Privacy

Your pictures are never uploaded. The background is removed by a model that runs inside your browser, on your own device, and no image data is sent to this site or to anyone else.

Your images

When you drop a photo, it is read by your browser and processed in a web worker on your machine. The site has no server that could receive it: the pages are static files. Close the tab and the picture is gone; nothing is stored on this device by the site either, apart from the model weights and a copy of the site's own pages, scripts and fonts in the browser's cache, which is what lets the tool open with no connection. Neither contains anything of yours.

You can check this rather than trust it. Open your browser's developer tools, go to the Network tab, and remove a background. After your first picture, the only requests are the page itself, its scripts and fonts, and one small counter request described below. Switch the browser to offline and the tool still works.

What the site does collect

• A count. When a background has been removed, the page sends one request to this site's own address saying which tool page it was on and which runtime ran the model, for example {"page":"/white-background","backend":"webgpu"}. Saving a file, converting one or making a passport photo sends the same kind of request with the format, the conversion or the document, for example {"event":"download","key":"jpg"}. Each adds one to a number for that day. Every value is one of a short fixed list, and the server discards anything else. No request carries an identifier, a cookie, a file name, dimensions or anything about the picture.
• Visit analytics. The site uses Google Analytics, loaded through Google Tag Manager, to measure how many people visit and which pages they arrive on. It sets a cookie to tell a returning visit from a new one, and it records which runtime the model ran on, which format a file was saved in, whether a sample picture was tried, and on a converter page which format was converted to which. It is not used for advertising, nothing about your images is collected, and the page's security policy blocks any tag from sending data to a host other than Google Analytics. A content blocker stops it entirely without affecting the tool.

The AI model

The first time you use the tool, your browser fetches the AI model from getpng.app itself and keeps it in its cache. Your picture is not part of that request, and no other website is contacted: the page's security policy does not allow a connection to any host except this site and Google Analytics.

The HEIC decoder

Browsers other than Safari cannot open HEIC, the iPhone's photo format, so the first time you drop a HEIC photo your browser fetches a decoder from getpng.app (about 2 MB) and keeps it in its cache. The photo is decoded inside your browser like every other picture; the request for the decoder contains nothing of yours, and pages that never see a HEIC file never fetch it.

Open source components

• libheif and libde265 decode HEIC photos. They are licensed under the GNU Lesser General Public License, version 3, and used through libheif-js 1.23.2, served unmodified as a separate file at /vendor/libheif-js-1.23.2/libheif-bundle.mjs with its licence text. The source code is at github.com/strukturag/libheif and github.com/strukturag/libde265, and you may replace that file with your own build.
• BiRefNet lite (MIT licence) and U-2-Net (Apache-2.0 licence) are the background removal models, run through ONNX Runtime Web (MIT licence) and Transformers.js (Apache-2.0 licence).

Under the GDPR

Because your images are never transmitted or stored, the site does not process them in the sense of the regulation: there is nothing to keep, nothing to delete and nothing to hand over. The daily counts are totals per day (removals, and how many used each tool, format or document) and cannot be related to a person. Google Analytics is used under Google's standard terms, and you can block it with any content blocker without affecting the tool.

Contact

Questions about any of this: hello@getpng.app.