What this page reads, and what it sends

There is no server behind BorderPhoto. The site is a set of static files, and the tool is JavaScript running in your tab. A photograph you open is turned into pixels in memory, measured, composited and encoded there, and the finished file is handed to your own browser’s download machinery. It is never transmitted, never stored and never written to any database, because there is nowhere for it to go.

The file is read from disk by the page, decoded into an image in memory, and held there for as long as the tab is open. A second copy, no longer than 2560 pixels on its long edge, is made for the canvas. When you open a different photograph or close the tab, both are released and nothing remains.

The front of the file is also read, up to a quarter of a megabyte of it, to find what the container declares about itself: a resolution in the JFIF header, the Exif block or a pHYs chunk, how many colour components a JPEG carries, and whether the container holds more than one frame. Those readings drive the rail and are discarded with everything else.

No cookie is set by this site, and no setting you make in the rail is remembered between visits unless you ask for it. Two exceptions, because a blanket denial that is nearly true is worse than a qualified one. Pressing Save under Recipes writes that recipe — its name and its numbers, never a pixel of the photograph — to this browser’s IndexedDB, where it stays until you delete it there or clear the site’s data; it is never sent anywhere. Nothing is written to session storage, and no cookie is set. The second: if you choose to use one of the optional on-device models described below, its file is kept in this browser’s Cache Storage so it is not downloaded again. A caption, a name or a date you type is never stored, and is left out of recipe files and share links.

This site uses Cloudflare Web Analytics. Its beacon is loaded only when the page is served from borderphoto.com itself: a small check in the page compares the address before any request is made, so a local copy, a preview deployment or a saved page sends nothing. On the live site the beacon records aggregate page views and performance timings — the page path, the referring site, a coarse country, and the browser and device category. It sets no cookie and assigns no identifier that follows you between visits or between sites.

The analytics property belongs to this site alone. It receives nothing about a photograph you open: the border tool never sends pixels, file names, file details, colours, captions, settings or export activity to the beacon.

None. This site shows no advertising and loads no advertising script.

At most three hosts besides this one, and none is ever handed a photograph: the measurement beacon, the contact form, and — only if you choose an optional model — our model file server, described below. The typefaces are served from this domain as part of the build. What does leave is the Cloudflare measurement beacon described above, on borderphoto.com only, and — only if you press send on the contact page — the note you typed, which goes to Google Forms as described below. Each sees what any web request shows the server it goes to: an IP address, a user agent, the page asked for. Image data is not in that list and cannot be, because it never leaves the tab in any form.

One request is conditional, and it is not a third party. Opening a HEIC photograph — what a recent iPhone writes by default — pulls a WebAssembly decoder from this domain the first time one is needed, as a separate chunk that nobody else ever downloads. It is a request for a decoder; it carries no part of your file.

Two features use a small machine-learning model: the person outline (a person-segmentation model, about 5.9 MB) and the face check on round profile pictures (a face finder, about 0.2 MB). Neither runs unless you press its button, which first tells you the size. The model file is then downloaded from our model file server, and the runtime that executes it — about 13.4 MB — from this site. That download is a request for a fixed file, the same for everyone; it carries nothing about you or your photograph. The model runs in your tab, and the photograph, the outline it finds and any face boxes stay there.

Downloaded models are checked against a recorded checksum before they run and are kept in this browser’s cache. Clearing this site’s data in your browser removes them. Hindi and other Devanagari captions use a typeface file served from this site, loaded only when such text is typed.

The contact page is the one place a request leaves for Google. Pressing its send button posts the name, email address and message you typed, together with this site’s domain, to a Google Form, which keeps the response under Google’s own policies. Nothing is sent while you type or before you press the button, no photograph or setting is ever part of it, and no other page here contacts Google.

If this document changes in a way that alters what is collected, the change will be described here rather than folded quietly into the text. Questions about it, or about the claims above, are welcome through the contact page.