How to check that your photos are never uploaded

What to expect

Test 1: watch the network

1. 1

   Step 1: Open the converter and your browser's developer tools

   Open the JPG to PNG converter. Then press F12, or Ctrl + Shift + I on Windows, Cmd + Option + I on a Mac.

   In Safari, first turn on Settings, Advanced, Show features for web developers, then use the same Mac shortcut.

2. 2

   Step 2: Open the Network tab and clear it

   Click Network in the developer tools. Click the clear button (a circle with a line through it) so the list starts empty.

3. 3

   Step 3: Convert a photo

   Drop a photo or two onto the converter. They convert at once and you can save them.

4. 4

   Step 4: Look at the list

   You will see no request that carries your photo. Click each entry, then Payload (or Request in Firefox), and check that none contains your image. You may see one small hit request to /api/hit. That is our own page-view counter. Open it and you will find two short text values: the page path and the page you came from.

   To make it easy to read, filter the list by Fetch/XHR or sort it by the Size column: a photo would be the largest upload by far.

Test 2: turn the internet off

1. 1

   Step 1: Load the converter page, then go offline

   With the page open and loaded, switch your Wi-Fi off. Or, in Chrome or Edge, open the Network tab, find the drop-down that says No throttling and choose Offline (Firefox has the same drop-down).

2. 2

   Step 2: Convert a photo anyway

   Drop a photo. It still converts and you can still save it. If the file had to be uploaded to be converted, this could not work. This is the clearest proof, and it needs no technical knowledge.

   This test is for the converters. The marketplace studio needs a connection, because it counts your pack, but that request holds only numbers (see Test 1).

Test 3: read the browser's own rulebook

1. 1

   Step 1: Find the page's security header

   In the Network tab, reload the page and click the first entry in the list (the page itself). Open Headers, scroll to Response Headers and find content-security-policy.

2. 2

   Step 2: Read what it allows

   It contains connect-src 'self'. That tells your browser to refuse any attempt by this page to send data to another website, with one exception: the Google Analytics addresses (google-analytics.com and googletagmanager.com) are listed too, because they are needed if you accept analytics in the cookie notice. Nothing is sent to them unless you do. It also limits images, fonts and frames to our own site, and forms may only lead to our own pages or to the sign-in and payment pages of Google and Stripe.

   So even a mistake in our code could not quietly send your photos to a third party: your browser would block it. (The one allowed exception, Google Analytics, is for page statistics only and is off until you accept it.)

What this does and does not prove

These checks show what the page does on your visit, today. A website can change its code later, and you trust the version you are served each time. That is why you can repeat the test whenever you like. Developers can also read the page's JavaScript in the browser's Sources tab.

Other things do reach us when you use an account: your email address to sign in, and your payment through Stripe if you buy Premium. The Privacy Policy and the Cookies and storage page list everything.

Questions