Security and privacy
Your image is decoded, re-encoded and handed back inside your own browser tab. Nothing is uploaded — and this page shows you how to confirm that yourself.
The short version
No image you compress on this site is uploaded anywhere. There is no upload endpoint, no storage bucket, no processing queue and no server-side code that could receive a file. The page is static HTML; the compression is JavaScript running in your tab.
What actually happens to your file
The browser reads the file with the File API and decodes it into an in-memory canvas. The encoder then reduces JPEG/WebP quality, and resolution if it must, until the output fits the byte target. The result is turned into a Blob and exposed to you as a download link, through an object URL that exists only inside this tab.
Close the tab and the object URL is released. Nothing was persisted, because nothing was ever sent.
How to verify this yourself
Watch the network tab. Press F12, open the Network panel, and compress a photo. Every request you see is for this page's own HTML, CSS, JS or fonts — none of them carries your image. If the tool uploaded files, you would see a multipart POST with a payload measured in megabytes.
Go offline. Load the page once, then disconnect your network and compress a photo. It still works, which it could not do if a server were involved.
Read the code. There is exactly one script: /assets/app.js. It contains no network calls for image data — search it for fetch( and you will find only local object URLs.
Metadata is stripped
Re-encoding through a canvas does not carry EXIF across. GPS coordinates, camera make and model, serial numbers and original timestamps are all dropped, because the output file is constructed from pixels alone. That is a privacy gain in almost every case where you would compress an image before sending it.
What the site does collect
The compressor itself collects nothing: no cookies, no fingerprinting, no per-file telemetry. The page loads Cloudflare Web Analytics, which is cookieless, does not build profiles, and reports aggregate page views and Core Web Vitals only.
Some pages carry display advertising. Ad scripts run on the page and can use cookies in the ordinary way, but they have no access to the files you drop into the compressor — the File API hands those bytes to your tab's own JavaScript, not to a third party.
Reporting a problem
If you find a security issue, please report it rather than publish it: email kioolfranrip@gmail.com. The site is served as static files from Cloudflare Pages, and the source for every page and for app.js is readable by anyone — that is the point. A concrete reproduction is worth more than a severity label.
Questions
Can you see the images I compress?
No. There is no upload endpoint. The file is read by your own browser with the File API, decoded into a canvas, re-encoded, and handed back to you as a download. No image byte is ever sent over the network.
How can I verify that myself?
Open DevTools (F12), switch to the Network tab, then compress a photo. Every request listed is for the page's own HTML, CSS or JS — you will not see a request carrying your image. You can also load the page once, disconnect from the internet, and compress normally.
What happens to the EXIF data?
It is dropped. Re-encoding through a canvas produces a new file containing only pixels — GPS coordinates, camera serial numbers and capture timestamps do not survive, which is usually what you want before posting a photo publicly.
Do you use cookies or trackers?
The compressor itself sets no cookies and runs no analytics. The page carries Cloudflare Web Analytics, which is cookieless and aggregate-only, and display ads on some pages. Neither has access to the contents of your files.
Is the code open to inspection?
Yes — the whole thing is static HTML, one CSS file and one JavaScript file. View source or open /assets/app.js and read exactly what runs.