Privacy Policy

Last updated November 8, 2026. This policy describes how the Image Size Finder site handles data as it works today: measuring local files, the Image link and Web page tabs, making a copy that fits, feedback and analytics.

Short version

• The site sets no cookies of its own.
• Images you drop, choose or paste are read by JavaScript in your browser. The files are not uploaded, and their names, sizes and contents are not sent to my server or to analytics.
• The Image link and Web page tabs send the address you type to my server, because a browser can’t read files on other sites directly. The server fetches the start of each image, reads its size, returns the numbers and keeps nothing. Only when you make a copy or a smaller version of an image whose site won’t let your browser read it does the server download that whole image (up to 4 MB) and pass it straight to you.
• I count page views and feature use with my own analytics under a random ID. It never includes your images, file names or the addresses you type. You can turn it off on this page, and browsers that send Global Privacy Control are never counted.
• “Make a copy that fits” draws and saves the new file in your browser. Copies of local files never leave your device; for an image from a link or a scanned page, your browser downloads it from the site that hosts it, or through my server when that site doesn’t allow it.
• A feedback message is stored only if you write one and press send.
• I don’t sell or share personal information, and I don’t use it for advertising. The site shows no ads.

Who runs the site

Image Size Finder is run by an independent developer, not a company (“I”, “me” in this policy; see About). I decide what the site collects and why, so I am the controller responsible for that data. To contact me about privacy, including any of the requests under “Your rights”, use the Send feedback button on the contact page. There is no public email address.

What is collected at a glance

Images you drop, choose or paste

When you choose images, drop them on the page or paste them, your browser gives the page access to those files only. The image size finder reads the first 256 KB of each file (more only when a format keeps its header further in; the whole file, up to 64 MB, for GIF, animated WebP or PNG and TIFF, to count frames and pages, and for a JPEG that seems cut off, to check for a motion photo’s video), plus the last 2 KB to check that the file isn’t cut off, and works out the size with code that runs on your device. The files are not uploaded anywhere, and the page makes no network request containing them, their names or their contents.

For formats your browser can display, the preview is made with a temporary blob: address that exists only inside the open tab. Press Clear all, remove the image, reload or close the tab and it is released. Nothing about local files is written to local storage, session storage or cookies. Copy puts text on your clipboard, and CSV saves a file to your device; neither sends anything.

The page reads only what affects size: dimensions, rotation, stored DPI, color format, bit depth and frame count. It does not read or display camera settings or GPS location, though those may still be inside your file.

The Image link tab

Browsers don’t let one website read another website’s files, so the Image link tab goes through my server. When you press Measure, the address you typed is sent to my server as part of the request (/api/probe?url=…). The server then:

• refuses addresses that point to private or local networks, such as localhost or a home router, including after redirects, and anything on a port other than the standard web ports 80 and 443;
• requests the image, identifying itself as Mozilla/5.0 (compatible; ImageSizeFinder/1.0; +https://imagesizefinder.net/about), asking only for the first 64 KB and more only if the header continues, following up to 5 redirects;
• gives up after 15 seconds;
• reads the size and the total file size the other server reports (when a server doesn’t report it, the file size is shown as unknown), returns those numbers to your browser, and stores neither the image nor the address.

The site you asked for sees a request from my server, not from your device. My hosting provider’s request logs may record the address you typed along with the request, as they record every request. Don’t use these tabs for addresses that contain private tokens or one-time links.

To stop the server being used as a free fetcher, each connection’s IP address may make a limited number of these requests per minute (120 image measurements, 20 page scans and 60 whole-image fetches). The count is kept only in the server’s memory for that minute and is never written down.

The Web page tab

Scan works the same way: the page address goes to my server (/api/scan?url=…), which fetches the page’s HTML once (up to 8 MB, within 12 seconds; for a longer page the result says that only the first 8 MB was read), finds the images it references and requests the start of up to 60 of them as described above, allowing each image 9 seconds, plus the start of up to 8 smaller srcset sizes of a picture to check that they are as wide as the page claims. “Measure the next” repeats this for the following 60. The whole scan stops after about 28 seconds. The server returns the list to your browser and keeps neither the HTML nor the results.

