All the tools
The whole toolbox in three families, with what each one needs before it can run.
Read itOn-device privacy
There is no upload step to be nervous about.
Every tool here runs the model on your own hardware. Your photo goes from your disk to your screen and back, and never anywhere else.
No transferWorks offlineVerifiable in devtools
The short answer
Photomop downloads a small AI model to your browser once, caches it, and then runs it on your device through WebGPU or WebAssembly. Your photo is read from disk into the tab’s memory, processed there, and saved back out as a download. It is never transmitted to us, so there is no image store to breach and no retention policy to take on trust.
The whole pipeline
Three boxes, and one that is missing
Most diagrams of a photo tool have a server in the middle. This one is interesting mostly for what is not in it.
Step one
Your file, on your disk
You drop it in, paste it, or pick it from the file dialog. The browser hands the page the bytes directly.
Step two
The tab does the work
A cached model runs in a worker, on your GPU through WebGPU or your CPU through WebAssembly.
Step three
Straight back to you
The full resolution result is written to a blob and downloaded. Nothing crossed the network.
Not in the path
Our serversNever in the path. They serve the HTML and the model file, then they are done.
Technical detail
What actually happens, in order
No hand waving. This is the sequence, from the first click to the file in your downloads folder.
- 01
The model comes to you
The first time you open a tool that needs one, the browser downloads a model file, typically 13 MB to 115 MB depending on the tool and the device. It goes into Cache Storage, the same place a progressive web app keeps its assets, and it stays there. That download is the only large transfer in the whole process, and it goes in the direction you would want: towards you.
- 02
Your photo is read, not sent
When you drop a file in, the page reads it through the browser's own file APIs. The bytes go from your disk into the tab's memory. There is no fetch, no form post, no multipart upload, because there is no endpoint on our side expecting one.
- 03
Inference runs in a worker
The model executes in a Web Worker off the main thread. On Chrome and Edge that means WebGPU, which hands the work to the graphics card already in your machine. Everywhere else it falls back to WebAssembly on the CPU, slower but producing the same result. Roughly 82 percent of browsers can take the fast path today.
- 04
The result is composited locally
The mask the model produces is applied to your original at full resolution. On a phone with less memory we run inference at a reduced size and then composite the alpha back onto the untouched full-size original, so the file you get is still the size you started with.
- 05
You download from yourself
The finished image is written to a blob in the tab and handed to your browser's download machinery. It has never crossed the network. Close the tab and every trace of it is gone from memory, because memory is the only place it ever was.
What our servers are actually for
They send you this page, the JavaScript that runs the toolbox, and the model file the first time you need it. That is the complete list. There is no inference endpoint, no image bucket and no processing queue, which is also why there is nothing for us to charge you per image for.
Side by side
On-device against a cloud pipeline
Both approaches run comparable models. Everything that differs comes from where the model sits.
| Question | Cloud pipeline | Photomop, on device |
|---|---|---|
| Where your image goes | Uploaded to a server you cannot inspect | Stays in the tab, on your machine |
| What a breach exposes | Whatever is in their image store | Nothing, because there is no store |
| Time before you see a result | Upload, queue, inference, download | Inference only |
| Works with no connection | No | Yes, once the model is cached |
| Marginal cost per image | Real GPU seconds, billed to them | Zero, so the free plan exports full size |
| Free plan export | Usually a small preview or a credit count | Full resolution, not metered |
| Account | Almost always, to meter you | Not needed today |
| Retention policy | A promise to delete, eventually | Not applicable, nothing was received |
Slide the table sideways to see every column.
The traffic ledger
What leaves your device, and what never does
“Nothing is uploaded” is the headline, and the honest version is a two-column list. Two things travel from us to you and back again in the ordinary way any website works. Everything to do with your actual photo sits on the other side of the line and stays there.
| What | Leaves your device | Why |
|---|---|---|
| The page you are reading | Yes | A request to our host for HTML, CSS and JavaScript. It carries your IP address and user agent, the way a request to any website does. |
| The AI model file | Yes | Once per tool family, and in the direction you would want: our file arriving on your device, not your file leaving it. |
| The photo you drop in | Never | Read from your disk into the tab's memory through the browser's own file APIs. There is no endpoint on our side expecting it. |
| The mask and the alpha channel | Never | Produced by a worker on your machine, held in memory, and gone when the tab closes. |
| The file you export | Never | Written to a blob in the tab and handed to your browser's own download machinery. It never touches the network. |
| EXIF metadata: camera, lens, timestamp, GPS | Never | It travels attached to the image, and the image does not travel. Nothing reads it out and sends it separately. |
| The filename | Never | Same reason. It is a property of a file we never receive. |
| Which tools you used, and how often | Never | We run no analytics, no session recording and no advertising pixels at the time of writing. |
Slide the table sideways to see every column.
The two rows in the first group are the same two requests every website on the internet makes. Our host keeps standard web server logs of them, which is written up in the privacy policy, and the browser storage the tools use is listed in the cookie notice.
