Security & privacy

ExactPic is built so that your photos never leave your device. This page explains exactly how that works and — more importantly — how you can verify it yourself instead of taking our word for it.

How local processing works

When you open a tool and select an image, the file is loaded into an in-memory canvaselement in your browser. All resizing, compression, and format conversion run on that canvas using your device's own CPU. The resulting file is created in memory and offered to you as a download. Your image is not sent to an ExactPicserver for processing. You can confirm this in your browser's Network tab — there is no outgoing request carrying your file after the page loads.

The site itself is a set of static files served from a CDN. Loading a page transfers only the HTML, CSS, and JavaScript needed to run the tool. After that, the tools work entirely offline. Our Content-Security-Policy header limits which third-party domains the page can connect to — Google Analytics for aggregate traffic measurement — which you can inspect in the response headers.

HEIC/HEIF photos (from iPhones) are decoded with the open-source heic2any library, which also runs entirely in your browser — the HEIC file is never uploaded to convert it. We test the offline workflow as part of our release checks: load a tool, disconnect from the network, and confirm compression, resizing, and HEIC conversion still complete locally.

How to verify it yourself

You do not have to trust this claim. Here are two independent ways to check:

1. Watch the Network panel.Open your browser's developer tools (F12 or right-click → Inspect), switch to the Network tab, then compress or convert an image. You will see the page assets load, but no request that uploads your image. There is no large outgoing request carrying the file.
2. Disconnect from the internet. Load any tool page, then turn off Wi-Fi or unplug the network. Select an image and run the tool — it still works, because everything happens locally. A tool that secretly uploaded your file could not function offline.

What we do and do not collect

• We do not receive, store, or transmit your images, filenames, or image metadata.

We use Google Analytics 4 (GA4) to measure aggregate traffic: pages visited, general device type, and tool usage events (tool_open, file_select, process_start, process_complete, process_fail, download, retry_tool, portal_view, task_view, check_result, heic_decoded, report_error_click).

GA4 does not receive your images, filenames, or the values you type into a tool.

GA4 may set first-party cookies (_ga, _ga_*) when enabled. IP anonymization is enabled in our GA4 configuration.

GA4 default event retention is 2 months unless changed in the GA4 property settings.

To opt out, use a browser extension that blocks Google Analytics, or enable “Do Not Track” and a GA opt-out add-on from Google.

• Our CDN may log standard request data such as IP address and browser type — the same as any website — but never the contents of your files.

Honest limitations

We want to be clear about what ExactPic is not:

• It is not an official government or passport service. Meeting a KB, pixel, or format requirement does not guarantee your photo will be accepted — many portals also check head position, background color, or expression, which are your responsibility to get right.
• It cannot repair a corrupted source file or add detail that was never captured. Compressing to a very small size will reduce visible quality.
• Requirements on third-party portals change without notice. Always confirm the current limits on the official form before you upload.

Who runs ExactPic

ExactPic is operated by MASTERPANEL LLC (Louisville, Kentucky, USA), a registered Kentucky Limited Liability Company. You can verify the company on the Kentucky Secretary of State record. If you have a security question, want to report a vulnerability, or need clarification about how the tools handle your data, email [email protected] and we will respond.