What this site can see

When you open a file here, the browser decodes it into memory in this tab. The boxes you draw are numbers held in the same tab, the fill rewrites pixels in the same tab, and the file you save is written by your own browser from those pixels. There is no upload endpoint on this domain, no server behind it and no account to attach anything to. Closing the tab is the whole of the clearing up.

This is checked rather than asserted. A build-time audit fails the release if any code path under the picture engine or the interface can reach the network or write to storage, which is why the one file on this site that does make a request touches no pixels at all.

There is no measurement script on these pages today. The analytics property for this domain has not been set up, the token in the source is a placeholder, and because it is a placeholder the beacon is not rendered at all — shipping one that collects nothing would still make a third-party request on every visit, which on a site making this particular promise is worse than having no figures.

If that changes, it will be a cookie-free counter on this domain’s own property, never a shared account with another site, and this paragraph changes in the same release as the switch. A build gate now fails if the prose here and the configuration disagree in either direction, which is the only reason that promise is worth anything.

This site is meant to be paid for by Google advertising, and the placements are built: one below the written section on each tool route, three inside a guide. No advertisement is served yet, because the domain has not been through review — the units render nothing at all until that is done.

When they do run, what an advertising network sees is what it sees anywhere: the address of the page, your general location from your network address, and whatever your browser tells it. It never sees your picture, because your picture is not in the page in any form a script could read, and it is never sent anywhere for an advertisement to be chosen. Personalised advertising is a matter for your own Google settings rather than something this site can turn on for you.

One thing, and only if you ask for it: the fill model, in a cache bucket named for this site. The panel that downloads it holds the control that deletes it, and clearing site data in your browser removes it just as well. No cookies are set by this site, nothing about your pictures is written down, and no history of what you have opened exists anywhere — including here.

There is no account and no database, so there is nothing to request a copy of and nothing to ask us to delete. If something on this page turns out to be wrong, the correction goes here rather than into a support queue nobody reads.