Privacy at EnlargePicture

Upscaled inside this tab. The original never travels.

There is no account, no sign-in and no server that sees your files. The page you are reading is a set of static files; the enlarging happens in code running inside your own browser tab, on pixels your browser decoded from a file you chose.

Choosing, dragging or pasting a file hands it to the browser, which decodes it into memory in this tab. The enlarger reads those pixels, computes a larger set, and hands them back to the page to draw. Pressing Save encodes the result and asks your browser to write it where you tell it to.

At no point in that sequence is the picture written to a disk on our side, copied to another machine, queued for processing, or held in any form that outlives the tab. Close the tab or press the reset control and the pixels are released; there is nothing further to delete, and no request you could send us to delete it.

One thing does travel, and it travels the other way. A HEIC file — the format an iPhone shoots by default — needs a decoder no browser ships, so dropping one causes this site to send you a two-megabyte piece of code from its own address. That is a download, not an upload: what crosses the wire is the decoder arriving, never your photograph leaving, and the request carries no information about the file that triggered it beyond the fact that somebody somewhere opened a HEIC.

No visit to this page is being recorded. There is a slot in the code for a cookie-free counter — the kind that notes which address was opened, roughly which country asked and what sort of device it was — and the slot is empty: the property behind it has never been set up, so no counting code is sent to your browser and no visit is tallied anywhere. View the source of this page and you will find nothing of the sort in it.

If that ever changes, the counter will belong to this domain alone rather than to a shared reporting bucket, it will still set no cookie and build no profile, and it could not see the picture you opened even then — a counter of that kind reads a web address, not the contents of a tab. This paragraph gets rewritten on the day it is switched on, not some time afterwards.

The plan is for Google to pay for this site through advertising, and right now none of it is running. The account has not been approved, no ad code is included in any page you can load here today, and nothing on the page is asking Google for anything. So there is currently no third party watching you here at all.

What it will look like once the account is approved is worth stating in advance, because you should not have to discover it. Google serves the ads, which means each ad is requested over the wire and that request can see what any web request sees: the address of the page you are on, your browser and its language, and a rough location worked out from your connection. Google may also set cookies or read similar identifiers to decide what to show you and to count it, which is the part worth knowing before it starts.

Two things will not change on that day. The picture you opened stays invisible to all of it, because it never becomes a web request in the first place. And nothing will be allowed above or inside the working surface — the space is mapped out below the tool and at the breaks in the longer reading, with each slot’s height held open in advance so the page cannot jump under your pointer. This section will be rewritten in the present tense the same day the first ad appears.

A model engine would change one sentence on this page: weights would have to be fetched from this site before anything could run, which is a download rather than an upload, and your picture would still not travel. If that day comes, this page will say so in the same plain terms before the feature ships, rather than after.