Privacy policy

Images you open in any Image KB Reducer tool are read, decoded, processed and re-encoded entirely inside your browser, on your own device. They are never uploaded, never transmitted to us or to anyone else, and never stored anywhere.

We do not receive them. We could not produce one if we were asked to, because there is no server that handles them and no database that could hold them. When you pick a file the browser hands this page a handle to bytes already on your disk; the work happens in a Web Worker using Canvas and WebAssembly codecs served from this site; and the result comes back as a Blob held in memory, which the download link points at. Closing the tab destroys it.

This includes everything derived from an image: its dimensions, its EXIF metadata, its GPS coordinates, its filename. All of that is read locally and none of it is sent anywhere. The Remove Metadata and Image Info tools are safe to use for exactly this reason.

Do not take the paragraph above on trust — it is the one claim on this page you can falsify from your own machine in under a minute, and a privacy policy that can be checked is worth more than one that has to be believed.

Open any tool, press F12 (or⌘⌥I on a Mac) to open DevTools, switch to theNetwork tab, and compress a file.

You will see the page, its stylesheet, its JavaScript, one font file, and — the first time a run needs them — some .wasm codec files. All of them come from imagekbreducer.com, all of them are downloads, and all of them arrive before or during the run rather than carrying anything away.No request carries your image.The one request that leaves this site is a small POST to app.kobbe.io — the analytics beacon. Click it and read its payload: a page URL, a referrer, a screen size, and, as a run progresses, an event name, the tool you used and how the run ended — the output format of a download, or the engine's reason code when it could not. A few hundred bytes, and none of them are yours.

Two details make that easy to confirm rather than merely observe. Every request for this site's own files is a GET, and aGET has no body to carry a file in; the requests that do carry a body all go to hosts named in section 6, and each is small enough to read in full.And the bytes sent stay in the kilobytes whatever you drop in — a 40 MB photo moves the download column and leaves the upload column alone.

If you find a request that contradicts any of this, it is a bug and we want to hear about it. The complete list of hosts this site is permitted to contact is in section 6.

Image KB Reducer also offers a command-line tool and an HTTP API for developers, documented at docs.imagekbreducer.com. They are not this website, and this page's first claim is about this website: nothing on imagekbreducer.com ever contacts the API, and the browser tools work exactly as section 1 describes whether the API exists or not.

The command-line tool runs on your own computer. Your image does not leave it.

The API is different by definition: when a developer sends an image to api.imagekbreducer.com from their own server, that image leaves their device — that is what an API is. The API's promise is therefore a different one, and it is stated where the API is offered: uploads are processed in memory, never written to disk, and not retained. The compressed result is returned in the response and then discarded. The Worker that runs the API has no storage binding for images, and the build fails if one is ever added. Cloudflare's request logs for the API contain the same metadata described in section 2 — method, path, status, timing, size — and no image bytes. The only thing the API keeps is the hashed API key, the name it was issued under, and when it was issued.

These are two separate promises about two separate products, and this site does not blur them.

Image KB Reducer has no accounts, no sign-in, no newsletter and no forms. We never ask you for a name, an email address or a payment method, because there is nothing here to sign up for or buy.

Hosting logs. imagekbreducer.com is a static site served by Cloudflare, and like every web server Cloudflare records standard request information — your IP address, your user agent, the URL requested, and a timestamp — for delivery, security and abuse prevention. This happens for any website you visit and is not something a static site can opt out of.

Analytics.We use kobbe.io for page-view analytics. It is cookieless: it sets no cookie, stores no identifier on your device, and does not follow you between sites. It records the page URL, the referring page, an approximate country derived from your IP address, and your browser and device type. It also records some usage data to help us improve the product: which tool was used, whether the run worked, and — if a file was refused before any work started — what type of file it was. None of this ever includes the image itself, its filename, its dimensions, or its size.

Google Analytics (not live yet).We will also use Google Analytics, on the same Google tag as Google Ads. It is not cookieless: where you have allowed it, it sets the two cookies described in section 3 so that it can tell a returning browser from a new one. It records page views and the same kind of usage data as above — which tool was used, and that a result was downloaded — and, like everything else on this page, it never receives the image, its filename, its size or its dimensions. Google is a separate controller of what it collects; section 4 explains what that means.

Advertising (not live yet).We will measure this site with Google Ads, which is described in full in section 4.

This site itself sets no cookies. It stores alocalStorage entry namedimagekbreducer-theme, holding light ordark, so the page does not flash the wrong theme on your next visit.None of these leave your browser and we never see them. Clearing site data removes all of them.

