privacy

No code path in this build can send pixel data anywhere: there is no origin to post to, and there is a check that says so — `npm run audit:rules` walks the built JavaScript before a deploy and fails if a network call turns up in a module that touches an image buffer. It is a gate that runs in the build, not a property the source can assert about itself, and that is the honest way to describe it.

The short version

However many pictures you bring — two on the blender or up to forty-eight on the board — they are decoded, laid out or mixed, and saved by this tab, and none of them ever leaves the machine you are reading this on. There is no account to make, nothing is stored between visits, and the site keeps no record of what you combined or that you combined anything.

What happens to a file you open

Choosing a file, dropping one, or pasting one hands the browser a reference to bytes on your own disk. Those bytes are decoded into an image in memory, a smaller copy is made for the screen, and both live in this tab until you clear the slot, take the picture off the board, or close the tab. The board’s layout and the blend are computed by the same tab against those copies. When you export, the result is built again at full size — the board reads each file from your disk once more, one at a time — and handed to the browser’s own download machinery as a file that existed for the first time a moment earlier. When the tab closes, the memory is released. Nothing in that sequence involves a network.

This is enforced rather than promised. The site is published as a static export with no server-side code of any kind, so there is no endpoint that could receive an image even by mistake. A check that runs before every deployment fails the build if a network, storage or database call appears in any module that can reach image data, and an automated browser test opens real files, arranges them, blends them and exports, and fails if any request leaves the page carrying data.

HEIC pictures

A HEIC picture — the default format on many phones — needs a decoder that browsers mostly lack. That decoder is part of this site: it is loaded from this site’s own address, and only once a HEIC has actually been opened. It is a program coming to your device; the picture does not go anywhere.

Models

No feature on this site needs a downloaded model today. If one is added — for example to find faces so a crop never cuts one — it will ask first, the model file will be downloaded from our model file server and kept in your browser’s cache, and it will run on your device. The model file comes to your device. Your pictures do not go anywhere.

What the visit counter sees

On the live site (combinepicture.com) a cookie-free counter, Cloudflare Web Analytics, records aggregate page views, the referring page, a coarse country, the browser and device type, and how quickly the page loaded. It sets no cookie and no identifier that could recognise you across visits or across other sites. It is not loaded at all on preview copies or on a copy of the site you run yourself.

It cannot see your pictures. It has no route to the files you open, the canvas or any bitmap this tab is holding, and nothing about the pictures — not a filename, not a size, not a pixel — is included in what it counts.

Advertising

There is no advertising on this site.

Changes, and how to ask

If anything here changes it will change on this page, and the change will be to what the site does rather than to how it is described. Questions about this policy, or anything else, can go through the contact page.

That page is the only one with a form. It sends what you type into it — your name, your email address and your message — together with this site’s domain to a Google Form, and only when you press its send button. Loading it requests nothing from Google, no other page here talks to Google, and the form cannot carry a picture.