Security & Privacy

When you drop a file into any Pix Garage tool, it is read directly from your device's memory by the browser's File API. The file is never transmitted over the network — not to our servers, not to any third party.

1. 1
   File is read locally — Your browser's File API loads the file into memory. At no point does this create a network request.
2. 2
   Browser APIs do the conversion — Depending on the tool, your image is processed by the HTML5 Canvas API, a WebAssembly module, or a pure-JavaScript library — all running inside the browser's sandboxed environment on your device.
3. 3
   Output is downloaded directly — The converted file is generated as a local Blob URL. Your browser prompts a download. Nothing is stored on disk, in a database, or in the cloud.

What we collect

We collect as little as possible. Here is the complete picture:

• No image data — your files are never uploaded to any server.
• No account required — there is no sign-in, no email, no profile.
• No cookies for tracking — we do not use advertising cookies or cross-site tracking.
• Basic analytics — we use privacy-respecting, aggregate page view counts to understand which tools are used. No personal data is tied to these counts.

Technology used

All processing uses open, auditable browser standards and well-established open-source libraries — pinned in our lockfile and reviewed on every update:

• HTML5 Canvas API — Used for PNG, JPG, GIF, BMP, TIFF, SVG, ICO, and WebP conversions.
• WebAssembly (Wasm) — Used for HEIC/HEIF decoding and background removal — a quantized ONNX model runs entirely client-side via Wasm.
• pdf-lib / pdfjs-dist — Used for PDF reading, manipulation, and generation — both run entirely in the browser.
• tesseract.js — Used for in-browser OCR — no image or text ever reaches a server.
• jszip / qrcode — Used for batch downloads and QR code generation, respectively.

Transport security

The Pix Garage website is served exclusively over HTTPS. TLS is terminated at Cloudflare's edge using modern cipher suites. HTTP requests are automatically redirected to HTTPS, and we do not serve any mixed content.

Infrastructure

Pix Garage is a static Next.js application deployed on Cloudflare Pages. There is no application server, no database, and no file storage — the attack surface is limited to the CDN layer and the static assets we serve. Cloudflare's DDoS mitigation, Web Application Firewall, and bot management are active on the domain; their security practices are documented in the Trust Hub.

Reporting a vulnerability

If you discover a security issue — for example, a way that user data could be exposed, a malicious script injection vector, or a compromised dependency — please report it responsibly before public disclosure.

Send a description to [email protected] with the subject line Security Report — Pix Garage, or use the contact page. Please include steps to reproduce, the potential impact, and any suggested mitigations. We acknowledge reports within 48 hours and aim to resolve confirmed issues as quickly as possible.

Scope