Last updated: November 1, 2026.

PassportPhoto is designed so that your photos are none of our business — literally: the tool processes them on your device, and we couldn’t see them if we wanted to.

Your photos

Your photos never leave your device. Opening a photo in the maker reads it with your own browser’s decoder; cropping, measuring and re-encoding happen in JavaScript inside the tab; downloads are generated locally as blob URLs. There is no upload endpoint in the site at all — load the page, disconnect from the internet, and every feature still works.

Because processing is local, we have no photo database, no retention schedule and nothing to breach. When you close the tab, everything it held is gone.

What the site itself collects

• Server logs. Our hosting provider (Cloudflare) processes standard request metadata — IP address, user agent, timestamp — to deliver pages and prevent abuse. That’s inherent to serving any website.
• Nothing you type into the tool. Crop positions, measurements and the downloaded files exist only inside your tab.
• No accounts, no trackers of our own. There’s nothing to sign up for, and no first-party analytics beyond the small cookieless usage-count ping described on this page.

Usage counts

So we know which pages help, each view sends one cookieless ping to our own server. It contains only the page address, the domain of the site that linked you, the page language and any campaign tag in the link; a second ping when you leave adds how long the page was open.

Our server records the time and adds the country and network provider reported by Cloudflare, a device type (phone, tablet, desktop or bot) from your browser’s user-agent, a source category and a bot-filter label. To count daily visitors it stores a code hashed from your IP address, browser, the date and a secret value — never the IP itself — and that code changes every day. Your photo, its file name and anything you type are never included, and no cookies are used. When you open a photo in the maker, when its finished photo first appears, or when you click a download link, a ping also carries the action’s name — upload, ready, dl:photo or dl:sheet — so we can count how many photos actually get finished. After a download a small card asks whether the photo worked; tapping an answer sends fb:yes, or fb:no:rejected, fb:no:size, fb:no:usage or fb:no:other — one fixed word per button, there is no text field. If a step fails, the ping carries a short fixed error code instead, such as error:decode when your browser can’t read the file. Never the photo, its file name, its size or the check results.

Advertising

Adsterra supplies display banners beside the content on wide desktop screens and one 320×50 banner below the tool or article on smaller screens. Loading an ad shares your IP address and browser details with Adsterra and its advertising partners; their own cookies or identifiers may be used where your browser permits them. See Adsterra’s privacy policy. Each banner runs in an isolated, sandboxed frame that cannot read this page’s inputs, uploaded images or browser storage. We do not pass tool inputs to the ad network. Advertising does not load on About, Privacy, Contact and Disclaimer pages. Blocking ads does not disable the tool. A separate 300×250 display ad sits between the upper and lower sections of longer content.

Cookies

Children

The site is a general-audience utility; it doesn’t knowingly collect personal information from anyone, of any age — which is easy to guarantee when photos never leave the device.

Changes and contact

If this policy changes, the new version replaces this page with an updated date. Questions: hello@passports.pics, or via the contact page.