Privacy policy

BlurMyPhotos has no accounts and sets no cookies, the only thing it counts is that a page was opened, and there is no server anywhere that could receive one of your photographs. That leaves very little to write a policy about, so this one describes what actually happens and nothing more.

1. The short version

Last updated 7 September 2026.

There is no account to create and nothing to sign up for.
We set no cookies of our own, first-party or third-party. Google's advertising code is now on every page; what it may set, and when, is section 4.
One cookieless page-view counter, described in full in section 8. No tracking pixel, no session recording, no profile, no identifier that outlives the request.
Your images are opened, edited and saved by your own browser. They are never uploaded, to us or to anyone else.
The only personal data we could ever hold about you is an email you decide to send us. The form on the contact page does not send anything — it writes the mail in your browser and hands it to your own mail app.

Everything below is the long version of those five lines. If any of them stops being true, the date above changes on the same day.

2. What we collect

Essentially nothing, and that is structural rather than a promise. The site is a set of static files on Cloudflare Pages. There is no application server, no database and no account system, which means there is no endpoint an image or a form submission could be sent to.

The contact page has a form on it, and it is worth being precise about what that form does, because an ordinary one would contradict the paragraph above. It does not submit anywhere. There is no handler, no form service and no third party behind it. What you type stays in the page until you press the button, at which point your browser assembles a mailto: link and hands it to your own mail app, where the message sits as a draft you can read, edit or throw away. Nothing is transmitted by this site at any point, and we see nothing at all unless you choose to send that mail yourself. Every page is served with form-action 'none' in its Content-Security-Policy, so a browser would refuse to post that form anywhere even if our code tried to.

No first-party cookie is set. Nothing is written to localStorage, sessionStorage or IndexedDB. Nothing about your visit survives the tab closing.

That leaves email. If you write to hello@blurmyphotos.com we hold your address, your message and anything you attach to it, in an ordinary mailbox, for as long as the exchange is useful and no longer than 24 months after our last reply, after which it is deleted. The lawful basis for handling correspondence someone chose to start is our legitimate interest in answering it — Article 6(1)(f) of the General Data Protection Regulation. Where you send more than an answer requires, such as a photograph attached to a bug report, the basis is your consent under Article 6(1)(a), and you can withdraw it by asking us to delete the message. Nobody who writes to us is added to a mailing list, because there is no mailing list.

3. Your images

When you open a file, the browser's File API reads it into a canvas on the page in front of you. Everything after that — face detection, the boxes you draw, the pixelation, the blur, the exported file — happens in your device's own memory. There is no upload, because there is no upload endpoint.

This is enforced by your browser rather than trusted to us. Every page is served with a Content-Security-Policy header whose connect-src directive names a short, fixed list of origins and no others: this site, the jsDelivr CDN, Google's model storage, Cloudflare's page-view beacon, and — since advertising code went on to the site — Google's advertising endpoints. Any other outbound connection the page attempted would be refused by the browser before it left your device, and not one of the origins on that list is an address a photograph or a document could be sent to. Google's ad endpoints receive requests for advertisements; there is no code path anywhere on this site that could put a pixel of your file into one. You can verify that two ways. Open the network panel in your browser's developer tools and watch what the page requests. Or load the page, put the device into aeroplane mode (airplane mode), and confirm that blurring a face still works with the network switched off.

Face detection does not change this. Choosing a file causes your browser to download Google's MediaPipe Tasks Vision runtime, version 1.0.1, from jsDelivr, and the blaze_face_short_range model from Google's model storage. The detection then runs on your own device. Traffic goes one way: code comes down, no image goes up. Neither file is fetched at page load, so if you never open a photo, neither is ever requested. HEIC and TIFF files each pull one further small library, again only when a file of that type is opened, and on Safari not even that, because Safari decodes HEIC itself.

The same holds for documents. Opening a PDF on the PDF tool causes your browser to download Mozilla's pdf.js renderer and its worker from jsDelivr; every page of your document is then rendered, redacted and written back out on your own device. The finished PDF is assembled inside the page by our own code, and it is written from scratch — the original's document properties, meaning the author name, the title, the producing software and the folder path it was saved from, are not carried into it.

One useful side effect of working in a canvas: re-encoding an image discards its EXIF block, so every file this site produces has already lost its camera data and GPS coordinates. That is also all the metadata stripper does, without the redaction step.

4. Advertising and Google AdSense

Accuracy matters here more than brevity, so this section separates two things that are usually run together: the advertising code, which is on the site now, and the advertisements themselves, which are not being served yet.

The code. Since 7 September 2026 every page carries Google's AdSense loader script in its head, and /ads.txt declares our publisher identifier. That script belongs to Google and is fetched from pagead2.googlesyndication.com, which means Google receives your IP address and the address of the page you are reading on every page load, exactly as it would on any other site carrying advertising. It is capable of setting cookies and of reading them.

The advertisements. No ad units are configured yet, so in practice no advertisement is placed on any page today. The reserved rectangles you may notice are placeholders holding their final height so the page does not jump when a unit is eventually put in one. That will change without a separate announcement, which is why the list below is written in the present tense rather than the future.

Where advertising is served:

Google and its partners use cookies to serve advertisements based on your prior visits to this site and to other sites.
You can opt out of personalised advertising at Google Ads Settings.
Google's own explanation of how it uses data from sites that use its services is at How Google uses information from sites or apps that use our services.

