Privacy Policy

Last updated: May 2026

The short version: Your files never leave your device. PhotoScrub does not collect, process, transmit, or store any of your photos, PDFs, or images. This is not a legal formality — it is a technical fact baked into the architecture.

How PhotoScrub works

PhotoScrub is a static website hosted at photoscrub.typeid.org on Cloudflare Pages. When you visit, your browser downloads HTML, CSS, and JavaScript files from Cloudflare's CDN. After that, all processing happens entirely inside your browser tab:

  • The File API reads your files directly from your disk into browser memory (RAM).
  • JavaScript parses and modifies file data in memory — EXIF stripping, PDF metadata removal, or image compression.
  • The processed file is written directly from browser memory to your Downloads folder.

No file data is ever sent over the network. There is no upload endpoint. Cloudflare, which hosts this website, has no ability to receive your files because no code on this site sends them.

What we do not collect

  • We do not collect your files or any content within them.
  • We do not collect GPS coordinates, metadata, or any information removed from your files.
  • We do not require an account, email address, or any personal information.
  • We do not use cookies for tracking or analytics.
  • We do not use analytics that identify individual users.

Third-party scripts

PhotoScrub loads the following JavaScript libraries from CDN (jsDelivr) on relevant pages:

  • exifr — reads EXIF data for display before stripping (photos page only). Runs locally; does not receive your images.
  • pdf-lib — reads and modifies PDF files (PDF page only). Runs locally; does not receive your documents.

jsDelivr may log standard CDN access data (IP address, timestamp, resource requested) per their own privacy policy. Your file content is never sent to jsDelivr.

If advertising is enabled, ad network scripts (e.g. Google AdSense) are loaded from third-party servers. These scripts do not have access to your files but may set cookies and collect standard browsing signals per their own policies.

Hosting

This site is hosted on Cloudflare Pages. Cloudflare may retain standard web server access logs (IP address, browser, pages requested) as part of CDN operation. Cloudflare never receives or processes your files.

Data controller

The data controller responsible for this website within the meaning of the GDPR is:

Claudio Busse
E-Mail: smudge.arch-3g@icloud.com

Legal basis for processing

This website does not actively collect or process personal data. The only data processing that occurs is incidental to the operation of the hosting infrastructure:

  • Cloudflare access logs (IP address, browser, pages requested) are processed on the basis of Art. 6(1)(f) GDPR — legitimate interest in operating a secure, functional website. These logs are retained and controlled by Cloudflare under their own privacy policy.
  • jsDelivr CDN logs (IP address, resource requested) may be retained by jsDelivr when loading third-party libraries. Same legal basis applies.

No file content you process through this site is ever collected, transmitted, or stored — by us or by any third party.

Your rights under GDPR

Under the General Data Protection Regulation (EU) 2016/679, you have the following rights regarding any personal data processed about you:

  • Right of access (Art. 15) — you may request confirmation of whether we process data about you and obtain a copy.
  • Right to rectification (Art. 16) — you may request correction of inaccurate personal data.
  • Right to erasure (Art. 17) — you may request deletion of your personal data where it is no longer necessary.
  • Right to restriction (Art. 18) — you may request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Art. 20) — you may request your data in a structured, machine-readable format.
  • Right to object (Art. 21) — you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at smudge.arch-3g@icloud.com. Given that this site collects no personal data beyond incidental hosting logs (which are controlled by Cloudflare), most of these rights are best exercised directly with Cloudflare.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Germany, you may contact the data protection authority for your state (Landesbeauftragter für den Datenschutz) or the federal authority:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Str. 153, 53117 Bonn
www.bfdi.bund.de

Contact

Questions about this privacy policy: smudge.arch-3g@icloud.com