Making a copy that fits

When an image misses an upload limit, Make the copy crops, resizes and compresses a new file to meet it; under the print table, the same button makes a print copy cropped to a paper’s shape. All of that is done by JavaScript in your browser with a canvas; the copy is offered as a temporary blob: address that you save with the download button (with several images, the ZIP is packed in your browser the same way), and it is released when you change the plan, remove the image, reload or close the tab. Your original file is not changed.

• Local files are read again from the browser’s memory. Nothing is uploaded and no network request contains the picture. If the file is HEIC and your browser can’t open HEIC itself (every browser except Safari), the page first downloads a decoder, about 3 MB, from my own domain: the open-source heic-to library built on libheif, both under the LGPL-3.0 licence. The decoder runs on your device; your photo is not sent with that request.
• Images from a link or a web page have to be downloaded in full to draw them. Your browser first requests the whole image directly from the site that hosts it, without cookies and with the referrer turned off, so that site receives your IP address and browser details, as it does for the thumbnails described below. Because the page needs to read the image, the browser also sends an Origin header naming this site; browsers always add it to such requests. Many sites don’t allow other pages to read their images. Then the page asks my server for it instead (/api/image?url=…): the server applies the same private-network checks as the Image link tab, downloads the whole image (up to 4 MB, within 20 seconds), passes the bytes straight back to your browser and keeps nothing; your browser then reuses it for further tries in the same tab rather than fetching it again. The image’s site then sees my server’s request instead of yours. SVG files and images over 4 MB are refused, and the server only answers such requests when they come from this site’s own pages.
• The copy holds the pixels; when the browser re-saves them as JPG it adds the standard sRGB color profile, while a copy that only changes the DPI keeps the original’s own profile. It carries a DPI value when there is one to carry: the original’s, the one you typed under My own limits, or for a print copy the one that matches the paper (WebP smaller versions carry none). Location, camera details and other photo metadata are not copied into it.

Thumbnails from other sites

After a link or page result arrives, the small previews in the results are loaded by your own browser straight from the site that hosts each image, with the referrer turned off. That site then receives your IP address and browser details, as it would if you visited it, and may log the request or set its own cookies. I have no control over that. Local files never cause such requests.

The site’s own fonts are bundled into the site and served from my domain, so your browser doesn’t contact Google Fonts or any other font service.

Feedback you send

The Send feedback button opens a short form. Nothing is sent while you type. Only if you press send, these details go to my feedback service, which runs on Supabase, and are stored so I can read and handle the message:

• the message you wrote, exactly as you wrote it;
• this website’s domain and the path of the page you were on, without any query string or # part.

The form doesn’t ask for your name or email. If you want a reply, include a way to reach you in the message; I will use it only to answer you. To limit spam, the feedback service caps how many messages one network can send per hour, so it processes your IP address to apply that limit. Please don’t include passwords, keys, payment details or other sensitive information in a message, and don’t attach or describe private images.

Analytics

I run my own analytics service, hosted on Supabase, to learn which features people use and where the site fails. It is not Google Analytics and it is not shared with any advertising network. It records:

• page views, with the page path only (nothing after ? or #);
• time on the page and how far you scrolled;
• clicks on labelled buttons and controls;
• the outcome of the main actions, with a short code and a count: measuring files (how they arrived, such as picker, drop, paste or example; how many were read; the first file’s format, such as jpeg or heic; whether it worked), measuring a link and scanning a page (whether it worked, the number of images, the image format, or the HTTP status of a failure), copying a result and exporting a CSV (with the row count), and making a copy that fits (which requirement was picked, such as youtube-thumb or custom, whether it worked and how long it took), downloading it, batches of copies and their ZIP (with the number of copies), and smaller versions of a scanned page’s images (whether WebP was chosen, how many were made, whether all of them worked, and the ZIP);
• a random visitor ID, a random session ID and the time.

It does not record your images, file names, pixel sizes, the addresses you type, the text of feedback, your name, your email or anything else that identifies you, and it doesn’t store your IP address as a way to identify you. The visitor ID is kept in your browser’s local storage and the session ID in session storage, both under keys starting with wa_. They are random, are not linked to any account and are not used on other websites.

The analytics script is loaded from my Supabase project on every page, so Supabase receives your IP address and browser details when your browser fetches the script, as any web server does, even if you have turned analytics off. There is no consent banner: analytics is limited to the items above, is used only to improve this site, and can be switched off here at any time.