Advertisements sit beside the tools, never inside them and never beside a download button. No advertising network receives your image or your document, for the same reason nobody else does: neither is ever transmitted anywhere at all. If you would rather Google did not see you here, an ad blocker stops the loader being fetched in the first place, and every tool on this site works exactly as well with one running.

5. Visitors in the EEA and the UK

Google does not permit personalised advertising to visitors in the European Economic Area or the United Kingdom unless the publisher uses a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework. Google's AdSense documentation on consent management requirements dates that requirement from 16 January 2024 for the EEA and the UK, and from 31 July 2024 for Switzerland. That platform is what asks you for consent and passes your answer to Google through Consent Mode v2.

One will be in place before a single advertisement is served to a visitor in those regions, and this policy will name it and say what it stores on the day it is added. Until then, note the distinction drawn in section 4: the loader script is present and Google therefore sees your IP address, but no ad unit is configured for it to fill, and no personalised advertising is being served to anybody in the EEA or the UK.

6. Cookies

We set none of our own — not one, first-party or third-party — and there is no cookie banner, which is the honest consequence of having no cookies of our own rather than a corner cut.

Google's advertising code, described in section 4, is capable of setting third-party cookies and may do so. That is Google's cookie rather than ours: we cannot read it, and it carries nothing we put in it. Where advertising is served to a visitor in the EEA or the UK it is subject to the consent process in section 5. Nothing else changes. No first-party cookie of our own is planned, and no cookie is or will ever be required for the tool to work. Refusing every cookie your browser allows you to refuse will not stop you redacting a photograph here.

7. Third parties that see your IP address

Requesting any file reveals your IP address to whoever serves it. That is how a response gets back to you, not a decision anyone made about you. Four organisations are in that position on this site. None of them receives your image, because your image is never sent anywhere.

Google Fonts used to be a fourth. The typefaces are now served from this domain, which means Google is no longer handed your IP address on every page load simply because a page has words on it.

Cloudflare: Hosts the site and serves every page and file on this domain. Cloudflare privacy policy.
jsDelivr: Serves the face-detection runtime, the HEIC and TIFF decoders, and the pdf.js renderer used by the PDF tool, all from cdn.jsdelivr.net. Contacted only after you open a file. jsDelivr privacy policy.
Google advertising: Serves the AdSense loader from pagead2.googlesyndication.com, and the advertisements themselves from Google's ad servers. Contacted on every page load, whether or not you open a file. How Google uses information from sites that use its services.
Google model storage: Serves the face-detection model file from storage.googleapis.com. Contacted only after you open a file. Google privacy policy.

jsDelivr and Google model storage are never contacted at all if you read a page without opening a file. Cloudflare and Google advertising are contacted on every page load, because one serves the page and the other is loaded by it.

8. Analytics

One page-view counter, and it is the least invasive one we could find: Cloudflare Web Analytics. It records that a page was requested, which page, roughly how quickly it rendered, and the country the request came from. It does not set a cookie, does not write to localStorage, does not build a fingerprint, and has no identifier that could follow you to another site or back to this one tomorrow. There is nothing in it that could be tied to you, which is also why we cannot tie it to you.

No tag manager, no heatmap, no session recorder, no split-testing script, and no Google Analytics. Cloudflare already serves every file on this domain, so the beacon reveals nothing to a party that was not already handling the request.

We would rather have counted nothing. But a site funded by advertising has to know which of its pages people actually read, or it ends up guessing — and guessing tends to end in more advertising rather than less. Counting pages without identifying readers is the version of that we can defend.

9. Children's privacy

The site is not directed at children under 13. There are no accounts, no first-party tracking and no way to build a profile of anyone, so there is nothing here that could knowingly collect a child's data. If you believe a child has sent us an email and you would like it removed, write to hello@blurmyphotos.com and we will delete it.

10. Your rights under the GDPR and the UK GDPR

You have the right of access to your personal data, and the rights to rectification, erasure, restriction of processing, objection, and data portability, along with the right to complain to a supervisory authority.

The honest position is that those rights attach to personal data a controller holds, and we hold almost none. If you have never emailed us, there is nothing here to access, correct, erase or port. If you have, write to hello@blurmyphotos.com and we will act within one month; ask for the exchange to be deleted and it is deleted. The controller for that correspondence is the BlurMyPhotos team, at the same address.

Once advertising begins, the only meaningful processing on this site will be Google's, and requests about that data go to Google rather than to us. Google Ads Settings controls personalised advertising, and the Google privacy policy sets out how to reach Google about the rest.

To complain about us or about Google, you can go to a supervisory authority without asking us first. In the United Kingdom that is the Information Commissioner's Office. In the EEA it is your national authority; the European Data Protection Board publishes the list of national supervisory authorities.

11. Changes to this policy, and how to reach us

Changes are made to this page directly, and the date in section 1 changes on the same day. Sections 2, 3, 4, 6 and 7 were rewritten on 7 September 2026, when the contact form and the PDF tool were added and Google's advertising code went on to the site. Two changes remain scheduled: section 5 will name the consent platform once it is in place, and section 4 will say so on the day the first advertisement is actually served.

Questions, corrections and data requests all go to hello@blurmyphotos.com. If you would rather see what the tool does before deciding what you think of this policy, how it works covers the same ground from the technical side.