What reaches the network

Choosing a file, dropping one on the panel or pasting one from the clipboard hands the browser a reference to something already on your device. The page turns that into pixels in memory, draws on them, and writes the result to your downloads folder when you ask it to. At no point is there a copy of the picture anywhere except in the tab.

When the tab closes, that memory goes with it. No picture is written to local storage, nothing is kept in a database, and there is no cache of recent files to clear — because there is nothing to put in one.

One thing is written to this browser, and it is no part of a photograph. Saving a look keeps a frame specification — which frame, where the band sits, how wide it is, the colour values and the parameter numbers — in local storage on this device, so the shelf can offer it back on the next picture. A look holds no picture, no thumbnail and no file name. Clearing this site’s data removes saved looks, and losing them costs you nothing but the looks themselves; that is also why every look can be turned into a code you keep yourself.

One thing is fetched while you work, and it is a decoder rather than an upload. HEIC, the format an iPhone saves by default, is a format no browser will open on its own, so the first time you hand one over the page pulls down a WebAssembly decoder and runs it here. The request carries a filename for the decoder and nothing about your photograph, which stays in the tab and is read by the code once it lands.

This site is published as static files. It has no API endpoint, no upload handler and no server-side code of any kind, which means there is no address an image could be sent to even if a mistake were made. A build check fails the release if a network call appears in any module that can reach pixels, and a second check fails it if a server route is added to the project at all.

Visits to pictureborder.com are counted with Cloudflare Web Analytics, a cookieless measurement service. On the live domain, each page loads a small beacon script from Cloudflare that reports the page address, the referring site, page-load performance and a coarse country and device category. It sets no cookie, keeps no identifier from one visit to the next, and builds no profile across sites. The property belongs to this domain alone.

The beacon never sees a picture, a file name, a colour, a setting or a saved look, because none of those leave the tab. A copy of these pages served from anywhere other than the live domain — a preview, or a local copy — does not load the beacon at all.

This site carries no advertising. No advertising code is requested on any page.

The contact page holds the only form on the site. It sends the name, email address and message you type, plus this site’s domain, to Google Forms — and only at the moment you press its send button, never as you type and never on opening the page. Google keeps the response under its own terms. No picture, look or setting goes with it, and no other page on this site sends anything to Google.

If the way any of this works changes, this page changes with it in the same release. There is no mailing list to notify because there is no mailing list. Questions go through the contact page.