Your image is processed on your device.

Image and text processing

Supported JPEG, PNG and WebP inspection and cleaning runs locally in browser memory. DNG and Apple ProRAW inspection also runs locally and is read-only. Rights writing, SHA-256 payload comparison and Privacy Receipt generation also run locally. Except for the separately disclosed, optional AI photo analysis below, we do not intentionally upload or store original selected images, image contents, entered draft text, rights-field values, file names or extracted metadata on metadata.click servers.

Optional AI photo analysis

No AI request starts merely because you choose a file. When you press the clearly labelled AI optimization button, the browser decodes and re-encodes the selected image as a temporary, metadata-free JPEG no larger than 1024 pixels or 750 KiB. Only that reduced preview, the selected goal and any optional context you enter are sent through the metadata.click server to a third-party AI processor; the original file is never sent by this flow. Do not analyze confidential material or another person's image unless you are authorized to do so.

metadata.click uses the submitted material transiently to request and return the draft and does not intentionally save the prompt or image in an application database or analytics event. The generated draft returns to the browser for review. The processor may handle necessary network and security logs under its own current privacy practices. AI analysis is subject to strict request limits and may be paused without affecting the local metadata cleaner.

Temporary browser data

The tool creates temporary in-memory object URLs so your browser can preview and download a cleaned file. These are revoked when results are replaced, reset or the page closes. The installable web app may cache public application code and artwork for offline use; it does not place your selected images into the offline cache.

Local delivery profiles

If you save an Image Delivery Passport rights profile, its profile name and chosen rights values are stored in this browser's localStorage under one versioned metadata.click key. The profile is not encrypted secret storage and is not sent to metadata.click. You can delete it in the delivery builder or explicitly export/import its validated JSON file.

Delivery manifests generated on-device include output filenames. They are not uploaded to metadata.click, but you should rename sensitive files before sharing a manifest.

Privacy-safe analytics

Production deployments may use Vercel Web Analytics and Speed Insights to understand page traffic, performance and coarse product events. Events can record facts such as the file-format category, a broad size bucket, whether cleaning completed, or which Creator Kit output was copied. They do not include file names, image contents, prompts, draft text, metadata values, GPS coordinates or creator names. Vercel also processes standard network data needed to serve and secure the site. See Vercel's analytics privacy information.

Cookies and accounts

The current public tool requires no account. Vercel Web Analytics is designed to operate without cookies. AI analysis uses a signed, HttpOnly, Secure, SameSite=Strict session cookie for up to 24 hours so the API can authorize and rate-limit requests. It does not contain a provider key, prompt, image or public account profile. If you open a paid checkout, payment and tax details are processed by the linked merchant-of-record checkout; metadata.click does not receive your full card number.

Security and limits

Local processing reduces exposure but cannot make a device, browser or internet connection risk-free. Keep original files, use an up-to-date browser and do not process a file you do not own or have permission to handle.

Contact

Support and privacy requests can be sent to hello@metadata.click. The service is currently operated as an independent public-beta project.