What this page reads, and what it sends

There is no server behind BorderPhoto. The site is a set of static files, and the tool is JavaScript running in your tab. A photograph you open is turned into pixels in memory, measured, composited and encoded there, and the finished file is handed to your own browser’s download machinery. It is never transmitted, never stored and never written to any database, because there is nowhere for it to go.

The file is read from disk by the page, decoded into an image in memory, and held there for as long as the tab is open. A second copy, no longer than 2560 pixels on its long edge, is made for the canvas. When you open a different photograph or close the tab, both are released and nothing remains.

The front of the file is also read, up to a quarter of a megabyte of it, to find what the container declares about itself: a resolution in the JFIF header, the Exif block or a pHYs chunk, how many colour components a JPEG carries, and whether the container holds more than one frame. Those readings drive the rail and are discarded with everything else.

Nothing is written to local storage, session storage or IndexedDB. No cookie is set by this site. Your settings are not remembered between visits, which is a deliberate consequence of that and not an oversight.

No measurement property has been registered for this domain. The identifier that would name one is still the placeholder the build shipped with, and the page tests it before it writes the tag, so the beacon element is never rendered and no reporting script is requested. Nothing tallies a visit here, no referrer is recorded, and there is no figure about your visit for anyone to read afterwards.

The intent held in the source, for the day a property exists, is a service that needs no cookie, on an identifier belonging to this domain alone rather than one shared across sites, reporting the route asked for, a coarse country, a referrer and a browser family — and nothing whatever about a photograph you open, since the tool reports nothing about what it is working on. That paragraph describes a thing not switched on. It will be rewritten in the present tense in the same change that switches it on, and not before.

This site is built to display advertising supplied by Google AdSense, and its four placements are declared in the source: one below the working surface on a measuring route, and three at the breaks in the reading on a written note. None of them is on the page in front of you. The domain has not been through AdSense review, so the switch that governs all four is off and each one renders nothing at all — no band, no reserved height, no label. Approval turns the switch on and the units appear at the positions the source already fixes.

The boundary is worth setting out before that happens, because it is a property of where the code sits rather than of anyone’s good intentions: the advertising script is given no access to the photograph. It cannot read the canvas, it is not told which file was opened, its name or its dimensions, and no unit may be positioned above the panel where the work happens or inside it. Automatic placement stays disabled, so the only units that can ever appear are those four. Google sets its own cookies and applies its own policies to them, and those are documented by Google rather than restated here.

Today, nothing. The typefaces are served from this domain as part of the build, no reporting script is requested, and with advertising switched off no Google tag is fetched either — so opening a page here contacts no host but this one. When advertising is approved, Google’s script becomes the single exception, and it will see what any web request shows the server it goes to: an IP address, a user agent, the page asked for. Image data is not in that list and cannot be, because it never leaves the tab in any form.

One request is conditional, and it is not a third party. Opening a HEIC photograph — what a recent iPhone writes by default — pulls a WebAssembly decoder from this domain the first time one is needed, as a separate chunk that nobody else ever downloads. It is a request for a decoder; it carries no part of your file.

If this document changes in a way that alters what is collected, the change will be described here rather than folded quietly into the text. Questions about it, or about the claims above, are welcome through PictureEditor, named in the attribution line under the wordmark at the foot of every page.