Privacy policy
Last updated 28 July 2026.
The short version. Your images are processed inside your own browser and are never uploaded to us or to anyone else. We have no accounts, no logins and no database. There is no server-side code on this site that could receive a file.
Your images
Every tool on img-fix.com runs in your browser using standard web APIs. When you select or drag a file, the browser hands the file's contents to code running on the page. That code decodes, crops or re-encodes it in memory and gives you back a result you can download.
At no point is the file transmitted over the network. img-fix.com is a static website — HTML, CSS, JavaScript and WebAssembly served from a CDN — with no application server, no upload endpoint and no storage. There is nowhere for an image to go.
You can confirm this rather than trust it. Open your browser's developer tools, go to the network tab, and use any tool on the site: you will see the page's own assets load and no request carrying your file. Or load a page, disconnect from the internet, and use the tool offline — it works, because everything needed is already on your device.
Images are held in memory only while you are working on them, and are released when you clear the tool, navigate away or close the tab. Nothing is written to local storage, IndexedDB or cookies.
Metadata
As a side effect of how the tools work, output files do not carry the metadata the input had. Decoding an image to pixels and re-encoding it does not preserve EXIF, so GPS coordinates, camera model, timestamps and device-specific tags are absent from what you download. Orientation is applied to the pixels before re-encoding, so images stay the right way up without needing the tag.
This is generally what you want when uploading a photo to a government form, but it is worth knowing if you were relying on that metadata for something.
Hosting and server logs
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical information necessary to serve a page: your IP address, the URL requested, your user agent, and the time of the request. We do not have access to individually identifiable logs, and we do not use them to build any profile of you. This processing is Cloudflare's, under its own terms; see Cloudflare's privacy policy.
Cookies and analytics
The site sets no cookies of its own, and we do not use Google Analytics. On the pages that carry advertising (see below), Google AdSense may set or read cookies as part of serving and measuring ads; that is Google's mechanism, described in how Google uses cookies , not something this site configures itself. On every page that processes a file, no AdSense request is made at all, so no AdSense cookie is set or read there either.
We do use Cloudflare Web Analytics to count page views, so we know which
pages are worth improving. It works by loading a small script from
static.cloudflareinsights.com. Because this domain is proxied through Cloudflare,
the measurements it reports go to img-fix.com/cdn-cgi/rum — this site's own
address — rather than to a separate analytics domain.
It records page-level information: which page was viewed, referrer, and general technical details like browser and country. We do not use it to identify individual people, we do not attempt to link visits together into a profile, and there is no way for us to connect a page view to a person. Cloudflare processes this data as our provider; their documentation describes what the product collects, and their privacy policy governs their handling of it.
This does not touch your images. Analytics counts page views. It has no access to the files you open in the tools, which are never sent anywhere — see the section above. Every page's Content-Security-Policy permits the analytics script by name; content pages additionally permit AdSense's ad-serving hosts, described in the next section. On every page that processes a file, the Content-Security-Policy permits neither AdSense nor anything else beyond analytics, and forbids the page from opening a connection to any other host.
Advertising
The site is free and is supported by display advertising from Google AdSense. Ads appear only on content pages that have no file input: the homepage, and Sources, How it works, About, Data and Surprising passport photo rules.
Ad scripts never run on any page that processes an image — the compressor, the passport photo cropper, the HEIC converter, every per-country and per-portal page under them, and the photo sizes reference table. This is not just a promise about what the pages load; it is enforced by this site's Content-Security-Policy, which additionally forbids the AdSense script host by name on exactly those paths. If that were ever misconfigured, the browser itself would still block the request — the same mechanism described in the section above for the no-exfiltration guarantee.
Why the split: the tools' entire premise is that your file is processed privately in your browser and goes nowhere. Loading a third-party ad script on the same page as a file input would put code from another company on the page at the moment you are using it, even though that code cannot see the image data. Keeping ads confined to pages with no file input removes that concern rather than relying on the ad network's own behaviour.
AdSense is Google's product; what it collects and how it is governed is described in how Google uses information from sites that use its services and Google's own privacy policy. We have not independently verified every detail of AdSense's data practices beyond what Google publishes, and this page does not claim more than that.
Two commitments hold regardless of where advertising sits: it will never have access to your images, because ad scripts cannot reach the image data the tools work on, and ads are never placed between you and your result.
Third-party requests
On the content pages listed above, this site loads the Cloudflare Web Analytics beacon described earlier and, for AdSense, scripts and requests from Google's ad-serving domains. On every page that processes a file, the AdSense request never happens: the page's own code never adds it, and the Content-Security-Policy independently forbids it, so both would have to fail at once for an ad script to load there. Everything the tools themselves need, including the WebAssembly decoder that reads HEIC files, is served from img-fix.com on every page.
Outbound links to official government sources are plain links. They are not loaded, embedded or pre-fetched, so following one is a normal visit to that site under its own privacy terms.
Children
img-fix is a general-purpose utility not directed at children, and it collects no personal information from anyone, including children.
Your rights
Data protection law — including the GDPR and the UK GDPR — gives you rights to access, correct and erase personal data held about you. Because we hold no personal data, there is nothing for us to produce or delete. If you believe otherwise, write to us using the address on the contact page and we will respond.
Changes
Material changes will be reflected in the date at the top of this page. Changes that introduce new data processing — analytics or advertising — will be described here before they take effect, not after.
Contact
See the contact page.