privacy

No code path in this build can send pixel data anywhere: there is no origin to post to, and a compile-time audit refuses the deploy if a network call ever appears in a module that touches an image buffer.

The short version

Two pictures go into this page and one comes out, and none of the three ever leaves the machine you are reading this on. There is no account to make, nothing is stored between visits, and the site keeps no record of what you blended or that you blended anything.

What happens to a file you open

Choosing a file, dropping one, or pasting one hands the browser a reference to bytes on your own disk. Those bytes are decoded into an image in memory, a smaller copy is made for the screen, and both live in this tab until you clear the slot or close it. The blend is computed by the same tab against those copies. When you export, the composite is built again at full size and handed to the browser’s own download machinery as a file that existed for the first time a moment earlier. Nothing in that sequence involves a network.

This is enforced rather than promised. The site is published as a static export with no server-side code of any kind, so there is no endpoint that could receive an image even by mistake, and a check that runs before every deployment fails the build if a network call, a storage call or a database call appears in any module that can reach image data. A HEIC picture is the one case where something is fetched — the decoder for that format, which is a program rather than a destination, and which is downloaded only once a HEIC has actually been opened.

What the advertising will see, once there is any

This site is built to be paid for by advertising served by Google, and the placements are already fixed: one unit under the working surface on each of the three tool routes, two inside each of the longer reference pages, and none above the tool or within it. None of them is being served today. The domain has not completed AdSense review, so a single switch in the source holds every placement shut, and what is rendered on the page you are reading is no unit, no label and no reserved band. Read the paragraph below as the arrangement that takes effect on approval, not as a description of this page right now.

When a unit does run, Google sets and reads its own cookies and can see the address of the page, an approximate location derived from your connection, and which browser you are using. It cannot reach either frame. An advertisement is drawn in a cross-origin frame with no route to the canvas, to the file inputs, or to any bitmap this tab is holding, and that boundary is the browser’s rather than a promise of ours. Google’s own advertising settings govern what it does with what it collects, and a content blocker removes the unit without disturbing the blender.

What the visit counter sees, which is nothing yet

There is no visit counter on this build. The measurement property has never been created, the token in the source is still the placeholder the scaffold wrote there, and the tag that would load a beacon is conditioned on that token, so it renders as nothing at all. No request for measurement leaves this page to any host, and no page address, referrer or country is recorded anywhere — not coarsely, not anonymously, not at all.

If that changes, the counter will be Cloudflare Web Analytics, which needs no cookie and therefore no consent banner, reporting into a property held by this domain alone and shared with no sibling site. It would see the address of the page, the referrer and a country-level location, would set no identifier, and could not tell one visitor from another across two visits. This section will be rewritten in the present tense on the day that becomes true, and not before.

Changes, and how to ask

If anything here changes it will change on this page, and the change will be to what the site does rather than to how it is described. Questions about this policy can go to the address published by the operator of the domain in the WHOIS record for combinepicture.com.