Privacy policy
Short, because there is not much to say.
In one paragraph
The text and images you check never leave your browser. This site has no account system, and no server that receives your files, because the tool does not have one. It does use Google Analytics to count page views. That is described in full below, and it never touches what you paste or drop into the checker.
What happens when you use the tool
Everything runs in your browser, using JavaScript already loaded from this site.
- Text you paste is analysed in memory on your device. It is not sent anywhere.
- Image files you drop or select are read with the browser’s own file API. They are not uploaded.
- When you close or reload the page, that data is gone. The tool itself writes nothing to your device — no local storage, no session storage, no cookie. The one cookie on this site comes from Google Analytics, and it is described next.
Analytics
This site loads Google Analytics 4, measurement ID G-8KCF4VD72K, to count page
views. It is the only third-party script on the site. It sets one first-party cookie on
watermarkdetector.app and sends the page address, a randomly generated client
identifier, your approximate location, and your browser and device type to Google. Google
processes that data for us; Google’s own privacy policy governs its handling.
What it never receives: anything you paste into the checker, anything you drop into it, and anything you type on any page. The analytics script cannot read the tool’s input, and the tool sends nothing anywhere. Block the script or turn JavaScript off, and the checker still works.
No advertising or remarketing feature is switched on. We do not sell data, and we do not build advertising profiles from it.
How to verify this
Three checks you can run yourself:
- Network tab. Open developer tools, go to Network, and run a check. You will see a page-view request to Google Analytics, and no request carrying your input. Paste something distinctive and search the request list for it.
- Response headers. This site sends
Content-Security-Policy: connect-src 'self' https://www.googletagmanager.com https://*.google-analytics.com. That list is the whole set of hosts the page may talk to. Anything else is refused by the browser, so the page cannot send your input anywhere else even if a future change tried to. - View source. The only script loaded from another host is
/analytics.js, short enough to read in full. It does one thing: start Google Analytics.
You do not have to believe a privacy policy. You can watch the network tab instead.
What the hosting provider sees
This site is served by Cloudflare Pages. Like any web host, Cloudflare processes the requests that reach it and may retain standard request metadata — IP address, user agent, timestamp, requested URL — for security and abuse prevention. That processing is described in Cloudflare’s own privacy policy.
Those logs are not received as a dataset, are not used to build profiles, and are not combined with anything you type or drop into the tool.
Links to other sites
Pages here link to outside sources, including unicode.org, c2pa.org, iptc.org, trojansource.codes, synthid.com and Google DeepMind. Once you follow one of those links you are on someone else’s site, under their privacy policy. That is worth knowing about synthid.com in particular: it is Google’s detector, and it works by having you upload the file to Google. This site never does that.
Children
This site is a technical utility. It is not directed at children, and it collects no personal information from anyone, including children.
Advertising
There is no advertising on this site today, and no advertising feature is enabled in the analytics described above. If advertising is added later, this policy will be updated before any ad script is loaded.
Changes
When this policy changes, the date at the top of this page changes with it.
Contact
Privacy questions go to the address on the contact page.