Privacy Policy

1. Introduction

JPEG Trust is an open-source research tool developed by the JPEG Trust research team for embedding, extracting, and verifying provenance metadata in JPEG and PNG images using the C2PA standard. This Privacy Policy explains what information the service processes, how it is handled, and your rights regarding that information.

2. Information we process

2.1 Uploaded images

When you use the verification, metadata reading, or metadata embedding features, you upload image files (JPEG or PNG) to our server. These images may contain embedded metadata including but not limited to:

• EXIF data (GPS coordinates, camera information, capture timestamps)
• IPTC metadata (author identity, copyright notices, digital source type)
• C2PA manifests (signature chains, edit history, AI-generation declarations)
• XMP data (editing software history, creator information)

Uploaded images are processed in memory and deleted immediately after the operation completes. We do not retain, store, or archive your uploaded images or their metadata beyond what is necessary to complete the requested operation.

2.2 Client-side storage

JPEG Trust stores the following data locally on your device (never sent to our servers unless you initiate an action):

• Preferences (localStorage): your selected theme (light/dark) and display language.
• Profile data (sessionStorage): trust profile YAML configurations you create, cleared when you close the browser tab.
• Image cache (IndexedDB): images you interact with may be cached locally for convenience. This data remains on your device.

2.3 Analytics

This site uses Google Analytics 4 (GA4) to collect anonymous usage data. Analytics cookies are only set after you give consent via the cookie banner. GA4 uses first-party cookies (_ga, _ga_*) to distinguish sessions. No personally identifiable information is collected, and analytics data is viewed only in aggregate.

We collect the following categories of anonymous data:

• Page views — which pages you visit and session duration
• Feature usage — which actions you perform (e.g. verifying an image, reading metadata, signing an image, running batch verification, creating a trust profile), whether those actions succeed or fail, and verification scores
• Downloads — when you download reports, signed images, or profile files
• UI interactions — file drag-and-drop usage, view mode switches, template selections, filter usage, and input method choices
• Preferences — theme and language changes
• Device information — browser type, device category, and approximate geographic region

We do not collect the content of your images, filenames, metadata values, or any text you enter into forms. Only the fact that an action occurred and its outcome (success/failure) is recorded.

You can withdraw consent at any time by clicking "Cookie Settings" in the sidebar, which will remove analytics cookies and stop further tracking. For details on how Google processes this data, see Google's Privacy Policy.

2.4 Feedback

The feedback page embeds a Google Form. If you submit feedback, your responses are collected by Google Forms and are subject to Google's Privacy Policy. Feedback submissions are anonymous unless you voluntarily provide identifying information.

3. Information we do NOT collect

• We do not require user accounts, passwords, or email addresses.
• We do not sell, share, or transfer any data to third parties beyond what is described in Section 2.3 (Analytics) and 2.4 (Feedback).
• We do not build user profiles or track individual identity across sessions.

4. How we use information

Uploaded images are used solely to:

• Extract and display embedded provenance metadata
• Verify image integrity against a trust profile
• Embed new provenance metadata into images

No other processing, analysis, or use occurs.

5. Data retention

Uploaded files are deleted immediately after processing. Client-side data (preferences, cached images) persists on your device until you clear your browser storage. We have no ability to access or delete client-side data — you control it entirely through your browser settings.

6. Security

Image uploads are transmitted over HTTPS. Server-side processing occurs in isolated containers. While we take reasonable precautions to protect data in transit and during processing, no system is completely secure. Do not upload images containing sensitive information that you would not want exposed in the event of a security incident.

7. International users

JPEG Trust is operated from the United Kingdom. If you access the service from the European Union or other jurisdictions with data protection laws, please be aware that your uploaded images are processed on our servers. Because we do not retain any uploaded data after processing, the scope of cross-border data transfer is limited to the duration of the operation.

8. Your rights

Because we do not collect or retain personal data, there is generally no stored data to access, correct, or delete. You can:

• Clear local preferences and cached images through your browser settings.
• Choose not to upload images containing sensitive metadata.
• Contact us with any privacy concerns.

9. Children's privacy

JPEG Trust is not directed at children under 13. We do not knowingly collect any personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the service after changes constitutes acceptance of the revised policy.

11. Contact

For questions about this Privacy Policy, contact the JPEG Trust research team at the JPEG Trust research team.