Privacy
The one-line version
Your files never leave your device. All parsing, cleaning and zipping runs in the browser. The server only ships static pages, and has never received an image, video or PDF from anyone.
How that is guaranteed
- The site is built and served as static files: there is no upload endpoint and no writable backend.
- Files are read with the File API and processed through ArrayBuffer and Canvas, entirely in local memory.
- The wasm modules for HEIC decoding and C2PA verification are served by this site and run in your browser; they transmit nothing.
- Batch downloads are zipped locally with fflate, with no server involved.
- Once the page has loaded, every cleaning feature keeps working with the network cut — the most direct proof there is of local processing.
What the browser records
| Item | Happens | Notes |
|---|---|---|
| Uploading files to a server | No | No upload endpoint exists |
| Sending file names to the server | No | Names are only used to label the download |
| Reading the clipboard | Only when you paste | Supports ⌘V screenshot pasting |
| Writing to local storage | Yes | One key only, the language preference (ail.locale); no processing history |
| Server access logs | Page visits may be logged | Contains IP and path, never file contents |
| Page-view analytics (GA4) | Yes | Path, referrer, country, device, event counts; writes no cookies — see below |
| Page-view analytics (Baidu Tongji) | Yes (sets cookies) | Path, referrer, device, screen size; cookies up to 400 days — see below |
Page-view analytics
The site uses Google Analytics 4 for visit statistics: which page was opened, which search engine referred it, roughly which country, which device, plus event counts inside the tool (for example “the clean button was pressed, 3 files, all succeeded”). That data is how we tell which pages people actually need — without it, copy changes are guesswork.
No file information is ever included. What gets recorded is a count — “the clean button was pressed, 3 files, all succeeded” — never a file name, never metadata content, never any field value from the result. The code enforces this: the tracking function rejects any string argument longer than 40 characters, and a filename always is, so one cannot be passed by accident.
Consent Mode is set to “denied” by default: GA4 writes no _ga cookie and builds no cross-site identifier. The cost is weaker session- and user-level metrics; event counts still arrive, which is enough to tell whether the tool is being used successfully.
A second counter, Baidu Tongji, runs alongside GA4. The two have different blocker rates, reachability and processing lag, so reading them side by side is how one skewed number gets caught.
The difference that matters: Baidu Tongji sets cookies. Four of them, as measured:Hm_lvt_… (365 days, visit timestamps), Hm_lpvt_… (session, last visit), HMACCOUNT (session, visitor number) and HMACCOUNT_BFESS (on hm.baidu.com, 400 days, used to recognise returning visitors across sites). GA4 under “denied” writes none; Baidu has no equivalent switch, so “no consent banner” above describes GA4 only.
To avoid these cookies, block hm.baidu.com — every feature still works — or visit in a private window.
If you block it with an ad blocker, every feature of the tool keeps working exactly the same — a failed beacon is silent and never affects a clean.
Breaking this promise would be the worst failure possible
For a tool that claims “no upload”, uploading secretly would be a fundamental betrayal. You can verify it yourself: open DevTools → Network, process any file, and no request will carry file contents. That is the check we would encourage you to run — do not take the wording on trust.
Third-party dependencies
To keep this verifiable, runtime dependencies are deliberately minimal: libheif (wasm, for HEIC decoding), c2pa-web (wasm, for parsing C2PA manifests) and fflate (local ZIP packing). All three run in your browser and play no part in transporting data.