Privacy
Images are never stored on our server, never written to a database and never kept in a log. The default analysis runs entirely in your browser.
What stays in your browser
- Your image is opened with a temporary browser URL and analysed with canvas and Web Workers. It does not leave your device.
- Scan history is stored only in your browser (IndexedDB): a 320 px JPEG thumbnail, the file name, the time and the report. It keeps at most 30 items. Full-size originals are never kept. Use Clear history on the home page to delete it.
- The "Enhanced server check" toggle is off every time you load the page.
Optional enhanced server check
This feature only appears if the site owner has configured a detector. It is off by default. When you switch it on, the image is sent to /api/detect.php, which reads it into memory, checks that it is a JPEG, PNG or WebP of at most 10 MB, forwards it to the configured detector service and returns the result. Nothing is written to disk or logs. A per-IP rate limit counter (using a hashed IP, no image data) is kept in memory for one minute. The detector service has its own privacy policy.
Third parties
- jsDelivr (CDN). After your first upload, the browser downloads the open-source libraries exifr and c2pa from
cdn.jsdelivr.net, pinned to exact versions with integrity checks. The CDN can see your IP address and that request, but not your image. - Reverse image search. The Google Lens, TinEye, Bing and Yandex buttons open those sites in a new tab. You paste or drop the image there yourself, so their privacy policies apply.
Cookies
We set one security cookie (aiac_csrf, session-only) to protect the optional server check from cross-site requests. We use no analytics or advertising cookies.