Skip to content

Privacy

Aback Images has no upload server. This page explains what that means and how to check it.

Last updated 15 November 2026

The short version

  • Your files are processed in your browser. Decoding, editing, AI models and encoding all run on your device, in Web Workers and WebAssembly.
  • We never receive your images, their metadata, file names, OCR text, or anything derived from them.
  • No account is needed and none exists. There is no database of users or files.
  • Your settings (theme, last options used per tool) are kept in your browser's local storage and never sent anywhere.

What the site does download

Like any website, your browser downloads the application itself: HTML, CSS, JavaScript, fonts, and, when a tool needs them, codec files (for example the AVIF encoder) and AI models (background removal, face detection, OCR language data). These are static files served from our hosting. They are requests to your device, never uploads from it.

The background removal, face detection and OCR models are hosted on this site with published checksums. They are not fetched from third-party AI services, and no inference happens on a server.

How to verify it yourself

  1. Watch the upload meter. Every tool shows a live “uploaded” counter. It counts the body of every request the page makes (fetch, XHR, beacons, WebSockets). During image processing it stays at 0 B.
  2. Use your browser's network panel. Open DevTools (F12), select the Network tab, then process an image. You will see only GET requests for app files and codecs; no request carries your image.
  3. Go offline. Load a tool, then disconnect from the internet and process an image. Core tools keep working because nothing needs a server. (A tool that needs a codec or model you have not used yet must download it first.)

Analytics and cookies

The site does not set tracking cookies. If privacy-respecting, aggregate usage statistics are enabled in future, they will only ever include product-level events such as “tool opened” or “processing took 800 ms”, never files, file names, image contents, metadata, hashes or extracted text.

Security model

Every file is treated as untrusted. Formats are identified by their bytes rather than their extension, decoders run in isolated Web Workers, image dimensions are checked before decoding to prevent memory exhaustion, and SVG files are sanitized (scripts, event handlers and external references removed) and only rendered through an image element that cannot execute code.

Contact

Questions about privacy? See the contact page.