Privacy
The short version: your images are processed by your own browser and are not uploaded. ImageUtility records a small amount of anonymous information about which tools are used, so it can tell whether they work. That information never contains any part of your image.
Your images
55 of the 58 tools do all of their work inside your browser. Your file is read from your device into the page, decoded, changed and re-encoded there, and handed straight back to you. It is never sent to a server, because there is no server that does image processing.
This is not only a promise about our intentions. Every page is served with a Content Security Policy containing connect-src 'self', which your browser enforces: it blocks any network request - fetch, XHR, WebSocket or beacon - to a domain other than this one, including from a script that had been tampered with. You can confirm it in your browser's developer tools.
What that policy does not do, said plainly so the guarantee is not read as wider than it is: it does not stop this page from sending data to this domain, which is precisely how the one exception below works, and it does not govern where a page navigates. It is a bound on what code running here can quietly fetch elsewhere, not a proof that no byte can ever leave. The reason your image stays on your device is the first paragraph - none of the code sends it. The policy is what stops that from being changed without anyone noticing.
We store nothing. There is no account, no upload folder and no copy of your file on any machine of ours.
One tool does keep a copy on your device, and it is worth being precise about rather than leaving to the phrase above. The image workspace saves a draft as you edit, so closing the tab does not cost the work, and keeps one per image you open rather than replacing the last. Those drafts live in your browser's own storage on this device, they are never sent anywhere, and nobody but you can reach them - which also means we cannot recover one for you. The page lists what is saved when you return, and each one can be opened, renamed or deleted outright.
The exceptions
2 of the 58 tools send your image somewhere. Each one asks first, every time, and shows you what will happen before anything is sent. If you decline, your image is never transmitted.
Compress and Resize Image is a separate case: every job it builds runs on your device unless you add the background-removal step yourself, and it lists where each step of a job runs before it processes anything.
AI Alt Text Generator
Sends your image because describing a picture needs a model too large to run on your device. When you accept, a reduced copy - no more than 1024 pixels on its long edge, re-encoded and stripped of metadata, and it is sent to our server, which passes it to the provider - unless you supply your own API key, in which case your browser sends it directly to the provider and our server is not involved at all. The provider is Anthropic (Claude).
If you use your own API key, that key is put into the request by your browser and is never sent to us. It is not stored unless you ask for it, and then only until you close the tab.
- Anthropic's commercial policy is to delete API inputs and outputs within 30 days.
- Anthropic's documentation states that retained data is never used for model training without express permission.
- Content flagged by Anthropic's automated trust and safety systems may be retained for up to 2 years.
Checked against their own documentation in September 2026: data retention and API data handling. We link them rather than only summarising them, so you can check the current wording rather than trusting ours.
Background Remover
Sends your image because cutting a subject out cleanly needs a trained model, and the only one we can license for commercial use is not good enough - we measured it and published the results. When you accept, a reduced copy - no more than 1536 pixels on its long edge, re-encoded, stripped of metadata and without your filename, and it is sent to our server, which passes it to the provider. Your browser never contacts them directly, and we do not keep a copy. The provider is a background-removal service.
Only the cut-out shape comes back. It is applied to your original file in your browser, so your original is never uploaded.
What is recorded
When you open a tool, and when a job starts, finishes, fails or is cancelled, ImageUtility sends one small event to its own domain. This is how we can tell whether the tools actually work for people, rather than guessing. It is the complete list - there is no second analytics system, and no third party receives anything.
| Field | Example | What it is |
|---|---|---|
v | 1 | The version of this event format. It exists so that a change to what is collected has to be a deliberate act. |
tool | compress-image | Which tool. Checked against the list of tools that exist, so it can never be anything else - not a filename, not a path. |
action | succeeded | One of five words: opened, started, succeeded, failed or cancelled. |
errorCode | unsupported-format | Present only when something went wrong, and only ever one of our own short labels - never the text of an error, which could contain a file path. |
durationBucket | fast | How long it took, as one of five ranges rather than a number. A precise timing would be a weak way of recognising a device. |
deviceTier | high | low, medium or high - a rough capability band worked out from your browser, used to know whether slower devices are being served properly. |
browser | chromium | One of four words: chromium, webkit, firefox or other. Sent by the page; your full browser identification is not read. |
A complete event looks like this, and is about a hundred bytes:
{"v":1,"tool":"compress-image","action":"succeeded",
"durationBucket":"fast","deviceTier":"high","browser":"chromium"}What is never recorded
Not as a policy we intend to follow, but because the event is built one field at a time from the list above. Anything else is discarded before it can be sent, and the receiving end rejects any event carrying a field it does not recognise.
- Your image, or any part of it
- The filename
- The file size
- The image dimensions
- EXIF data or GPS coordinates
- Text recognised from an image
- Alt text that was generated
- The file size or dimensions you asked for
- Your IP address
- Cookies or any identifier
- Your full browser or device identification
- Anything you type
No cookies, no identifiers, no profile
ImageUtility sets no cookies and uses no local identifier, so there is nothing that links one event to another or to you. The collector does not read or store your IP address, and does not read your user agent - the four-value browser label above is sent by the page itself. There is no advertising, no third-party analytics and no tracking pixel.
One consequence, stated plainly: we cannot tell whether anyone comes back. That is a real gap in what we know, and it is the price of not identifying you.
Changes
If what is collected ever changes, this page changes with it - the tables above are generated from the same definition the software uses, so they cannot quietly fall out of date.