Privacy

• Photographs are read by the page and never transmitted. There is no server here to transmit them to: the whole site is static files, and no address on it accepts an upload.
• Every fill runs in this tab. The learned fill runs here too, in a background worker, after a one-time download that states its size before anything moves.
• By default nothing about a picture is stored — not the pixels, not the file name, not the dimensions, not the region you painted. Closing the tab ends it. One switch changes that, and only in your own browser: see Keeping your work, below.
• There are no accounts and no sign-in. The only place an email address is asked for is the contact page, and only if you choose to write.
• Pages on pictureeraser.com load Cloudflare Web Analytics, a cookie-free beacon that counts aggregate page views. It loads when a page loads, before any photograph is opened, and it cannot see the working surface.
• This site carries no advertising.

Here is the whole list. On the live domain, every page view loads the Cloudflare Web Analytics beacon from Cloudflare's beacon host, and the beacon reports that page view back to Cloudflare. If you open an iPhone HEIC file, a WebAssembly decoder of roughly one and a half megabytes is fetched from this site. If you choose the structure-aware fill and press its download button, migan-512.onnx is fetched once from our model file server; if you press Find people and then its download button, human_segmentation_pphumanseg_2023mar.onnx is fetched once from the same server. If you send a message from the contact page, the message goes to a Google Form. Nothing else leaves the page, and none of these requests carries your photograph or anything derived from it.

Picking a file hands this page a reference to it. The bytes are read into memory, the front of the header is parsed to establish what kind of file this actually is and what the camera recorded about rotation, and the pixels are decoded into a canvas. From that point the picture exists as arrays of numbers inside the tab. The region you paint is another array. The fill is arithmetic over both. What you save is assembled in memory and passed to whatever the browser uses to put things in a downloads folder.

None of those steps sends your picture anywhere. The audit that runs before this site is published fails the build outright if a module that touches image data acquires the ability to make a request; the one module that downloads a model touches no pixels, and it is described below. A check a machine runs is worth more here than a sentence somebody wrote.

Two deliberate exceptions exist and both are worth naming precisely. If a HEIC photograph from an iPhone is opened, a WebAssembly decoder of roughly one and a half megabytes is pulled down, because no browser reads that container on its own. And if you choose the structure-aware fill, the model that engine runs is downloaded — the next section is about that one. Each request asks for a fixed static file at a fixed address and carries nothing about your picture, in the URL or anywhere else. Neither happens on a plain page view.

The fill engines that ship inside this page — the patch search, the marching fill, the smooth fill and the clone from a pinned source — are arithmetic over the pixels of your own photograph and reach nothing. The remaining engine is a neural network, and a network is a file. Choosing Structure-aware in the engine list and pressing the button under it downloads migan-512.onnx: 26,639,447 bytes, about 25.4 MB, MIT-licensed, from our model file server. That is a different host from this one, and the download is refused unless its length and its SHA-256 match the published figures.

What that request contains is a fixed URL and whatever your browser attaches to any request for a static file: its own version string, and the address it is coming from. It has no body. Nothing about your photograph is in it — not the pixels, not the file name, not the dimensions, not the region you painted, not whether you have opened a photograph at all. The model travels to your device, and your picture never travels anywhere.

The runtime that executes the model — ONNX Runtime's WebAssembly build, 13,986,063 bytes across two files — is served from this domain. The page hands the verified model to a background worker in this tab, and the inference runs there, so the page keeps responding. Total for the first structure-aware removal on a device: about 38.7 MB, stated in the interface before a byte of it moves. Both files are then kept in your browser's cache, so a second removal fetches nothing, and the same panel offers a button that deletes them again.

Declining costs you nothing but that engine. The four built-in fills do every removal on this site and are what runs unless you deliberately pick the model; the download is never begun on your behalf, and closing the page part-way through discards what had arrived rather than keeping a broken file.

One more file can come the same way. Find people, which proposes a region around anyone standing in the picture, needs a small segmentation model: human_segmentation_pphumanseg_2023mar.onnx, 6,163,938 bytes, Apache-2.0, from our model file server and with the same request shape — a fixed address, no body. It is fetched only when you press the button under the size statement, checked against its published SHA-256 before it is kept, and run by the same on-device runtime. It returns a painted region and nothing else; the picture stays where it is.

The Export area of the eraser has a box labelled Keep my work in this browser if the tab closes. It is unticked unless you tick it. While it is ticked, the photograph you opened and the list of removals you made — each region as a run of numbers, with its method and settings, and nothing else — are written to this browser's own IndexedDB store after every removal, and the tick itself is remembered in localStorage. When you come back, the page offers to restore the session or discard it; it never restores on its own.

That store belongs to this site in this browser on this device. Nothing in it is sent anywhere: there is no server to send it to. Unticking the box deletes what was saved, and so does the Delete the saved session button next to it, or clearing this site's data in your browser settings.

Every EXIF field in the original — camera, lens, exposure, the date, and the location if your camera recorded one — is absent from the file this page saves. None of that is a feature added on top: it falls out of the way a browser writes a canvas into a file, and it is the right outcome regardless. The pixels have been rewritten, so carrying forward a capture record that describes a photograph nobody took would be a small lie. If you need that data, keep the original, which this page never modifies.

On pictureeraser.com, every page loads Cloudflare Web Analytics. It is a small script from Cloudflare's beacon host, and its property belongs to this domain alone. For each page view it reports aggregate figures to Cloudflare: the page address, the referring page, a coarse country derived from the connection, the browser and device class, and page-load timing. It sets no cookie, keeps nothing on your device, and assembles no history across visits or across sites.

It loads when the page loads, before any photograph is opened, and it has no access to the working surface: it cannot observe whether a photograph was opened, what the photograph contained, which region was erased or what was saved. The site sends it no events of its own. A preview copy of the site, a page saved to disk or a copy running on any other address does not load the beacon at all; the check runs in the page before the script is added.

This site carries no advertising, and no advertising script is part of it. If that ever changes, this page will describe what such a script could see before the first advert appears.

The contact page is the one place this site asks you to type anything about yourself. When you press its send button, the name, email address and message you wrote, together with the name of this site, are posted to a Google Form, and Google keeps the response under its own terms. The form is sent only when you press send, nothing from the desk is ever attached, and no other part of this site talks to Google.

Should any statement above cease to be accurate, this page is edited before anything ships, and the edit is spelled out rather than buried under a version number. A site whose whole proposition is that nothing leaves the device does not get to alter that quietly.