Privacy

You open a scan. Your browser decodes it, reads it for damage, fills what you approved and writes a repaired copy to your downloads folder. Every one of those steps happens inside the tab, on the device in front of you. There is no upload, because this site has no server that receives files — it is a set of static pages, and a check in the build refuses to publish it if any code path that could transmit a picture ever appears.

A few things travel towards you rather than away from you, and only when they are needed. A decoder, when you open a HEIC file, and a TIFF reader, when you open a TIFF — both from this domain. The model files plus the runtime that executes them, when you press the control on the repair panel that offers to redraw wide damage and states its size. And a small face-finding model, when you press the face guard, which also states its size. Those are programs arriving here. On the live domain, one more request goes out on every page: a cookie-free page-view count to Cloudflare Web Analytics, described below. Your photograph is not part of any of it and has nowhere to go.

No part of the file — not its pixels, not its name, not its dimensions, not the fact that you opened one — is included in any request this page makes. Nothing about it is written to local storage, to IndexedDB or to a cookie unless you turn on Keep this repair in this browser (described below). What this site does put in a browser cache is the model weights, which came from our model file server, and a copy of this site’s own pages and scripts so the bench opens offline. Neither is your picture.

This is the part worth being exact about, because a page that says “nothing is uploaded” and quietly opens a connection to somewhere else has told the truth in a way designed not to be checked. Here is every request this site can make beyond its own pages, stylesheet, scripts and typefaces.

Our model file server is our own, on a separate host, rather than a public model hub, and that choice is deliberate: a request to somebody else’s content delivery network would tell them which of this site’s visitors is repairing a damaged photograph, which sits badly beside the rest of this page. It is still a second host, it still sees an ordinary HTTP request from your browser for a file, and calling it anything softer than that would be evasive. The request carries nothing about your picture, and it goes in one direction: a download.

Two optional things are stored in this browser and nowhere else. If you turn on Keep this repair in this browser if the tab closes in the record column, the file you opened and the recipe of what you did to it (settings, brush strokes, history labels; never a rendered copy) are kept in this site’s IndexedDB for seven days so you can reopen it. Forget it now deletes it at once. It is off by default and is never sent anywhere.

After a first visit, a small offline worker keeps a copy of this site’s own pages, scripts and styles so the bench opens with the network off. It handles requests to this domain only and never stores a picture. The privacy badge on every bench opens a list of every request the page can make, and a button that clears everything this site keeps in the browser: the kept repair, the model files and the offline copy.

A model running here is a file of numbers being multiplied by a square of your photograph inside this tab. It is not a service, it has no other end, and there is no round trip in which anything could be retained. It is shown one 512-pixel square at a time, cut around damage you marked, with the marked pixels blanked before it sees them.

Nothing is computed from your picture that outlives the tab. No embedding, no descriptor, no hash of a face, no identity, no age or demographic estimate, no classification of the scene or of the people in it. The pass produces replacement pixels for the region you marked and a count of how many it wrote, and both are discarded with the page. What the model invents in a hole is invention, and the page says so where the control is rather than only here.

The face guard, if you run it, finds where faces are in the scan as rectangles, and only so that a redraw over one can warn you first and a region covering a face is never redrawn automatically. The rectangles are not an identity, are not compared with anything, are never sent and are discarded with the page.

Cloudflare Web Analytics counts aggregate page views for this domain. When a page is served from repairimage.com, a small script loads from static.cloudflareinsights.com and reports the requested path, referrer, coarse country, browser and device type, and page-load performance. On any other host — a preview copy, a local build — a check in the page decides before any request is made, and the script is never loaded.

The property belongs to this domain alone. The beacon sets no cookie and no identifier, builds no cross-site history, and receives no scan, file name, dimensions, damaged region, restoration setting, model result or export from the working surface. It is the only third party a visitor reaches without asking; the model files and the contact form are the others, and both wait for you to press something.

There is no advertising on this site. No ad unit is requested, nothing is drawn, no space is held for one, and no advertising network receives a request from these pages. If that ever changes, this page changes first.

• The repair never adds colour to a monochrome original.
• No face is reconstructed from nothing.
• Anything a model invents is marked on the picture and counted in the record.
• Nothing you open is shared or used to train anything, and nothing is kept unless you turn on keeping it in this browser.

None of it has to be taken on trust. Open your browser’s network panel, repair a scan and save it, and count the requests. Apart from this page, its stylesheet, its scripts and its typefaces — every one of them from this domain — you will see the Cloudflare Web Analytics beacon and its page-view report (on repairimage.com only), the HEIC decoder or the TIFF reader if you opened a file in that format, and, if you pressed the control that offers the model pass, one request to this domain for the runtime and one or two to our model file server for the weights (one more for the face guard if you ran it). The count matters less than the arrow beside it: not one of those requests leaves carrying your scan.

If this policy changes materially the date below changes with it and the change is described rather than merely dated. There is no account system, so there is nothing to delete and no request to make — closing the tab has already done it, and everything this site can leave behind in your browser has a delete control, on the panel that put it there and behind the privacy badge. Last reviewed on 24 October 2026.

To reach the people behind it, use the contact page linked at the foot of every page. It sends nothing until you press its send button; then the name, email address and message you typed, together with the domain repairimage.com, are posted to a Google Form and kept there to be read. The page fetches nothing from Google before that, it has no way to attach a scan, and the repair bench never talks to Google at all.