This app handles photos of your friends' faces. So rather than claiming it is safe, this page states what it does not do — and how you can verify that for yourself.
What is not collected
- Your photo. The image you choose is opened, drawn and exported entirely inside the browser.
- Names, dates, spice levels. Nothing you type is sent anywhere.
- Face and bowl positions. Detection runs on the device, and the models are served from this site.
- Analytics, cookies, ad tags. None are present.
- Accounts. There is no sign-in.
It is built so it cannot send
A promise not to send data can only be verified by someone who reads the source. So the page constrains itself instead:
Content-Security-Policy:
connect-src 'self'; ← blocks external fetch / XHR / WebSocket
form-action 'none'; ← blocks exfiltration via form submission
img-src 'self' blob: data:;
default-src 'self';How to verify it yourself
- Watch the network: open the network tab in developer tools, then choose a photo and make a certificate. Not one external request appears.
- Cut the connection: after loading the page once, switch to airplane mode or turn off Wi-Fi and open it again. Everything still works. That is the clearest evidence that no network is needed.
Photo metadata
Photos taken on an iPhone carry EXIF metadata including GPS coordinates. This app extracts only the pixels on import, so the exported image contains no EXIF. Sending the finished certificate to someone does not hand them the location of the shop or your home.
What stays on your device
Only when you press “Pin to wall” is the finished image stored on this device (IndexedDB). It lives in this browser alone, with no sync and no backup. The “Take everything down” button, or clearing site data, removes all of it.
Your language choice is remembered the same way, in localStorage on this device. No cookies are used.
About hosting
This page is served from Vercel. Loading any web page leaves a record at the host (an IP address and so on), and this is no exception. But your photo and your input are never sent there. Only HTML and JavaScript come down; the traffic goes one way.