pixelrinsepixelrinse

Privacy, Limits & Methodology

PixelRinse application code sends no product-usage events. A hosted first visit requires a network connection. The website host may retain access and infrastructure logs under its own policies.

Privacy Model

File inspection, cleaning, verification, comparison, receipt generation, and downloads are local browser operations. The application does not send product events, page views, file counts, types, sizes, names, metadata, contents, hashes, results, or diagnostics to an analytics or crash-reporting service.

  • Local File ProcessingFile bytes, names, metadata, previews, reports, masks, cutouts and watermark text stay on this device. After the required code has loaded, supported cleaning can continue offline. Neural editors download only the explicitly selected, pinned model weights from Hugging Face and the local runtime from this app. Those hosts can see resource requests and normal connection information, never your selected file, mask, text or inference. Model and application resources may be cached; user content is not cached or uploaded. Preparing a model does not by itself prepare the whole app for offline reload.
  • No application usage telemetryThe PixelRinse client contains no usage analytics integration or collection endpoint. This does not disable or inspect access, security, operational, or account-level logging handled by the website host.
  • Memory OnlyFiles are held in temporary memory (RAM). When you close the tab or click "Clear", object URLs are revoked. We do not claim cryptographic secure erasure of RAM.
  • Browser Download CaveatWhen you download processed files, they interact with your OS filesystem. Your OS may index them, create thumbnails, or sync them to cloud services (like iCloud or OneDrive).

Earlier builds could send coarse action events through a tracker supplied by the hosting environment when the local analytics opt-in was enabled. We have not queried, migrated, or deleted any historical host-side records; their existence, storage location, and retention are controlled by the hosting account and platform.

Local service is not available

PixelRinse does not install, discover, contact, or send files to a native service. The synthetic readiness demonstration uses fixed in-memory labels only. Any future separate service on your device would have distinct memory, temporary-file, crash-dump, swap, and operating-system limitations and would require explicit consent for each selected job.

What file cleaning cannot remove

Embedded metadataOnly the documented metadata categories for a cleaning-supported format are removed. Metadata inside embedded images or other nested files may remain.
Hidden document contentComments, notes, tracked changes, hidden cells, layers, attachments, and custom data may remain, require review, or cause the file to be rejected.
Visible or audible contentFaces, names, text, reflections, voices, locations visible in pixels, document values, and other content are not redacted.
Archive and filesystem informationArchive entry names may reveal information. After download, the browser or operating system can add timestamps, paths, thumbnails, indexes, or sync records.
External recordsPixelRinse cannot remove copies, backups, message history, cloud-provider records, or metadata already held by another service.
Forensic limitsNormal browser memory cleanup is not cryptographic erasure. Steganography, device traces, caches, swap, and advanced forensic recovery are outside the verification scope.

Methodology: Container cleaning vs. Fresh Export

Container cleaning

Structurally rewrites supported containers without recompressing image pixels or converting document content.

  • Lossless JPEG Container Clean: Removes supported EXIF/XMP, thumbnails, comments, private APP data, and post-EOI bytes without re-encoding. It preserves every compressed scan and required decoding structure byte-for-byte, plus JFIF and Adobe rendering markers.
  • JPEG appearance boundary: Preserve retains minimal rendering-only orientation and coherent ICC profile bytes, including any profile descriptions. Other EXIF fields and thumbnails are removed; this is not removal of all rendering metadata. Ambiguous orientation and malformed profiles remain unavailable. Auxiliary/multiple-image JPEGs require explicit primary-only Fresh Export, discarding secondary images and HDR gain maps; re-encoding/color may change.
  • PNG: Keeps IHDR, PLTE, IDAT, IEND, tRNS, cHRM, gAMA, sBIT, sRGB. Removes everything else (tEXt, zTXt, eXIf, iCCP, etc).
  • Office documents: Rebuilds DOCX, PPTX, and XLSX packages without supported document-property parts, then verifies required content and relationships.
  • PDF: Rebuilds supported, unencrypted files without document-info and XMP metadata.
  • Caveat: Complex or maliciously structured files may bypass structural filters. These are marked as "Review needed".

Fresh Export

Decodes the image to raw pixels using the browser's engine, discards the original file, and encodes a brand new file.

  • Verified output: The generated file is reparsed and reported against PixelRinse's documented supported checks.
  • Lossy: Re-encoding a JPEG introduces generation loss depending on the selected quality.
  • Color Limits: Fresh export flattens colors to the browser's default sRGB space, discarding custom ICC profiles.
  • Visible Details: This process does NOT obscure faces, text, license plates, or reflections visible in the image pixels.
  • Documents: Fresh Export is unavailable because generic conversion can destroy text, formulas, charts, links, forms, and accessibility.

System Limits

  • 25 MiB max sizeLarger files can exceed browser memory limits during decoding or document rebuilding.
  • 40 Megapixels maxExtremely high resolution images consume too much RAM during Fresh Export decoding.
  • 20 files per batchTo ensure stable performance and consistent ZIP generation across browsers.
  • 200 MiB batch totalThe active group of input files must not exceed 200 MiB. Larger selections hold only unread file references (up to 100 files / 1 GiB); save and release the active group before opening the next.

Future Roadmap

PixelRinse keeps inspection free and uses a one-time unlock for cleaning and cleaned downloads. Future planned improvements include:

  • Professional automation API (local CLI).
  • Additional verified document and media containers.
  • Folder-level workflows with deeper sub-directory retention.
  • Custom presets for specific EXIF retention (e.g. keep Copyright but remove GPS).

Inspection remains free without an account, payment, or license. For supported cleaning, configured checkout is hosted by a payment provider. These third parties receive billing details you enter there, such as payment and contact information, under their own privacy policies. PixelRinse adds no payment surcharge; external network or issuer fees may still apply. PixelRinse's payment API receives only the selected product, a random installation identifier, and order facts, and never file contents, names, hashes, or metadata. Returning from the provider does not unlock anything; you check the payment explicitly. A server-signed perpetual recovery license can be exported and restored without an account. Payment methods remain unavailable until their provider setup is complete.