Your images are processed entirely on your own device. They are never uploaded to our servers, never transmitted to any third party, and never stored anywhere by us. We could not retrieve one if we wanted to, because we never receive it.
How that works, and how to check it yourself
When you choose a file, your browser reads it locally and draws it into a
<canvas> element. The resizing and compression happen in your browser's own memory.
The result is handed back to you as a download. At no point does the file travel over the network.
This is not only a promise — it is enforced by your browser. Every page here is served with a strict
Content Security Policy whose connect-src directive is set to 'self'.
That instructs your browser to block every outbound connection this page's code could attempt —
fetch, XMLHttpRequest, sendBeacon, WebSockets — to anywhere other
than this domain. There is no allowed destination to upload an image to. Even if our code were altered
or compromised, your browser would refuse to send it. You can read the policy yourself in the response
headers for any page on this site.
You do not have to take our word for it. Open your browser's developer tools, switch to the Network tab, and resize an image. You will see three files load from this domain and nothing else happen. No image upload, and no request to any other company — there is no analytics script on this site.
What we do collect
One thing, and it is the unavoidable one.
- Standard server request data. Like every website, serving you a page involves your IP address, browser user-agent, the page requested and a timestamp reaching our host, Cloudflare. Cloudflare states that it discards the client IP address at the nearest data centre and does not store it in its core databases or logs. We never see IP addresses ourselves.
We read aggregate counts from that — how many requests arrived, roughly which countries they came from, which pages were popular. That counting happens on the server, after the fact. There is no measurement script on this site. Nothing runs in your browser to observe you, which is why this page loads no third-party code at all.
What we do not collect
- No cookies. This site sets none, of any kind.
- No accounts, logins, passwords or email addresses.
- No payment information. The tools are free.
- No advertising, no advertising networks, no third-party trackers.
- No analytics script, no tag manager, no third-party JavaScript of any kind.
- No cross-site tracking, no profiles, no advertising identifiers.
- No image data, filenames, or anything derived from the files you process.
Who receives your data
Cloudflare, Inc. is our sole processor — it hosts the site, and the request data described above is a by-product of that hosting. No other company receives anything. Cloudflare's own privacy practices are described in its privacy policy, and its Data Processing Addendum, incorporating the EU Standard Contractual Clauses and the UK Addendum, applies to our account.
Do Not Track
Some browsers send a "Do Not Track" signal. This site does not track users across websites or over time under any circumstances, so there is no tracking for the signal to switch off. We treat all visitors the same way whether the signal is present or not.
Your rights
Data protection laws give people the right to access, correct or delete personal data held about them. We hold no identifiable personal data, so there is nothing for us to retrieve or erase. If you would like to ask about this anyway, write to [email protected] and you will get a straight answer.
Children
This site is not directed at children under 13 and we do not knowingly collect personal information from them. There is nothing here for a child to sign up for.
Changes
If this policy changes materially — in particular if advertising is ever introduced — the effective date at the top of this page will be updated and the change will be described here before it takes effect. The commitment that your images are processed on your device and never uploaded will not change; it is the point of the site.
Who runs this
HermitFile is operated by an individual in Pennsylvania, United States. For anything at all — a privacy question, a bug, a form specification we have wrong — email [email protected].