Privacy

Choosing a photograph here hands this page a file. The page decodes it into pixels in the browser’s memory, draws those pixels into the layout you picked, and — when you press save — writes a new file straight to your downloads. At no point in that sequence is a photograph sent anywhere. There is no server behind this site to send one to: the whole thing is a set of static files and the code that runs in your tab.

Traffic does go the other way, and this page used to imply it never did. Two files can be fetched while you work: a HEIC decoder from this site’s own host, and — only if you press “Fit the faces” — a face finder from our model file server, which is a different host. Both are code coming to your device. Neither is your photograph leaving it. The next two sections say exactly what each one is.

It is read from disk, its orientation flag is resolved so a portrait does not arrive sideways, and it is reduced to a working copy small enough that thirty of them will fit in a phone’s memory at once. The full-size original is released immediately. The only time the original is read again is at the moment you save, when each photograph in turn is decoded at full size, drawn into its slot, and released before the next one opens.

The collage in progress is kept in this browser’s own storage on this device — the layout, the order, each framing, the title and stickers, and a copy of each photograph you opened — so a reload or a closed tab does not lose it. That store is IndexedDB, which lives on your device and which no server can read; nothing in it is sent anywhere. “Start over and forget it”, in the Save step, deletes all of it, and so does clearing this site’s data in your browser settings. The files on your device are never altered; everything the tool does happens to copies.

One exception is worth naming precisely. If you open a HEIC photograph — the format recent iPhones use — the page downloads a decoder from its own host the first time, because no browser can read that format on its own. That download is code coming to your device. Your photograph still does not leave it.

A collage crops every photograph to fill its cell, and the mistake everybody notices is the cell that takes the top off somebody’s head. The Photos step offers to fix that pass for you, and doing it needs a file this site does not ship: a 224 KB face detector — 229,738 bytes exactly — called YuNet, MIT-licensed, fetched from our model file server. That is a request to another host, and it is the only one the collage tool itself makes. The page around the tool makes one more, for counting visits, described in the next section.

The request carries what any browser request carries: your IP address, the file being asked for, and nothing else this page adds — no cookie is set, no identifier is sent, and the host is told nothing about which photographs you have open, because the request is made before any of them are looked at and says nothing about them. The size is printed on the button before it is pressed, the download is refused if the file arrives at the wrong length, and what arrives is kept in a named Cache Storage bucket so a second visit fetches nothing at all. “Delete it from this device” in the same panel empties that bucket.

The photograph does not follow it. The model travels to you; the detector runs on your own processor, in this tab, in about 16 milliseconds a photograph, and what it hands back is a rectangle per face — no identity, no name, no estimate of anything, nothing written down. All the tool does with that rectangle is decide how far to slide a picture inside its slot, which is the same adjustment your finger makes when you drag one.

Press nothing and none of it happens: no request is made, no model is stored, and every slot is framed by dragging exactly as it was before this existed. The reason this section is here at all is that an earlier version of this page said no request was made to any other domain, and the moment that button shipped the sentence stopped being true.

Visits are counted, and this is how. Pages on createacollage.com load Cloudflare Web Analytics, a cookie-free page counter, from static.cloudflareinsights.com. It records that a page was viewed, the page’s address, the site that sent you here (the referrer), your country and your browser and device type, worked out from the request itself. It sets no cookie, stores nothing on your device, builds no profile that follows you to other sites, and is told nothing about your photographs: no image, no file name, no size, no title you typed. The property belongs to this site alone.

The counter runs only on the live domain, createacollage.com. The script is added after the page has loaded and only when the address bar shows that domain, so a preview copy, a local build or any other host sends nothing at all. If your browser or an extension blocks it, nothing on the page changes.

There is no advertising on this site. No ad script is fetched, no ad frame is drawn, and no advertising company receives anything from your visit. If that ever changes, this section will say so, in the present tense, on the day it happens.

Two things can be kept in this browser, on this device, and neither is ever sent anywhere. The collage in progress is kept in the browser’s own database under the name createacollage: one record with the layout, the order, the framing, the style, the text and the save settings, and one record per photo holding the original file you opened, so a reload can bring the collage back. Start over and forget it, in the Save step, deletes both. If you have pressed Keep faces whole, the face finder’s model file is kept in the browser’s file cache under cac-face-model-v1 so it is not downloaded twice; Delete it from this device, in the Photos step, removes it.

Clearing this site’s data in your browser’s settings removes both as well. A private window keeps neither once it is closed.

This is a general-audience tool and nothing here is directed at children. The tool collects no personal details, and the site keeps none: there is no account and no database behind it.

The contact page is the one place that asks who you are. When you press its Send button, the name, email address and note you typed are posted to Google Forms along with the words createacollage.com, so the maker can tell which site the note came from. Nothing is sent before that press, the page loads nothing from Google while you type, and nothing else on this site contacts Google. Your photographs are never part of it.

If this page changes, the change will be to describe something the site does differently, not to quietly widen what it collects. The one commitment that will not change is the first one: your pictures are not uploaded, because there is nowhere to upload them to.