Privacy

Pictures you open here are read by your own browser and are never transmitted. Text you type into the studio, the checker and the text reader stays in those fields; the contact page, described below, is the one place where typed words are sent. There is no account, no login, and nothing that stores a description between visits. The site is a set of static files; there is no endpoint here that could receive a file even if something tried to send one.

Choosing, dragging or pasting a file hands it to the browser’s image decoder. The decoded pixels live in the tab’s memory while you are working. Small copies — 192 and 256 pixels for colour and light, 900 for finding rows of text, up to 4,000 for the text reader, and whatever size a detector you pressed needs — are drawn onto canvases so the work can be done, and the whole lot is released when you open another picture or close the tab.

Nothing about your picture or your words is written to storage. The site keeps no local storage, session storage or browser database entries of its own, and a build check fails if one appears in the image code or in any component. Opening the same picture tomorrow is exactly as new to this page as it was today.

The text reader. Pressing Read on the image to text page (or on the Visible text tab of the studio) downloads Tesseract, an open-source text recogniser compiled to WebAssembly, and its English data — about 7 MB in all — plus about 1.4 MB more for Hindi if you choose it or agree when asked. All of those files come from this site, describephoto.com, and run in a background worker in your tab.

The detectors. Three small detectors can be run on an opened picture: a face finder (YuNet, 224 KB), a person finder (PP-HumanSeg, 5.9 MB) and a depth finder (MiDaS small, 63.7 MB). None loads until you press its button, and each button states its size first. Their model files come from our model file server; the runtime that executes them (ONNX Runtime Web, 13.3 MB, once) comes from this site. Every model file is checked against a fingerprint before it runs.

Those requests go one way. They fetch a file and carry nothing else — no picture, no text, no identifier. There is no captioning model among them and no server fallback behind them: if a download fails, that feature simply does not run.

Downloaded detector models are kept in the browser’s Cache Storage, under keys that start with the model’s name, so they do not download twice; the studio’s detector panel has a control that deletes them. The text reader’s files and the rest of the site sit in the browser’s ordinary HTTP cache, like any web page.

The site also installs a small service worker (/sw.js) so pages you have opened keep working without a connection. It keeps copies of this site’s own pages and files — never a picture, never your text, never anything from another address — in two Cache Storage entries named dp-sw-pages-v1 and dp-sw-files-v1. Clearing this site’s data in your browser removes them.

If you install the site as an app and share a photo to it from another app, your phone hands the photo to that service worker, which answers on the device — nothing goes to a server — by holding the photo for a moment in a Cache Storage entry named dp-sw-share. The page takes it out and deletes the entry as soon as it opens.

The folder pages (bulk and product alt text) have a box marked “Keep my work on this device”. It is off unless you tick it. Ticked, the words, decisions, approvals and read text for each row — keyed by file name and size — and the panel’s settings are kept in an IndexedDB database in this browser named describephoto-work, so the work survives a closed tab. The pictures themselves are kept only if you also tick “Keep the original pictures too”. Unticking the box, or pressing “Clear saved work”, deletes the saved record (the empty database stays until you clear this site’s data). Nothing in it is ever sent anywhere.

That is the complete list: no cookie and no local storage key is created by this site, and no IndexedDB database unless you turn on “Keep my work on this device”.

The footer of every page has a “Nothing sent” button. It lists every request the tab has made, grouped by where it went — this site, our model file server, the page-view counter, the contact form — with each request’s method and how many bytes it carried up and down. To do that, a few lines at the top of each page note the method and body size of requests the page starts; they never read what is inside and never send anything themselves.

The contact page is a short form, and it is the only part of this site that sends anything you type. Pressing its Send button posts your name, your email address and your message to Google Forms, together with the words describephoto.com so the note can be told apart. Until that press nothing is sent, the page loads nothing from Google while you write, and no picture, draft or measurement from the studio goes with it.

On describephoto.com itself, pages load Cloudflare Web Analytics, a cookie-free beacon. It records aggregate page views, the referring page, coarse country, browser and device category, and page-load performance. It sets no cookie, stores no identifier and builds no profile across sites. The property belongs to this domain only.

The beacon is added by a check in the page that runs before any request: it loads only when the address is describephoto.com. A copy of the site on any other address — a preview, a local test — makes no analytics request at all. The beacon learns nothing about your picture or the text you enter: none of it is in what the beacon reads.

No advertising is served on this site. No advertising script loads on any page and no ad is requested. If that ever changes, this page changes first, in the same release.

If any of this ever changes — the measurement setup altered, a new model or a captioning model added, anything at all that alters what leaves your machine — it changes here first and it changes in plain language. There is no version of this site where a picture is sent somewhere and the policy is quietly updated afterwards to match.