Threat model
What this protects you from, and what it does not
A privacy claim that only lists its wins is marketing. Here is the whole board, because knowing where the protection stops is what lets you decide whether it is enough for the work in front of you.
Ruled out entirely
ArchitectureNot policy, not a promise. These are impossible rather than forbidden, which is a different and much stronger kind of guarantee.
- A breach of our image store, because there is no image store
- A subpoena or a legal order asking us to hand over your photos
- A future change of ownership, policy or business model applied to images we already hold
- An employee with production access looking at a customer's file
- A third-party subprocessor receiving your images on our behalf
- Your photos being used to train a model, ours or anybody else's
- A retention window you have to take on trust
Still on you
Out of scopeMoving the model to your device removes the remote parties. It does not change anything that was already true of the machine in front of you.
- A device that is already compromised. If something is reading your disk, it reads the original too
- A malicious browser extension, which can read any page you have open, including this one
- Anyone with access to your downloads folder after you save the result
- The plain fact that your browser and your operating system handle the file, as they do with every file
- What happens to the image after you send it somewhere else
- Your network operator seeing that you visited this site at all, which is true of visiting any site
The comparison that matters
A cloud pipeline has every item in the second list too, and then adds the whole first list on top: their storage, their staff, their subprocessors, their retention policy, their next owner and their next breach. On-device processing does not make a photo invulnerable. It removes one entire category of risk, and it happens to be the category you have no way of auditing. That, and not the speed, is the reason the whole product is built this way.
Do not take our word
Check it in sixty seconds
Privacy claims are cheap. This one is unusual in that you can falsify it yourself, without any special tooling, in about a minute.
- Airplane mode. Load a tool, wait for the model, then disconnect. Keep editing. It works.
- Network tab. Open devtools, filter by Fetch or XHR, edit a photo. Your image appears in no request.
- Task manager. Watch the GPU spike on your own machine while the cut-out runs. That is your hardware doing it.
- The one caveat. Your browser and your operating system still see the file, because they always do. What changes is that no third party does.
FAQ
Privacy questions
The ones worth asking of anything that claims your photo never leaves the device.
How can I check for myself that nothing is uploaded?
Two ways, both take a minute. Open your browser's developer tools, switch to the Network tab, and edit a photo: you will see the model file download once and no request carrying your image at any point. Or simpler, let a tool finish loading, turn off your wifi, and keep editing. It still works, which it could not do if the photo were going anywhere.
What is WebGPU, and what happens if my browser does not have it?
WebGPU is the browser API that lets a page use your graphics card for general computation. Chrome and Edge support it broadly, which covers roughly 82 percent of browsers today. If yours does not, the same model runs through WebAssembly on the CPU instead. It takes longer, sometimes several seconds longer on a big image, and the output is the same.
Does the model download count as sending you my data?
No, and the direction matters. The transfer is our file arriving on your device, not your file leaving it. Once it is cached the tool works with the network off entirely, which is the clearest possible evidence that your image is not part of any request.
Do you collect anything at all?
Our host records standard web server logs, which include IP addresses and requested URLs, the way every website on the internet does. We run no analytics, no session recording, no advertising pixels and no third party trackers at the time of writing. If that ever changes, the privacy policy and the changelog will both say so before it does.
Is on-device processing enough for client work under GDPR or HIPAA?
We are not your lawyers, so treat this as a description rather than advice. What we can state plainly is the fact that matters to most assessments: your images are never transmitted to us, never stored by us and never processed by any third party on our behalf, because the processing happens on the device in front of you. For many teams that removes the transfer question entirely.
Does this work on a phone, or only on a laptop?
Both. The same tools run on Android and on iPhone, on the device itself rather than on a server the phone talks to. A phone has less memory to spend, so on the tighter devices we run inference at a reduced size and composite the result back onto your untouched full-resolution original. The file you download is the size you started with; very fine detail can be a little softer than the same photo cut on a laptop.
What happens to my photo if the tab crashes or I close it?
It is gone, and there is no copy anywhere for us to restore. Everything lives in the tab's memory for exactly as long as the tab does. That is the same property that makes the privacy claim true, seen from the other side: we cannot lose your photo, and we cannot get it back for you either. Export before you close, and keep your original.
Who else can see my photo while I am editing it?
Your operating system and your browser, because they handle every file you open. Any browser extension you have installed, because extensions can read the pages you have open. Anyone with access to the machine itself. What on-device processing removes is the whole category of remote parties: us, our host, a subprocessor, whoever buys us later, and anyone who breaches any of them.
If your assessment needs something this page does not cover, write to us and we will answer in writing rather than in a sales call. Anything that changes about what we collect gets recorded in the changelog on the day it changes.
Keep reading
Where to go next
Photomop vs the rest
Eighteen head-to-heads, each built from the other vendor's own published facts.
Read itPrivacy policy
What we hold, which is very little, written in the plainest language we could manage.
Read itPricing
What the free plan covers today, what Pro adds, and why the split falls where it does.
Read it