How your files stay private

The tools process files on your device, so they never reach our server. Only the paid HTTP API receives files, and it handles them in memory without storing them. Updated 24 September 2026.

Security

  • Files stay on your device: The tools run in your browser and upload nothing – not even to our server.
  • No AI, no cloud models: Classic algorithms that run on your own computer or phone.
  • Nothing kept from the API: Pro API files are held in memory only and discarded after processing.
  • Two-factor sign-in: Protect your account with an authenticator app and recovery codes.

Processing in your browser

Every tool on this site – background and object removal, metadata cleanup, PDF tools and text cleanup – runs in your browser, in a separate thread (Web Worker). Images, PDFs, documents and text are processed on your device and are not uploaded anywhere, not even to our server.

  • Before processing, each file is checked from its actual bytes, not its name: real type, size and image resolution. A file whose content does not match its extension is refused.
  • Files that are too large or have too many pixels for your plan are refused before they are decoded, so a crafted file cannot freeze your browser.
  • Heavy jobs run with a time limit and you can cancel them at any time.

Check it yourself

You do not have to take our word for it. Every browser shows what a page sends:

  1. Open the developer tools (F12, or Cmd + Option + I on a Mac) and switch to the Network tab.
  2. Process a file with any tool.
  3. Go through the requests: you will see the page’s own scripts, styles and fonts, but no request that carries your file.

If you are signed in with history switched on, you will also see one small request with the file name and sizes for your history – never the file itself.

Our Content Security Policy only allows the page to connect to its own address. Even if someone wanted to, the page could not send your file to another server.

No AI – classic algorithms

We do not use neural networks or AI models. The tools are built on proven image-processing methods: colour and edge analysis, chroma key for green and blue screens, flood fill (magic wand), GrabCut-style segmentation of a selected area, and inpainting (Telea and PatchMatch), which fills a removed area from its surroundings.

That is what makes them private and fast: there is no model to download and no GPU server, so they run on an ordinary computer or phone and your files never have to leave it. It also means they have limits:

  • Works best: solid or contrasting backgrounds, product photos, logos, green screen, small objects, thin text and small watermarks.
  • Works poorly: hair and fur on busy backgrounds, complex scenes, large objects, and big semi-transparent watermarks over detailed areas.

Clean output files

  • Edited images are encoded again from their pixels, so the results carry no EXIF, GPS, camera or editing data.
  • PDFs and Office documents keep their internal structure. To remove their metadata, hidden parts or attachments, use the metadata and PDF tools.
  • SVG files are not accepted at all. An SVG can contain scripts and references to external resources, so we refuse it rather than try to clean it.

HTTP API (Pro)

The HTTP API is the only way a file reaches our server – you send it there yourself from your own code. The server processes it in memory only and discards it as soon as the result has been sent.

  • File contents are never written to disk, to a database or to logs.
  • The file size is checked before the request is read; oversized and compressed request bodies are refused.
  • Jobs wait in a short queue and only a few run at the same time, each with a time limit, so a single request cannot overload the server.
  • We record only metadata: the number of operations and the volume of data per month, for your quota and billing. If history is switched on in your account, API jobs appear there with file name, tool and sizes.
  • Per-minute rate limits and the monthly quota are counted per account, not per key.

Website protection

The site sends strict security headers that limit what the page is allowed to do:

  • Content Security Policy: scripts, workers and network connections only from our own origin. The only outside resource is the Inter typeface from Google Fonts.
  • HTTPS only, enforced by HSTS. The page cannot be embedded in frames on other sites (clickjacking protection).
  • nosniff, a strict Referrer-Policy and a Permissions-Policy that switches off access to the camera, microphone and location.
  • Changes to a signed-in account are protected against CSRF by checking where each request comes from.
  • All endpoints have rate limits against flooding and password guessing.

Accounts and sign-in

  • Passwords are stored only as a scrypt hash. Common and easily guessed passwords are refused.
  • Optional two-factor authentication (TOTP) with an authenticator app and ten one-time recovery codes. The 2FA secret is stored encrypted.
  • A list of your signed-in devices – you can sign out any of them. When a new device signs in, we send you an e-mail alert.
  • Failed sign-ins are limited per IP address and per account. Sign-up is protected by a computational check against bots instead of a captcha.
  • The session cookie is HttpOnly, Secure and SameSite. Changing your password signs out all other devices.

API keys

  • You see the full key only once, when you create it. We keep only its SHA-256 hash, so the key cannot be read from our database.
  • Each key can be limited to specific permissions (scopes), allowed IP addresses and an expiry date, and revoked at any time.
  • Repeated attempts with invalid keys from one address are temporarily blocked.

Payments

Payments are processed by Stripe. Your card number never passes through our server and we have no access to it – we keep only the Stripe customer and subscription identifiers.

What we store

  • Without an account: nothing about your files.
  • With an account: e-mail, password hash, language, plan and settings; signed-in devices with a hashed IP address; security events.
  • History of processed files – metadata only (file name, tool, sizes, time), never the content. You can switch it off and clear it in your account.
  • API usage counts for the quota and billing.

Reporting a vulnerability

Found a security issue? Please write to contact@adscaled.media before you make it public – the contact is also listed in /.well-known/security.txt. We reply as soon as we can and thank everyone who reports responsibly.