Photos and files

Photos and files you attach to a tip are rebuilt to remove hidden data, then locked before they are stored. This page explains what the rebuild removes, what it cannot remove, and how attachments are stored.

Hidden data is removed

Most phones and cameras write hidden data into every photo. This can include the GPS location where the photo was taken, the device’s make and model, and the exact time. None of it shows in the picture, but any of it could point back to you.

Before a photo or file you attach is saved, we re-create it from scratch so hidden data — like the GPS location your camera records, the device model, and timestamps — does not come along. This happens both on your device and again on our server.

Re-creating the file means nothing hidden has to be found and deleted one field at a time. The picture is kept; the hidden data is not. Some phone photo formats are converted to a more common format during the rebuild. The picture itself is unchanged.

PDF documents are cleaned too. The document’s own information, such as the author name and the software that made it, is cleared before the file is saved.

Locked before storage

Files you attach are locked before they are stored, just like the rest of your tip. Anyone who reached the stored files without going through your program would find locked data, not your photos.

This lock is held for your program, not by you. Your program can open the files you attach, because they are the evidence you chose to send.

The honest limits

The rebuild removes hidden data, not what the picture shows. If a photo shows something that could identify you, such as your reflection, your street, or your name on a paper, no cleaning can remove that. Look at what the photo shows before you attach it.

A PDF is not fully scrubbed. Clearing a document’s own information does not rebuild the pictures inside it, so a photo placed inside a PDF keeps its hidden data. If you want to send a photo, attach the photo file itself rather than putting it inside a document.

Video is rejected, not cleaned. The platform has no reliable way to rebuild a video without its hidden data, so it does not accept video files.

Related

• Encryption: how your tip itself is protected.
• Anonymity: what the platform knows about you, and what it does not.
• Retention: how long your tip is kept.

The full register of guarantees, in the exact words the platform commits to, is on How TypVault protects you.