Architectural Foundation: In-Browser Zero-Knowledge Processing
imgAi.in (operated under the domain imgai.in) was created to permanently resolve the privacy and data exposure risks inherent in centralized cloud image tools. In traditional online converters, your files—whether family photos, legal agreements, tax forms, or biometric identity documents—are transmitted across public networks to remote web servers, where they reside in temporary storage, are processed by server-side binaries, and may be subjected to logging, telemetry, or third-party scraping.
imgAi.in operates on a radically distinct, cryptographically isolated paradigm: Pure Client-Side In-Memory Execution.
libheif), uncompressed TIFF decoding (UTIF.js), and next-generation WebP compression (libwebp)—execute as compiled C/C++ WebAssembly binaries executing strictly within your browser's sandboxed virtual machine.Categories of Data Handled & Storage Schedules
Because we adhere strictly to the principle of Data Minimization, our operations generate almost zero persisted records. The following table provides complete transparency regarding how different data types are handled:
| Data Classification | Storage Location | Retention Window | Third-Party Transmission |
|---|---|---|---|
| User Images & Documents | Local Device RAM Only | 0 seconds (Instant purge on tab close) | Zero (0%) |
| EXIF & GPS Location Metadata | Client RAM (Offscreen Canvas) | 0 seconds (Permanently stripped on request) | Zero (0%) |
| Theme & UI Preferences | Client Browser localStorage |
Until cleared by user cache reset | Zero (0%) |
| Technical Server Access Logs | Web Host Edge Infrastructure | 7 to 30 days (Automated cycle rotation) | Never sold; used solely for DDoS mitigation |
Global Regulatory Compliance Frameworks
imgAi.in was designed from the ground up to exceed international statutory privacy standards without requiring complex opt-in waivers or cookie paywalls:
European Union GDPR (Regulation EU 2016/679) & UK GDPR
imgAi.in embodies Article 25: Data Protection by Design and by Default. By refusing to transmit binary photographic payloads across networks, imgAi.in eliminates the concept of an external "Data Controller" or "Data Processor" regarding your files. Processing occurs solely on the user's personal hardware terminal under the domestic processing exemption (Article 2(2)(c)).
- Article 5(1)(c) (Data Minimization): Zero unnecessary bytes are requested or collected.
- Article 5(1)(e) (Storage Limitation): No image data is retained after the browser task terminates.
- Article 17 (Right to Erasure): All in-memory buffers are automatically erased when you close your tab.
California Consumer Privacy Act (CCPA / CPRA § 1798)
Under the CCPA, California residents possess the right to know whether their personal information is being sold or shared. imgAi.in unequivocally declares: We do NOT sell, rent, monetize, or disclose your personal information or image media to any third party, data broker, or commercial aggregator. We do not engage in targeted behavioral advertising or cross-context behavioral tracking.
HIPAA Security Rule (45 CFR § 164.312) Zero-Knowledge Standard
Medical clinicians, dental radiologists, and healthcare professionals frequently handle sensitive diagnostic imagery and scans containing electronic Protected Health Information (ePHI). Because imgAi.in processes files exclusively inside the local browser instance, no ePHI is ever transmitted across external communication channels, eliminating third-party HIPAA exposure and bypassing the necessity for a Business Associate Agreement (BAA).
India Digital Personal Data Protection Act (DPDP Act 2023)
imgAi.in operates under the national domain extension imgai.in and complies fully with India's DPDP Act 2023. We collect zero biometric facial identifiers, Aadhaar numbers, or financial credentials. Digital Data Principals enjoy complete autonomous ownership over their visual materials without covert profiling.
Cookies, Web Beacons & Third-Party Advertising Policy (Google AdSense)
At imgAi.in, we maintain a clear technical distinction between our 100% Client-Side In-Memory Image Engine (which never uploads, inspects, or logs your image files) and standard web technologies used to maintain website functionality, measure aggregate anonymous traffic, and display non-intrusive advertisements.
Google AdSense & Third-Party Vendor Notice
Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies (such as the DoubleClick cookie) enables Google and its partner advertising networks to serve ads to users based on their visit to imgAi.in and/or other sites across the Internet.
Users may opt out of personalized advertising at any time by visiting Google Ads Settings (or My Ad Center). Alternatively, users can opt out of a third-party vendor's use of cookies for personalized advertising by visiting the AboutAds.info Choices Portal or for European users via the Your Online Choices Portal.
* Note: Opting out of personalized advertising does not mean you will stop seeing advertisements; it means the ads shown will not be tailored to your prior web browsing history.
