GPS location
Coordinates, altitude, even which way the camera faced. One photo can point at an address; a series of them can draw a routine.
Privacy cleanup
Your photos remember more than you do.
Every photo carries a passenger list — where it was taken, which device it came from, who touched it last. Privacy cleanup reads the list, grades what it finds, and removes exactly what you choose. Nothing leaves your machine.
Risk scan grades findings High, Medium or Low
Save-a-copy default — the original stays untouched
No upload · no account · runs offline
The scan: what the file was carrying
One scan reads the metadata in full — EXIF, XMP and IPTC together — and rates every finding as High, Medium or Low risk, counting the fields that carried it. You see the verdict before anything changes.
| Grade | Typical findings | Why it matters |
|---|---|---|
| High | GPS coordinates, device serial numbers | Location and hardware identity — the two that identify most directly and travel furthest. |
| Medium | Device IDs, MakerNote data, personal comment fields, face regions, embedded thumbnails | Softer one at a time; together they assemble a profile. A thumbnail is a second copy of the photo. |
| Low | Author names and copyright strings, software history | Worth knowing, lightly invasive — and sometimes exactly what you want to keep. |
Risk is usually a combination
A location tag places the shot; a serial links it to your other files; an edit trail says what happened after. None of those is dramatic alone, which is why the scan grades rather than alarms.
What actually comes out
Cleanup works through the families of concern a photo can carry. Each one is a named switch in a profile — not part of an opaque “clean everything” button.
Device serials and IDs
The camera body's serial number, maker notes and device identifiers. They do not say who you are, but they do say which files belong together.
Author data
Artist names, copyright strings and personal comment fields. Sometimes exactly the credit you want on a file — which is why removing it is a choice, not a default.
Face regions
XMP region tags that describe where faces sit in the frame. They are metadata about the picture, not part of it — and they do not need to travel.
Software history
Which applications opened, edited or saved the file. Usually a harmless detail; occasionally an unintended note about how the image was made.
Embedded thumbnails
A second, smaller copy of the image stored inside the metadata — one that can outlive some of the edits made to the visible picture.
- Private comment fields —
UserCommentandDocumentName— are graded and removed with the personal set. MakerNote— the manufacturer's private block — is graded Medium, not Low.- Field names you add yourself are matched too, so your own conventions count.
Two profiles to start, then make your own
A cleanup profile is a set of decisions about what matters for a given file. StegoPixel ships two, and lets you write the rest.
| Profile | What it removes |
|---|---|
| Safe for Social Media | GPS, serial numbers, device IDs and embedded thumbnails — while keeping the copyright line, so credit still travels. |
| Full Anonymization | Everything: all EXIF, XMP and IPTC metadata is stripped from the saved file. |
Custom profiles
A switch for each family of concern — GPS, serials and device IDs, author data, face regions, software history, thumbnails — plus any field names you supply. Saved as a local profile, ready for the next file.
Built-ins are protected
The two shipped profiles cannot be overwritten. Your edits become new profiles, so the safe starting points stay safe.
A profile can keep things, too
Want GPS kept for a mapping project? That is a profile with the GPS switch turned off. The app removes what you selected — never what it guessed you wanted.
Preview: see the removal list first
Preview runs the profile against the actual file and lists exactly which tags it would remove, before a byte is written. You approve a list, not a promise.
- Preview answers the real question — what does this specific photo carry?
- The profile decides the families; the preview shows the concrete tags inside them.
- The scan and the preview are both read-only — nothing moves until you confirm the cleanup.
Read it once, slowly
Metadata is invisible by nature; that is why it leaks. The preview is the clearest view you will ever get of what was travelling with your pictures.
Saving: a copy by default, on purpose
Cleaning writes a new file and leaves the original exactly where it was. That is the shipped default — saving in place is possible, but you have to choose it.
Save As (the default)
A cleaned copy is written alongside the original. The copy is clean; the original still carries everything it always did, which is exactly what makes the decision reversible.
Save Changes (in place)
The file is rewritten where it lies. This is the one that removes data for good, so choose it deliberately.
Backups for destructive writes
A backup is taken before operations that overwrite, by default. A setting, not a hope.
Export As goes one step further and writes the image out in another format — JPEG, PNG, TIFF, WebP or BMP — with or without unsaved cleanup changes. GIF can be read, but not written.
A cleaned file cannot be un-cleaned
Removal is a destructive write to the saved file: the metadata is genuinely gone, which is the point. If you are unsure, take the copy and leave the original with everything still aboard.
Nothing is uploaded, because there is nowhere to send it
The scan, the preview, the cleanup and the export all run on your machine. The application ships without an HTTP client and without telemetry — so the photos you are cleaning never cross the network to be cleaned.
- Disconnect the network and clean a photo — nothing about the result changes.
- Custom profiles live in your local app data, not in an online account.
- The details are checkable: the privacy page lists every network claim and how to verify it yourself.
A claim you can test in a minute
Pull the cable, watch the app in Windows' own resource monitor, or do both. A tool built for sensitive files should be verifiable, not taken on faith.
What cleanup can and cannot do
Removing metadata is a real change with real edges. These are the ones to know before you rely on it.
- Once a cleaned file is saved, the removal is not reversible — the data is gone from that file.
- Cleanup changes the file, not the world: a photo already shared stays shared, and copies beyond your machine are beyond its reach.
- Pixels are not touched. Face-region tags are notes about the picture; the faces themselves remain exactly where they are.
- GPS you choose to keep is GPS you publish. The app will not decide that for you.
- The cleanup workspace handles the loaded image; for whole folders, run the privacy nodes —
Privacy_RemoveGpsandPrivacy_RemovePersonal— in a workflow.
Know, then decide
Most photos are harmless, and pretending otherwise would be dishonest. The ones that are not tend to be surprising — a house number, a habit, a serial that links a folder together. Cleanup is about seeing the whole list first.
Frequently asked questions
Does cleanup delete or modify my original photo?
Not by default. The shipped behaviour is Save As — a cleaned copy is written beside the original, which stays exactly as it was, and backups are taken before any destructive write. You can choose to save in place, but you have to mean it.
Can I undo a cleanup after saving?
No — once a cleaned file is saved, the removed metadata is gone from it for good. That is why the default writes a new copy and leaves the original untouched: keep the original until you are sure the copy is what you want.
Does it blur or remove faces from the image?
No. Cleanup works in metadata, not pixels. Face-region tags are XMP notes describing where faces appear; removing them removes the notes, while the faces themselves remain untouched. Privacy cleanup never inspects or alters image content.
Does cleaning work offline, and are my photos ever uploaded?
Offline and unuploaded. The app ships without an HTTP client and without telemetry, so there is no path for a photo to leave your machine while it is being cleaned — disconnect the network and nothing about the result changes.