Security & privacy

ExactPic is built so that your photos never leave your device. This page explains exactly how that works and — more importantly — how you can verify it yourself instead of taking our word for it.

How local processing works

When you open a tool and select an image, the file is loaded into an in-memory canvaselement in your browser. All resizing, compression, and format conversion run on that canvas using your device's own CPU. The resulting file is created in memory and offered to you as a download. Your image is not sent to an ExactPicserver for processing. You can confirm this in your browser's Network tab — there is no outgoing request carrying your file after the page loads.

The site itself is a set of static files served from a CDN. Loading a page transfers the HTML, CSS and the JavaScript for the page itself; the code that does the actual work is a separate download, fetched the first time you run that tool rather than when the page opens. Once it has been fetched the browser caches it and the tool needs no further network access at all. The exceptions are the AI-powered ones — background removal, subject cutouts and the passport white-background path — which download a machine-learning model before they can run, and may fetch it from a third-party CDN. That download carries no data of yours in either direction: your image still never leaves the device. We publish an enforced Content-Security-Policy that limits which third-party domains the page can connect to — including Google Analytics for aggregate traffic measurement when you allow it — which you can inspect in the response headers.

HEIC/HEIF photos (from iPhones) are decoded by your browser's own image decoder — the HEIC file is never uploaded to convert it. Safari and iOS can open the format; most other browsers cannot, and where yours cannot we say so immediately rather than appear to try.

Being processed locally and working offline are related but not the same thing, and the difference is worth stating plainly. Your files are never uploaded, on any tool, whether or not you have a connection. But a tool you have never run on this device has not downloaded its working code yet, so opening a page and going offline before running anything will stop with a loading error rather than a result. Run the tool once with a connection and it is cached from then on.

How to verify it yourself

You do not have to trust this claim. Here are two independent ways to check:

1. Watch the Network panel.Open your browser's developer tools (F12 or right-click → Inspect), switch to the Network tab, then compress or convert an image. You will see the page assets load, but no request that uploads your image. There is no large outgoing request carrying the file.
2. Disconnect from the internet. Load a tool page and run it once, so the browser has its working code. Then turn off Wi-Fi or unplug the network and run it again on another file — it still works, because everything happens locally. A tool that secretly uploaded your file could not finish with the network off. Do the run-once step first: without it you are testing whether the code can download, which it cannot, and that proves nothing either way about your file.

What we do and do not collect

• We do not receive, store, or transmit your images, filenames, or image metadata.

We use Google Analytics 4 (GA4) to measure aggregate traffic: pages visited, general device type, and tool usage events (tool_open, file_select, process_start, process_complete, process_fail, download, retry_tool, portal_view, task_view, check_result, heic_decoded, report_error_click).

GA4 does not receive your images, filenames, or the values you type into a tool.

Measurement is on by default. You can switch it off from the footer of any page or on this page, and a browser sending a Global Privacy Control signal is opted out automatically.

GA4 sets first-party cookies (_ga, _ga_*) unless you switch analytics off. IP anonymization is enabled in our GA4 configuration.

GA4 default event retention is 2 months unless changed in the GA4 property settings.

To opt out, use a browser extension that blocks Google Analytics, or enable “Do Not Track” and a GA opt-out add-on from Google.

• Our CDN may log standard request data such as IP address and browser type — the same as any website — but never the contents of your files.

Honest limitations

We want to be clear about what ExactPic is not:

• It is not an official government or passport service. Meeting a KB, pixel, or format requirement does not guarantee your photo will be accepted — many portals also check head position, background color, or expression, which are your responsibility to get right.
• It cannot repair a corrupted source file or add detail that was never captured. Compressing to a very small size will reduce visible quality.
• Requirements on third-party portals change without notice. Always confirm the current limits on the official form before you upload.

Who runs ExactPic

ExactPic is operated by MASTERPANEL LLC (Louisville, Kentucky, USA), a registered Kentucky Limited Liability Company. You can verify the company on the Kentucky Secretary of State record. If you have a security question, want to report a vulnerability, or need clarification about how the tools handle your data, email [email protected] and we will respond.