Categories of Cookies & Local Storage Used
| Category | Provider | Purpose & Data Collected | Opt-Out / Management |
|---|---|---|---|
| Strictly Necessary (First-Party) | imgAi.in LocalStorage | Retains your dark/light UI theme preference (theme) and recent tool shortcuts in client browser RAM. Contains zero PII. |
Clear browser storage or Site Data via browser settings. |
| Advertising & Remarketing | Google AdSense / DoubleClick | Allows Google to deliver contextual and personalized display advertisements to finance our 100% free image utilities. | Google Ads Settings |
| Consent Management | imgAi.in Consent Cookie | Records whether you accepted or customized cookie categories in our GDPR/ePrivacy consent banner (imgai_cookie_consent). |
Reset via browser LocalStorage or site footer link. |
Web Beacons & Standard Server Log Files
Like virtually all standard web server infrastructures, imgAi.in follows standard logging protocols. When your browser requests static assets (such as HTML documents, CSS stylesheets, or WebAssembly binaries), web servers record non-personally identifiable technical telemetry in standard Apache/Nginx access logs. This information includes:
- Internet Protocol (IP) addresses (used for geographic rate limiting and DDoS mitigation).
- Browser type, engine version, and operating system platform.
- Internet Service Provider (ISP), date/time timestamps, and referring/exit pages.
- HTTP response codes and payload byte sizes.
Critical Guarantee: Server log files are used solely for infrastructure security, network debugging, and server capacity planning. They are NEVER combined with user identities, and your image data is never logged because image payloads are processed locally and never transmitted across HTTP requests.
External Assets, CDNs & Script Integrity
To maintain lightning-fast worldwide delivery without burdening your connection, imgAi.in loads reputable static open-source client-side scripts from globally audited Content Delivery Networks (CDNs), specifically cdnjs.cloudflare.com and cdn.jsdelivr.net.
Open-Source Libraries
UTIF.js (TIFF decoder), heic2any.js (Apple HEIC engine), and Cropper.js (canvas framing) are downloaded once as static JavaScript files and executed entirely offline.
Strict Zero-Data Routing
Under no circumstances do these CDN endpoints receive your image files. Your browser only requests the immutable library code; the actual processing remains isolated in your memory.
Security Engineering & Memory Buffer Cleansing
Protecting client-side memory integrity is paramount. imgAi.in incorporates active memory lifecycle management:
-
Automated Blob URL Revocation: When preview images and export URLs are instantiated via
URL.createObjectURL(), our core engine monitors their lifecycle and callsURL.revokeObjectURL()immediately upon download or replacement, preventing memory exhaustion and residual memory snooping. -
Zero-Telemetry Canvas Cleansing: When switching between tools or uploading new files, all 2D canvas matrices are actively overwritten and reset with empty context dimensions to ensure zero remnant pixel persistence.
-
Hardened HTTP Security Headers: Our web server transmits enterprise-grade security headers on every response:X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=()
Protection of Sensitive Documents (Passports, Signatures & EXIF)
Certain visual assets carry heightened security and privacy risks. imgAi.in implements specialized safeguards for these critical tools:
Passport & Visa Photo Studio
When generating biometric 2×2 inch (51×51 mm) or 35×45 mm passport photos according to ICAO Document 9303 standards, no facial landmarks, geometric vectors, or biological profiles are recorded, analyzed, or trained upon. Your headshots remain strictly your confidential property.
Digital Signature Maker
Signatures are legally binding under the U.S. ESIGN Act and EU eIDAS Regulation (910/2014). Drawing or extracting your signature on imgAi.in takes place on a local transparent HTML5 canvas. The resulting anti-aliased PNG export is created locally in memory and never leaves your browser viewport.
EXIF Geolocation Scrubber
Modern smartphone photos embed GPS coordinates pinpointing your exact residence, workplace, and children's locations. Our EXIF tool analyzes raw metadata chunks and purges GPS latitude/longitude, camera model numbers, and serial stamps directly inside your browser before you post to social media.
Children's Privacy Protection (COPPA & GDPR-K)
Protecting the privacy of young children is critically important. imgAi.in does not knowingly collect, harvest, solicit, or maintain any personal data from individuals under 13 years of age (or under 16 years of age within European Union member states), in full compliance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. 6501) and GDPR Article 8.
Because our application requires no registration and executes zero server uploads, parents and educators can safely allow students to utilize imgAi.in for educational art projects, image cropping, and format conversion with absolute peace of mind.
User Rights & Data Subject Access Requests (DSAR)
Under global privacy statutes including GDPR, UK Data Protection Act, and CCPA, users maintain substantial legal rights, including the Right to Know, the Right to Access, the Right to Rectification, and the Right to Erasure ("Right to be Forgotten").
Policy Amendments, Versioning & Legal Contact
We may periodically update this Privacy Policy to reflect technical optimizations, new browser standards, or evolving international regulatory mandates. All updates will be published directly on this page with an updated effective date and revision index.
Data Protection & Legal Inquiries
If you have inquiries, audit verification requests, or security feedback regarding our zero-upload sandbox architecture, please reach out to our legal and security compliance team: