What leaves this page

A picture you open is read by the browser you are reading this in. It becomes a bitmap in this tab’s memory, the remapper works on that bitmap, and the file you save is written from it. No copy of it is sent anywhere, because there is nowhere to send one: this is a set of static files with no server behind it, no application programming interface and no storage. A build gate stands behind that: the rules audit scans every file under the image pipeline and the component tree for the six browser calls that could put something on the network or on your disk — fetch, XMLHttpRequest, sendBeacon, local storage, session storage and IndexedDB — and the release fails if one appears without a written exemption beside it.

Two things that check is not, stated because a claim of this kind is only worth what its limits are. It reads those two directories — the intake, the image code and every component — and not the colour modules underneath them, which contain arithmetic and no means of making a request. And it is a scan for the names of the browser APIs that could send something, so it proves that none of them is written down, not that sending is impossible in some general sense. It is a real gate on the one failure mode that matters and it is not a proof.

The browser decodes it. For HEIC, which browsers other than Safari cannot decode natively, a WebAssembly codec of about 2.0 MB is fetched from this site’s own origin the first time such a file arrives — the codec travels to you, not the picture away from you. Orientation is read out of the first 128 kilobytes of the file so that a photograph taken sideways is stood upright before anything is measured.

The bitmap is then converted into a colour buffer and held while the tab is open. Closing the tab or opening a different picture releases it. Nothing about your picture is written to local storage, to a database in the browser, or to a cookie; the site sets no cookie of its own at all. One thing can be written, and only if you ask for it: if you press Save in the brand-colours list, the hex values of the colours you saved — six characters each, at most sixteen, with any name you typed beside one — are kept in this browser’s local storage so they are there next time; removing them from the list removes them from storage. That list holds no filename or any pixel data; a saved colour is only the value and the name you chose to keep. If you press one of the optional “find the person” or “find faces” buttons, the model file you agreed to download is kept in this browser’s cache so it is not fetched twice — the model, never your picture. The file on your device is never modified: an export produces a new file through the browser’s ordinary download mechanism, with a name derived from the one you opened.

Capture metadata does not survive an export. The output carries pixels and their dimensions. Camera model, lens, timestamp and any location tag are dropped, which is a consequence of writing a new file from a canvas rather than a feature, but it is the behaviour you should expect and count on.

On recolorimage.com, and only there, these pages load Cloudflare Web Analytics. The page checks the address it is running on before it asks for the beacon, so a preview copy, a local build or the page saved to your disk never loads it. The beacon is cookie-free: it sets no cookie and stores no identifier in your browser. It reports aggregate page views, the path requested, the referring page, a coarse country, the browser and device class, and how quickly the page loaded. It never receives your picture, a sampled colour, a target colour, a setting or an exported file — none of those exist anywhere it can read.

The beacon is fetched from static.cloudflareinsights.com, and its reports go to Cloudflare, who process them under their own privacy policy. A content blocker that stops it changes nothing about how the tool works.

There is no advertising on this site. No ad script loads, no ad request is made and no advertising cookie is set.

Fonts, stylesheets, scripts, the HEIC codec and the model runtime are all served from this origin. Apart from that, a page makes exactly three kinds of request elsewhere, all named here: the analytics beacon described above, on recolorimage.com only; the contact form, described below, when you press its send button; and, only after you press “find the person” or “find faces” and see its size, one download of that model file from our model file server. The model download carries no part of your picture: the model is fetched, checked against its published SHA-256 and run in this tab. There is no error-reporting service either — a failure in the tool is described to you in the interface and transmitted nowhere. If you would sooner check that than take it on trust, the network panel of your browser’s developer tools lists every request made while you recolour a picture.

The site is a general-purpose utility and is not directed at children. The tool asks for no account, no email address and no personal detail of any kind. Questions about this page can be sent through the contact page linked in the footer.

That page is the only place a personal detail is ever asked for. Pressing its send button posts four fields to a Google Form: the name, email address and message you typed, and the domain recolorimage.com. Nothing is posted before you press it, the page fetches nothing from Google while it loads, and no picture, colour or setting from the tool goes with it.

This page was last revised on 24 October 2026.