Privacy
Marks are applied here. No picture is sent anywhere.
The short version
Your files stay on your disk. This page reads them, draws the mark, writes new files, and keeps nothing — there is no server behind it for a copy to go to.
Nothing you open is sent anywhere, because there is nowhere for it to be sent. This site is a set of static files on a content network; it has no application server, no database and no endpoint that accepts a picture. That is not a policy that could be changed quietly — a check in the build refuses to publish the site if any code in it starts making a network request with image data, and the whole thing would have to be rearchitected to break the promise.
Traffic goes the other way once, and only if you ask for it. If you press Suggest a spot in the Placement group, one file is fetched from a host that is not this one: the subject finder’s weights, 6,163,938 bytes, from our model file server. That request is a program arriving, not a photograph leaving — it carries nothing about you beyond what any request for a file carries, and no part of your picture is in it. This page used to say that nothing at all is fetched from another domain. That stopped being true the day the suggestion was added, so the sentence was rewritten rather than left standing.
What happens to a picture you open
| Reading it | The file is read by the browser into memory in this tab. The copy on your disk is never written to, renamed or moved. |
|---|---|
| Working on it | The picture is drawn onto a canvas, the mark is drawn over it, and the result is drawn again at full size when you save. In a batch each file is marked in a background worker that belongs to this tab. All of it happens on this device. |
| Camera data | The camera-data mark and the {year} and {date} wording read the make, model, lens, settings and date from the file's own header, in this tab. Nothing is looked up anywhere. The saved file does not carry the original camera data or GPS position, because it is re-encoded from a canvas — unless you tick “Keep the original camera data”, which copies the camera, lens, exposure and date back into a saved JPG and still leaves out the GPS position, the embedded thumbnail and the maker's private notes. |
| Mark faces | The fourteen faces a mark can be set in are files on this site, fetched from this domain the first time a mark uses one. No font is requested from any other host. |
| Large pictures | Above roughly 32 megapixels — 16 on an iPhone or iPad — you are asked whether a lighter working copy is acceptable, because the alternative is a tab that fails silently. The choice is yours and it is remembered nowhere. |
| Saving it | A new file is assembled in memory and handed to the browser's own download machinery. It goes wherever your downloads go. |
| Afterwards | Closing or reloading the tab drops everything. Nothing is written to disk by this page except the file you asked for. |
| HEIC and TIFF | These need a decoder the browser does not have, so a code file is fetched the first time one of them turns up. That request carries no part of your picture — it is a program arriving, not a photograph leaving. |
| Suggesting a spot | Only if you press it. A reduced copy of the picture is made in this tab, a model runs over it here — on this device's graphics processor through WebGPU where the browser offers it, otherwise on its processor — and it reports roughly which parts of the frame a person occupies. Those numbers rank the nine positions, the ranking becomes one sentence, and the rest is dropped before the sentence is shown. No cutout is produced, nothing is kept, and nothing about the picture is transmitted. |
What is stored, and only when you ask
Saved settings. When you name a set of mark settings and keep them, they go into this browser’s own storage for this site, on this device. They hold the mark description and nothing else: no picture, no file name, no identifier for you. A signature mark’s strokes are part of its description, so a saved signature setting holds them.
A logo, if you tick “Keep the logo with this recipe” when saving. The logo file — at most 2 MB, and at most ten recipes with a logo — is kept in this browser’s IndexedDB beside the recipe, so loading it brings the logo back. Forgetting the recipe deletes its logo.
A signature, if you tick “Remember this signature on this device”. Its strokes are kept in the same IndexedDB store; unticking the box deletes them.
A recipe file you save is an ordinary download that goes wherever your downloads go; opening one reads it in this tab as data.
And the subject finder, if you ever downloaded it. The model file is put into this browser’s cache for this site so the second use costs no request at all and works with the network switched off. It is a program that came from the network, not anything of yours, and the panel that offered the download carries a control that deletes it again. It is checked against its SHA-256 checksum before it is cached or run, and a file that does not match is discarded. Its runtime — 13.3 MB of WebAssembly, or the 24.6 MB WebGPU build on a device that offers WebGPU — comes from this domain rather than our model file server, and the browser caches it like any other file of this site.
Records of a stopped folder run. When a run on a folder is stopped before the end, the names, sizes and modification dates of the files it finished — and the names it gave them — are kept in this browser’s IndexedDB against a fingerprint of the settings, so the next run with the same settings can offer to skip them. No picture and no part of one is kept. A run that reaches the end deletes its record, and only the five most recent are kept.
The offline copy, if you open the phone page. /watermark-on-phone asks the browser to keep this site’s own code, fonts, pages and illustrations in a cache (a service worker), so the page opens without a connection. It never caches a picture, a setting or a model file.
Clearing site data for this page deletes all of it. A different browser or a different machine starts empty. There is no synchronisation, because there is no account for anything to synchronise to.
Measurement, and no advertising
This site carries no advertising. No advertising script loads on any page and no advertising cookie is set.
Page views are counted with Cloudflare Web Analytics, and only on watermarkpicture.com itself: a small check in each page adds the Cloudflare beacon when the address in your browser is this domain, so a local copy or a preview build sends nothing. The beacon is cookieless. It reports the page requested, the referrer, a coarse country, the browser and device category and loading performance, and Cloudflare aggregates those into counts; it does not build a cross-site profile. It receives nothing about the picture, the watermark wording, the placement, the opacity, a saved setting or an exported file.
Blocking the beacon changes nothing about the tool. The other request to another host is the model file described above, which is a file you asked for and which sets nothing.
- No sign-in exists here, so there is no account and no password. The only email address this site ever receives is one you type into the contact form yourself.
- No file you open is transmitted, logged, cached or counted.
- Declining the model download costs you nothing but the suggestion: the nine-point grid, the inset, the rotation and the drag handle are the tool, and they were the tool before there was a model to decline.
- Nothing about the mark you chose — the wording, the placement, the opacity — leaves the page.
- No profile is built about you by this site, and no third-party identifier or cookie is set from these pages.
Children, and getting in touch
This is a general-audience utility with no accounts, and apart from a message someone chooses to send through the contact page it collects nothing, so it does not knowingly hold information about anybody of any age.
If something on this page is wrong, or you want to ask what happens to a particular kind of file, write from the contact page. Its form sends what you type — your name, your email address and your message — plus this site’s domain to a Google Form, and only when you press its send button. Opening that page fetches nothing from Google, no other page here talks to Google, and the form cannot carry a picture or a mark.