Last updated: October 2026.

ExifView exists to show you what your own photos reveal — camera settings, timestamps, and often the GPS position where they were taken. A tool whose entire point is inspecting sensitive metadata has to handle that metadata responsibly, so it was built around one rule: the file is examined where it already sits, on your machine.

Data we never receive

Drop a photo in and the browser itself reads the bytes, decodes the embedded metadata and renders the report. That is JavaScript executing locally — there is no upload endpoint in the code, no processing queue, no remote copy of the image or its contents. Disconnect from the internet after the page has loaded and inspection keeps working, which is the simplest proof that nothing is transmitted.

The one transfer you control

When coordinates are found in a file, the report includes an optional OpenStreetMap link. Clicking it sends the latitude and longitude to OpenStreetMap in the link URL — a deliberate, per-photo action on your part. Nothing else is shared, and ignoring the link sends nothing.

Automatic data: hosting

ExifView is served via Cloudflare. Delivering pages involves their edge systems handling connection metadata — the requesting address, the URL fetched, the time, the browser string — for delivery, abuse protection and traffic statistics. The site runs no accounts and stores no form submissions, so there is no user record for those logs to be joined to.

Third parties on the page

Advertising, where enabled, is supplied by networks such as Google AdSense. They may place cookies or use similar identifiers to count impressions and personalize ads where allowed; adjust that through your browser’s cookie controls or Google’s Ads Settings. We may additionally use aggregate, non-identifying analytics to see which guides get read. Photo contents, file names and metadata values cannot appear in any of this — they are never on the network.

Storage and cookies

The viewer itself sets no first-party cookies and writes nothing to localStorage — a photo is forgotten the moment you leave or reload the page.

Contact and changes

Privacy questions go to hello@photopassport.online. Future revisions of this policy will appear here, dated.

Usage counts

What travels for usage counts is one cookieless ping per page view — page address, the domain of the referring site, the page language and any campaign tag in the link — and a second one when you leave, with the time the page was open.

Our server adds the time, Cloudflare’s country and network-provider readings, a device type (phone, tablet, desktop or bot) inferred from the browser’s user-agent, a rough source category and a bot-filter label. Daily visitors are counted with a code hashed from your IP address, browser, the date and a secret value; it resets each day and the IP address is not stored. No cookies, and nothing about your images — no pixels, file names or sizes — is in it.