Turning analytics off stops all events and deletes the wa_ IDs from this browser. Your choice is saved in local storage under image-size-finder:analytics-off, so it applies only to this browser on this device. If you clear this site’s data, the choice is cleared too.

Cookies and browser storage

The site sets no cookies of its own. It uses your browser’s storage as listed below, and you can clear all of it at any time in your browser’s settings.

Hosting and server logs

The site is hosted on Vercel. Like any web host, Vercel processes your IP address, browser details, the time and the address requested in order to deliver pages, keep the service secure and diagnose faults, and keeps request logs for its own retention period. Requests from the Image link and Web page tabs, including the address you typed, and image fetches for copies (/api/image) are part of those logs.

Service providers and transfers

• Vercel: hosting and the server functions behind the Image link and Web page tabs.
• Supabase: the analytics service and the feedback service, as my processor.

These providers may process data in the United States and other countries outside your country. Where data protection law requires it, transfers rely on the providers’ standard contractual clauses or similar safeguards.

Why the data may be used

Where the GDPR or a similar law applies, the legal basis is legitimate interest: running the site, keeping it secure, understanding which features are used and what fails so it can be fixed, and answering feedback. Fetching an image or page you ask for is done to provide the feature you requested. Feedback is sent only when you choose to send it. I balance these interests against yours by collecting the minimum listed here and by letting you turn analytics off.

Sharing and selling

I don’t sell personal information, rent it or share it for targeted advertising, and I don’t combine it with data from other sources. Apart from the service providers above, I would disclose information only if the law required it, to protect the site or its users from fraud or abuse, or as part of a transfer of the site to a new owner, who would stay bound by this policy for data collected under it.

How long data is kept

• Local images and their previews: only while the tab is open, never stored.
• Copies and smaller versions: only in the open tab until you download them; a downloaded copy is a file on your device that I can’t see.
• Image and page addresses you type: not stored by me; hosting logs follow Vercel’s retention.
• The analytics visitor ID and your opt-out choice: in your browser until you clear this site’s data. The session ID: until you close the tab.
• Analytics events: only as long as they help me improve the site, reviewed for deletion at least once a year. There is no automatic deletion schedule. I may keep totals with no IDs in them, such as page views per day, for longer.
• Feedback messages: until they have been dealt with, and reviewed for deletion at least once a year.

Security

The site is served only over HTTPS. Local files are never transmitted. The link and page features refuse private and local network addresses, including after redirects, and limit how much they download. Analytics events and feedback are written through narrow interfaces that accept new records but don’t let a visitor read anyone else’s data, and access to the stored data is limited to the person who runs the site. No system is perfectly secure.

Your rights

Depending on where you live, for example under the GDPR, the UK GDPR or US state privacy laws, you may have the right to ask whether I hold information about you, to get a copy of it, to have it corrected or deleted, to restrict or object to how I use it, and to withdraw a choice you made. You won’t be treated differently for using these rights.

To make a request, use the feedback form and say what you want. Because I don’t collect names or accounts, I can usually only find a feedback message if you tell me roughly what it said and when you sent it, and I can only find analytics events if you give me the visitor ID from your browser’s storage (the wa_ key). Turning analytics off is the quickest way to stop further collection. I act on requests within one month; include a way to reach you if you want a written answer. If you are in the EEA or the UK, you can also complain to your local data protection authority.

US state privacy laws

In the past 12 months I have collected, as described above, internet activity on this site (analytics events and server logs) and the content of feedback messages people chose to send. I have not sold personal information or shared it for cross-context behavioral advertising, and I don’t use or disclose sensitive personal information. Residents of California and other states with similar laws can make the requests described under “Your rights”.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, the analytics script doesn’t record anything and there is no setting to change. There is no common standard for responding to the older Do Not Track signal. I don’t track you across other sites, so there is nothing for it to switch off, and you can still turn analytics off above.

Children

The site is a general-audience tool for measuring images. It is not aimed at children, and I don’t knowingly collect personal information from children under 13 (or under 16 in the EEA and the UK). If you believe a child has sent me personal information in a feedback message, tell me and I will delete it.

Links to other sites

Result tables link to the images and pages you measured, and the upload checks link to each platform’s help page. Those sites have their own privacy policies, which apply once you follow a link.

Changes to this policy

I will update this page, and the date at the top, whenever the way the site handles data changes. If a change means collecting something new, it will be described here before it starts. Questions about this policy can go through the contact page.