When analytics is switched on, Google Analytics will set two cookies on this domain, each lasting two years: _ga, which holds a random client id so that a returning browser can be told from a new one, and _ga_*, which holds the state of your current session. Neither holds anything about you or your images. Where consent is required, neither is set until you have given it, and clearing this site's data removes both.

When advertising is switched on, Google Ads will set cookies and read cookies your browser already carries, in order to measure this site and — where you have consented — for remarketing. Where consent is required, none of that happens until you have given it. Those are described in sections 4 and 5.

Image KB Reducer is free and has no paid tier. It will be funded by advertising, served by Google. This is the part of the site that genuinely does collect data and share it with a third party, and it is worth being exact about.

When it is switched on, Google and its ad-serving domains will receive your IP address, your user agent, the Image KB Reducer page you are on, and any Google advertising cookies your browser already carries. Google uses that to select an ad, to measure whether it was seen or clicked, and — where you have consented — for remarketing, which is the mechanism by which an Image KB Reducer ad may later follow you to another site.

Google is a separate controller of that data, not a processor acting only on our instructions. What it does with it is governed by Google's own policies, which we do not control. You can read how Google uses data from sites that use its services atpolicies.google.com/technologies/partner-sites, and manage your own Google ad settings atmyadcenter.google.com.

Your image is not part of any of this. An ad tag sees a page view. It cannot see a file you never sent, and there is no code path on this site by which image data could reach it.

If you are in the EEA, the UK or Switzerland, no Google cookie — analytics or advertising — is set and no personalised advertising runs until you have said yes. The prompt will be a single line at the bottom of the page with two equal buttons, Accept and Reject. It is served by this site, not by a third party; it blocks nothing, and the tools work identically whichever you press. Your answer is passed to Google through its Consent Mode before any Google code runs, which is also why every party that may receive your data is named in section 6 rather than described as “our partners”.

Declining is a real option and not a degraded one. If you decline, the tools work exactly the same: they are local, so consent has no bearing on whether they run.

To withdraw consent, or to give it, use the control that will appear below once the prompt is live; this page is one click from the Privacy link in every footer. Your choice is kept in your browser asimagekbreducer-consent, with the time you made it, so you are not asked on every page. Clearing this site's data resets it and the prompt appears again where it is required. Withdrawing consent does not undo processing that already happened on the basis of the consent you had given.

Today there is nothing to withdraw: no consent prompt is shown, because nothing that would need consent is running. The control appears here at the same moment the first tag does.

If you are in India, we rely on your consent under the Digital Personal Data Protection Act, 2023 for analytics and advertising, and the same withdrawal route applies. Our lawful basis elsewhere is consent for analytics and advertising, and legitimate interest for the hosting logs described in section 2.

Every party, named individually, and every host this site is permitted to contact. A list that quietly omits one is worse than no list at all, because a single DevTools session falsifies it — seesection 1a. Each entry says plainly whether it is live today.

In addition, Cloudflare, which serves imagekbreducer.com, processes the request logs described in section 2. No image data is included in those logs, because no image is ever sent.

Read the “what it can see” lines carefully, because they are the honest limit of the claim. Analytics and advertising seepage views — that you loaded a page, from roughly where, on roughly what device. They never see pixels, because the pixels are never sent anywhere for them to see. Those are two separate claims and this site keeps them separate on purpose: “your image never leaves your device” is permanent, and “we do not track you” is something Image KB Reducer does not say.

These recipients may process data outside your country, including in the United States. We do not sell personal data, and we have no mechanism by which we could: we hold none of it.

Depending on where you live you have rights to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent at any time. You also have the right to complain to your data protection authority.

In practice the honest answer for most of these is that there is nothing for us to hand over. We hold no account, no profile and no images; the analytics is cookieless and holds no identifier that could be matched back to you. For data held by Google, useyour Google account's privacy controls, which reach further into Google's own records than any request to us could.

To exercise a right or ask a question, write toprivacy@imagekbreducer.com.

Image KB Reducer is a general-purpose utility and is not directed at children. We do not knowingly collect personal data from children, and there is no account or profile here that could hold any.

The date at the top of this page is the date it was last reviewed against what the site actually does, not the date it was last edited for style. When analytics or advertising is switched on, the “not live yet” markers above will change and the date will move with them.

The one commitment that will not change is the first one: your image never leaves your device. Everything else on this page is a description of a website, and websites change.

Questions about this policy, or about anything above that does not match what you see in your own Network tab:privacy@imagekbreducer.com.