Privacy

Last updated 4 September 2026

The short version

The image you drop in is decoded, re-encoded and compared by code running in your browser. It is never sent to the server, never stored and never seen by anyone else — and neither is anything inside it, such as the camera model or location an image file may carry in its metadata. Visits are counted with self-hosted software on the same server, which stores one random identifier in your browser so that a return visit is counted as the same visitor. That is described in full below, including the part of it this site is not yet satisfied with.

Server logs

The web server records each request: IP address, timestamp, the path requested, HTTP status, referrer and user agent. This is standard web server behaviour and is used to keep the service running and to investigate faults and abuse. The legal basis is Art. 6(1)(f) GDPR — a legitimate interest in operating a secure, functioning service. Log entries are rotated and deleted in the ordinary course of operation and are not combined with anything else or used to build a profile.

Audience measurement

This site counts visits usingRybbit, running on the same server as the site itself. No data goes to a third-party analytics provider and none leaves the EU.

It sets no cookie, but it does store one thing on your device: a random identifier under the key rybbit-visitor-id in your browser’s local storage, so that a second visit is counted as the same visitor rather than as a new one. It is a random value with no meaning outside this site, it is sent nowhere except to the server this site runs on, and clearing your browser’s storage for this domain removes it.

Recorded per visit are the page requested, the referring page, the page title, your screen size and browser language, and coarse information derived from the request — browser, operating system, device type and country. Also recorded are clicks on buttons, clicks on links leading away from this site, copying text, and JavaScript errors, the last so that a page broken for some browser can be found at all. IP addresses are used to derive the country and are not stored alongside it. Nothing is combined with anything else and nothing identifies you personally.

Being corrected. Because that identifier is stored on your device, § 25 TDDDG most likely requires your consent for it, and this site does not ask yet. Until 4 September 2026 this page claimed the opposite — that nothing was stored, and that this was why there was no banner. That was found by measuring what the site does rather than by reading what it says about itself, and it is written here instead of being fixed quietly later. The measurement itself is a legitimate interest under Art. 6(1)(f) GDPR in knowing which pages are read; the storage is the part that is open.

A content blocker suppresses the measurement entirely, and the site works identically without it. This page previously also offered Do Not Track as a way to opt out; the software does not act on that header, so the offer was not real and has been withdrawn rather than left standing.

What this site does not do

• No cookies and no session identifiers. One identifier is kept in local storage — see the measurement section above, which describes it and says what is unresolved about it.
• No advertising, no tracking pixels, no cross-site tracking.
• No third-party services beyond the audience measurement above. Fonts are the ones already on your system; nothing is fetched from a CDN.
• No accounts, no sign-up, no email collection.
• No transmission of the images you drop in, and none of their metadata. They stay in the tab and are gone when you close it.

The appearance setting is the second thing kept on your device, and the only one you choose yourself: picking light or dark stores that word in your browser's local storage so the page does not flash the wrong colours on the next visit. It is never sent anywhere.

Hosting

The site is hosted on a dedicated virtual server in Germany. There is no content delivery network and no reverse proxy operated by a third party between you and it, so the connection ends at that server.

Your rights

Under the GDPR you may request access to personal data held about you, as well as its correction or erasure, object to processing, and lodge a complaint with a supervisory authority. In practice the only personal data here is a log entry containing your IP address; to identify it you would need to state the approximate time of your visit.

Controller

Responsible for this site under Art. 4(7) GDPR:[contact address pending]

This site is a personal, non-commercial project. It carries no advertising, sells nothing and has no paid features.