Privacy

Your photograph is opened by the browser, held in the tab’s own memory while you work on it, and discarded when you close the tab. It is not sent to this site, because this site has nowhere to send it to — there is no server component here, only files served to your browser. Nothing about your picture is stored, logged, counted or remembered.

Choosing a file hands the browser a reference to it. The browser decodes it into pixels; a copy no more than 1600 pixels on its long edge is made for the screen; the effect kernels read that copy and write a new one. When you export, the original is decoded again at full size, run through the same kernel, encoded by the browser, and handed back to you as a download that was assembled entirely inside the tab.

The heavy arithmetic happens in a Web Worker, which is a second thread inside the same tab, with the pixel data passed to it directly in memory. Nothing crosses the network at any point in that sequence. One exception exists and it is worth naming: opening a HEIC file — what recent iPhones write by default — causes the page to fetch a WebAssembly decoder, because browsers do not decode HEIC themselves. That request downloads code to your machine; your picture does not travel in the other direction.

Nothing about your picture lands in local storage, in session storage or in any in-browser database — no pixels, no file name, no dimensions. Two small things can: if you star a look or save a recipe in the lab, that list is kept in this browser’s local storage so it is still there next visit. A favourite is the name of a look; a recipe is a name you typed plus the look’s numbers (strength, exposure and the like). Neither is ever sent anywhere, and clearing this site’s data in your browser removes both. A .cube colour table you import is read in the tab and is not stored at all. Nothing is written to session storage.

Yes, at the page level, and only on the live site. When a page is served from filterpicture.com it loads Cloudflare Web Analytics, a cookie-free counter reporting to a property that belongs to this domain alone. On any other address — a preview copy, a test server, your own machine — the counter is not loaded at all.

What it sees is the sort of thing a server log sees: that a page was fetched, roughly from where, which browser and device kind asked, and how long the page took to load. It sets no cookie or identifier, writes nothing to your device and does not recognise you on a later visit. It never sees your picture, your settings, your file names or your recipes, because nothing in the lab hands those to anything — the render never leaves the canvas it was drawn on. It is page-level measurement, not a record of what you did in the tool.

No advertising runs on this site. There is no ad script, no ad frame and no advertising cookie, and nothing here reaches an ad network while you work. If that ever changes, this page will say so before the first advert appears.

The contact page is a form, and pressing its send button posts exactly four things to a Google Form: the name, email address and message you typed, and the name of this site so the note can be sorted. Nothing goes before you press it — the page fetches nothing from Google while it loads — and no picture can travel that way, because the form has no place to put one. The lab itself never talks to Google.

The site is a general-purpose picture tool and is not directed at children, and the lab collects nothing from anyone that could identify them.

If this policy changes it will change here, and the change will be one you can read rather than a line saying the policy has been updated. The architectural part of it — that pictures stay on your machine — cannot change without the site being rebuilt as a different kind of thing, which would be obvious rather than quiet.