Privacy

The short version

A portrait you open is decoded by the browser into memory belonging to this tab. Every operation — the mask, the frequency split, the heal, the red-eye pass, the face finder, the export — reads and writes that memory and nothing else. Closing the tab ends it. There is no account, no upload, no history and no server-side component of this site whatsoever.

One file is fetched from a domain that is not this one, and only if you ask for it: the face finder’s weights, 229,738 bytes, from our model file server. That request carries nothing about you beyond what any request for a file carries, and it goes in one direction. The photograph is not part of it.

What happens to a file you open

The file is handed to the browser’s own decoder. Two reduced copies are made — one at 2560 pixels on the long edge for the screen, one at 820 for the frame budget during a slider drag — and both live in the worker that does the arithmetic. Your settings are kept as a short list of typed edits in fractions of the frame rather than pixel counts; the export re-runs that same list against the full-size pixels. By default none of it is written to disk, to local storage, to IndexedDB or to a cache, and none of it survives a reload. The one thing this site puts in a cache without being asked twice is the face finder’s model file, which came from the network and is not your picture.

What is kept only if you switch it on

The desk has a “Keep in this browser” section with two things in it, both off until you use them, both stored in this browser’s IndexedDB on this device, and neither ever a picture. Saved stacks are named sets of layer values — skin, light, eye detail and the whiten amounts — with no strokes and no file names; delete each from the same list. Session recovery, when switched on, keeps the list of edits for the portrait you are working on (numbers in fractions of the frame) together with that file’s name, size and dimensions, so that opening the same file again can offer to replay them. The photograph is not stored: restoring needs you to open it again. The on/off choice itself is one line in local storage. Switching it off, or pressing “Forget the kept session”, deletes the kept session.

Two export options are also off by default. Camera data: when you turn it on, a JPG export carries the camera, lens, exposure and date from your JPG original; a GPS location is never written, and serial numbers, the maker note and the thumbnail are left out. Share, offered on phones that support it, hands the finished file to the share sheet you choose; this site hosts nothing and makes no link.

The mask the layers run inside is geometry plus two colour statistics sampled from the region you placed. It is a single-channel array of bytes at working resolution, it is rebuilt whenever a control moves, and it is thrown away with everything else.

The face specifically

This is the part worth being exact about, because the concern a person actually has when a page offers to work on their face is not whether a JPEG travels somewhere. It is whether the face becomes a record.

Something here does now locate a face, and that is the change this page has to state plainly rather than bury. If you press Find the face, a detector runs on the picture in this tab and returns, for each face it sees, a rectangle and five coordinates: the two eyes, the nose tip and the two corners of the mouth. The working region is placed from the rectangle; the five points are used to keep the eyes and mouth out of the smoothing and to tell the red-eye scan where to look. Those numbers live in this tab’s memory for as long as the picture is open and go nowhere.

What is not computed is the part people actually worry about, and none of it has changed. No face embedding is computed, stored or compared against anything. No template, no descriptor vector, no hash of a face, no similarity search, no identity, no age or demographic estimate, no expression or attribute scoring. A box and five points cannot be used to recognise anybody — they are where a face is, not whose it is — and nothing is retained from which anything more could be derived later. The 468-point mesh that would trace each feature is not in this build at all.

The detector is a file, and it is the one thing this site fetches from another domain. It is 229,738 bytes, MIT-licensed, served from our model file server, and it is downloaded only after you press a control that states that size. It is then cached in this browser, so the second time you use it nothing is requested at all and the feature works with the network switched off. The rail carries a control that deletes it again. The runtime that executes it — 13.3 MB of WebAssembly — is served from this domain and cached the same way. Both of them travel to you. Your photograph does not travel anywhere: it is never uploaded, never posted, never sent to our model file server or to us, and there is nowhere here for it to be sent to.

Decline the download and none of that happens. No request is made, no model is stored, no face is located, and every layer on this site works exactly as it did before there was a detector — you place the working region yourself and the red-eye scan searches the whole frame. That path is not a degraded mode kept for appearances; it is what the tool was built as, and it is still the default until you ask for otherwise.

What is measured

This site uses Cloudflare Web Analytics, on its own property, to count how pages are used. The beacon is cookie-free and sets nothing in your browser. For each page view it reports the address requested, the referring page, a coarse country, the browser and device type, and how long the page took to load. Cloudflare reports those figures to us in aggregate; there is no account and no profile of you.

The beacon loads only on the live site, retouchpicture.com. A small check in the page looks at the address it is served from before the beacon script is ever requested, so a local copy, a preview build or any other host sends nothing at all. The beacon receives no file name, file size, setting, image, mask, face-finder result or indication that you opened a portrait, because none of that leaves this tab. There are no product events: no click, no tool choice and no export is reported.

Advertising

Advertising on this site is served by Google AdSense; the ad script loads on the page but never receives your images, file names or anything you do in the tool. Advertising on this site is served by Google AdSense; the ad script loads on the page but never receives your images, file names or anything you do in the tool.

Hosting, and what a host can see

The site is a set of static files on a content network. Serving them means the host observes the ordinary facts of an HTTP request: an IP address, a timestamp, a requested path. That is unavoidable for anything reachable over the internet, it applies to the HTML and the fonts rather than to your picture, and it is the full extent of what leaving this page in a browser tab involves.

Two things are fetched on demand rather than with the page. The HEIC decoder, the first time a file in that format appears. And the face finder with its runtime, the first time you press the control that offers it — the model from our model file server, a second host that therefore sees a request from you, and the runtime from this domain. What crosses the network in each case is the program itself, in one direction, to you.

Children, and why the caps are not conditional

This site cannot tell how old anyone in a photograph is and does not attempt to. That is the reason the ceilings on every control are fixed rather than adjustable per subject: a tool that cannot know who is in the frame has no business offering a setting that would be wrong for some of them.

Writing to us

The contact page is the one place this site asks you to type anything about yourself. When you press its send button, the name, email address and note you typed, together with this site’s name, are posted to a Google Form, and Google keeps the response under its own terms. Nothing goes while you type or when the page opens, no portrait or setting is ever part of it, and no other page here talks to Google.

Changes, and how to check

If this policy changes, the page changes; there is no mailing list to be told on. The claim that matters can be checked without trusting the prose — open your browser’s network panel, retouch a portrait and export it, and count the requests. Apart from this page, its stylesheet, its scripts and its two typefaces — every one of them served from this domain — the HEIC decoder if you opened a file in that format, and, if you pressed Find the face, one request to our model file server for 229,738 bytes plus one to this domain for the runtime — and, on the live site only, the cookie-free analytics beacon described above — there are none. Watch the direction as well as the count: none of them carries your photograph. Advertising on this site is served by Google AdSense; the ad script loads on the page but never receives your images, file names or anything you do in the tool.