Local file access
JavaScript reads the file only after you select it. The original media bytes are never uploaded. For still images, a separate sanitized JPEG preview and normalized report are published after analysis; filename, timestamps, raw C2PA, and raw local report remain local. Audio and video create no publication.
Local audio and video reading
Supported audio and video containers are parsed inside a dedicated browser Worker using same-origin MediaInfo WebAssembly and chunked Blob slices. Native preview controls use a temporary local blob URL without autoplay. Audio and video bytes, tags, embedded artwork, chapters, stream data, titles, artists, codecs, and normalized JSON remain local. Large files may temporarily use browser memory, and unsupported private structures may not be reported.
Local visual context
For still images only, the selected image is also passed to a browser Worker for a separate visual estimate. The Worker uses WebGPU when available and otherwise falls back to WebAssembly. Model weights and runtime files are downloaded from this same site and may remain in the normal browser cache; the selected image is never included in those requests. The score is probabilistic and is not embedded metadata, provenance, or authorship probability.
Optional local captioning
Captioning runs only when you press its button. A same-origin model uses WebGPU when available to suggest a title, description, and tags for an image or sampled video frames. The original stays local and is not included in model downloads. Generated text may hallucinate and requires review. Caption output stays local and is excluded from the automatic public UUID result in this release. Video captioning samples frames; it does not inspect the complete stream. The feature does not infer identity, exact age, or ethnicity.
Local N-rated content estimate
For still images only, a separate same-origin model estimates whether visible nudity or sexual content may be unsuitable for a general audience. Original image bytes, inference tensors, and raw model outputs remain in the browser; same-origin model and runtime requests contain no file data. A separately re-encoded preview may later be published as described below. This probabilistic screening signal is not an age rating or a finding about any person’s age, identity, consent, intent, or the legality of the image.
Local visual inventory
For still images only, after the separate AI-pattern estimate, a pinned COCO object model runs in another local Worker and suggests up to ten labeled regions. WebGPU is preferred and WebAssembly is the compatibility fallback. Model weights and runtime files come from this same site; image pixels, boxes, labels, tensors, and confidence scores are not uploaded. Suggested labels may be wrong, incomplete, or sensitive and are not reliable accessibility text.
Remote URL imports
When you submit public URLs, this service sends them one at a time to its same-origin fetch endpoint. The server downloads at most 100 MB per URL into bounded memory, returns the bytes to your browser, and does not save the fetched files. Source websites receive requests from this server. Private, local, link-local, credentialed, and unsupported addresses are blocked, including after redirects. Subsequent analysis runs in the browser; image reports follow the normal 24-hour publication rules, while fetched audio and video remain local after delivery.
Anonymous activity counters
The homepage shows approximate site activity. One visit is normally counted once per browser and UTC day using a local-storage date flag shared across tabs, including a first entry through an SEO landing page. A file is counted after its core local metadata read succeeds, independently of the optional visual model. Counter requests contain only the event schema and event type; the domain identifies the tool. They contain no image, filename, prompt, metadata, score, result, UUID, cookie, persistent device identifier, or IP-derived identifier. If local storage is unavailable, deduplication cannot be guaranteed, so the displayed numbers are estimates rather than unique people.
Automatic 24-hour image publication
The still-image picker states before selection that a completed report will publish. The browser sends a metadata-free preview plus normalized summary, generation parameters, embedded text, visual score, object regions, and rounded N-rated classification and model score. It does not publish raw N-rated logits, tensors, crops, or body-part labels. The public UUID page is listed in Recent results for up to 24 hours and remains noindex. Anyone can view, copy, or cache its published information. When the N-rated estimate is uncertain, detected, or unavailable, the public UUID preview is replaced with a neutral placeholder and the result is excluded from Recent results. The original image and filename are not uploaded. Audio and video reports remain local-only.
Storage and deletion
A random deletion credential is stored in this browser so you can remove a published result. The public-result store contains only the sanitized preview, selected summary, social card, creation and expiry times, and a hash of that credential. New automatic still-image results expire after 24 hours; older explicitly created links retain their original expiry. Physical cleanup runs at least every six hours. Deletion cannot immediately remove copies already cached by Telegram or another third party.
Operational logs
Standard web logs may record an IP address, requested path, response status, and timestamp for security and reliability. They do not contain the original image, published field values, visual score, object labels, counter payload content, or deletion credential.
Local reader resources
The page loads the C2PA reader, MediaInfo parser, bundled official trust-list snapshot, ONNX AI-pattern, N-rated, object and captioning models, and compatible WebGPU/WebAssembly browser runtimes from the same site. Your file is not included in those requests.
Analytics
Google Analytics is disabled unless you explicitly consent. Events contain only the static tool identity. File names, share IDs, URLs, images, prompts, metadata, hashes, visual scores, N-rated classifications and scores, object labels, object confidence values, media kind, duration, codecs, titles, artists, stream fields, result values, and deletion credentials are excluded.
Contact
Email: eschota@gmail.com. Please do not email image files or sensitive embedded metadata.