising to keep all utilities free without subscription walls. When third-party ad networks (such as Google AdSense) are active, they may use cookies or web beacons for ad delivery and measurement according to their own privacy policies.

What we NEVER collect: Image files, visual contents, EXIF metadata (GPS coordinates, camera serial numbers), file names, processing outputs, or any personal identifying information.

Privacy-Sensitive Use Cases

Because theimgapp adheres to strict zero-storage, ephemeral processing, users trust our tools for:

• Personal photos — Private family moments that should never reside on third-party cloud storage.
• Confidential work — Unreleased product graphics, client branding, and NDA-protected visual assets.
• Identity & official documents — Resizing or cropping government IDs and passports for online forms without leaving copies online.
• EXIF stripping — Removing sensitive GPS location tags from photos before sharing on public networks.

How to Verify Our Claims

You can independently verify how theimgapp handles your files using your browser:

1. Inspect the Network Tab: Open Developer Tools (F12 or right-click → Inspect) and switch to the Network tab.
2. Run a tool: When you process an image, you will see either local execution or a direct POST request to a local /api/* endpoint.
3. Check the response: The response is a raw binary stream returned immediately to your browser. You will notice no third-party redirects to cloud buckets (like AWS S3 or Google Cloud Storage) and no persistent URLs generated.
4. Check the download link: Downloaded files are converted into browser-local blob: URLs that exist exclusively inside your current tab's memory and disappear when the tab is closed.

Image Metadata & Privacy

Digital photos often contain embedded EXIF metadata containing your exact GPS coordinates, camera serial numbers, and capture timestamps. Before publishing photos online, consider using our Metadata Viewer & Stripper to inspect and safely wipe this hidden data.

Questions or Concerns?

If you have questions about our privacy architecture or security practices, our approach is straightforward:privacy by design. By never storing files and keeping our server operations entirely stateless, we make data breaches of your personal media architecturally impossible.