HermitFile

Privacy

Effective 14 August 2026 · the plain-English version is the whole version

Your images are processed entirely on your own device. They are never uploaded to our servers, never transmitted to any third party, and never stored anywhere by us. We could not retrieve one if we wanted to, because we never receive it.

How that works, and how to check it yourself

When you choose a file, your browser reads it locally and draws it into a <canvas> element. The resizing and compression happen in your browser's own memory. The result is handed back to you as a download. At no point does the file travel over the network.

This is not only a promise — it is enforced by your browser. Every page here is served with a strict Content Security Policy whose connect-src directive is set to 'self'. That instructs your browser to block every outbound connection this page's code could attempt — fetch, XMLHttpRequest, sendBeacon, WebSockets — to anywhere other than this domain. There is no allowed destination to upload an image to. Even if our code were altered or compromised, your browser would refuse to send it. You can read the policy yourself in the response headers for any page on this site.

You do not have to take our word for it. Open your browser's developer tools, switch to the Network tab, and resize an image. You will see the page's own files load, and an anonymous page-view measurement request. You will not see your image, because it is never sent.

What we do collect

Two things, both handled by our hosting provider, Cloudflare. Nothing else, from anyone else.

• Standard server request data. Like every website, serving a page involves your IP address, browser user-agent, the page requested and a timestamp reaching our host. Cloudflare states that it discards the client IP address at the nearest data centre and does not store it in its core databases or logs. We never see IP addresses ourselves.
• Cloudflare Web Analytics. A cookieless measurement script that counts page views and page load performance. It records the page URL, the referring site, your approximate country, device type and browser, and page-speed timings. Cloudflare states that it does not use cookies, localStorage or any other client-side storage, and that it does not fingerprint individuals. It does not log query strings. We use it to see whether anyone is finding this site — nothing more.

What we do not collect

• No cookies. This site sets none, of any kind.
• No accounts, logins, passwords or email addresses.
• No payment information. The tools are free.
• No advertising, no advertising networks, no third-party trackers.
• No cross-site tracking, no profiles, no advertising identifiers.
• No image data, filenames, or anything derived from the files you process.

Who receives your data

Cloudflare, Inc. is our sole processor — it hosts the site and provides the analytics described above. No other company receives anything. Cloudflare's own privacy practices are described in its privacy policy, and its Data Processing Addendum, incorporating the EU Standard Contractual Clauses and the UK Addendum, applies to our account.

Do Not Track

Some browsers send a "Do Not Track" signal. This site does not track users across websites or over time under any circumstances, so there is no tracking for the signal to switch off. We treat all visitors the same way whether the signal is present or not.

Your rights

Data protection laws give people the right to access, correct or delete personal data held about them. We hold no identifiable personal data, so there is nothing for us to retrieve or erase. If you would like to ask about this anyway, write to [email protected] and you will get a straight answer.

Children

This site is not directed at children under 13 and we do not knowingly collect personal information from them. There is nothing here for a child to sign up for.

Changes

If this policy changes materially — in particular if advertising is ever introduced — the effective date at the top of this page will be updated and the change will be described here before it takes effect. The commitment that your images are processed on your device and never uploaded will not change; it is the point of the site.

Who runs this

HermitFile is operated by an individual in Pennsylvania, United States. For anything at all — a privacy question, a bug, a form specification we have wrong — email [email protected].