Browser-local Image Processing: Privacy Boundary and Test

Direct answer

The AIGClub image handlers read a selected file through a browser object URL, decode it into an Image, draw to Canvas, create a Blob, and attach that Blob to a download link. They contain no application request that uploads the selected image. The page can still request analytics, monitoring, advertising, fonts, or other resources, and browser extensions or device software can act outside the handler. Use a trusted environment, test with a synthetic image, inspect network requests, verify the download, and never treat local processing as absolute privacy.

Four boundaries to keep separate

Handler: file selection, object URL, browser decoding, Canvas, Blob, and download.

Page: HTML, scripts, analytics, monitoring, advertising, fonts, and other resource requests.

Environment: browser extensions, malware, shared profiles, clipboard, screenshots, backups, and synced folders.

After download: file metadata, storage permissions, recipients, upload services, and later sharing.

• Review the three image handlers

Reproducible network test with a synthetic image

Create a harmless 32 × 32 image containing a unique visible test word; never use a sensitive image for this check.

Open browser developer tools, clear the Network log, enable request preservation if navigation is expected, and select the synthetic file.

Crop, resize, or convert it and download the result while recording requests initiated during those actions.

Expect normal page resources to exist. Investigate any request whose body or payload contains the synthetic image bytes or unique marker; absence in one run is evidence for that run, not proof about extensions or future code.

What source review can establish

The current handlers create object URLs and Canvas Blobs and do not call fetch, XMLHttpRequest, a form submission, or an application image-upload API. Source review can support that bounded statement; it cannot prove that third-party code, an extension, a compromised browser, or the operating system is unable to access data.

Metadata and color profiles require a separate test

Canvas export often creates a new pixel-based file, but this guide does not promise that EXIF, GPS, other metadata, ICC profiles, or color behavior are always removed or retained. If disclosure matters, inspect the downloaded file with a dedicated metadata tool and document the result.

Sensitive-image operating checklist

Use a trusted, updated browser and device with reviewed extensions.

Keep the original outside shared or automatically synced locations when required.

Process the minimum necessary file and close the page when finished.

Open the download, check pixels, MIME, dimensions, metadata requirements, and storage path.

Apply the receiving service's privacy and retention policy before sharing.

Claims this workflow does not make

It does not promise no page networking, anonymity, encryption beyond the browser environment, malware resistance, extension isolation, secure deletion, metadata removal, animation preservation, lossless pixels, or safety after the user downloads or shares the file.

Frequently asked questions

Why can the Network panel show requests during local processing?

The page may load unrelated analytics, monitoring, advertising, fonts, or other assets. The bounded question is whether the selected image is sent by the AIGClub handler.

Does a clean synthetic test prove a private photo is safe?

No. It provides evidence for one browser, version, page build, and run; trust in the device, extensions, future code, and recipient still matters.

Can I assume Canvas removed GPS metadata?

No. Use a dedicated metadata inspector on the downloaded file whenever location or other metadata is sensitive.

Is a public or shared computer acceptable?

Avoid it for sensitive images because browser, account, storage, extension, and device controls are unknown.