What this page can see

Choosing a photograph here hands it to the browser, not to us. It is decoded into memory in the tab you are looking at, the arithmetic runs there, and the file you save is written from that memory straight to your disk. The check that measures the saved file runs in the same tab. There is no upload step, no processing queue and no copy anywhere, because there is nothing on the other end of this domain that could hold one — the site is a set of static files, with no server-side code and no way to add any.

Your photograph, its outline, the colours you pick, the receipt’s readings and the file name are never put in any request, in any address bar, or in any log. The requests this site does make are listed next, all of them.

• This domain. The pages, their scripts, styles and fonts; the backdrop library’s thumbnails and, when you choose one, its full-size file; and — only when you ask for a model — the 13.3 MB WebAssembly runtime that executes it on the processor, or the 24.6 MB graphics-card (WebGPU) runtime for the two slow models on a browser that offers one. They carry nothing about your photograph.
• Cloudflare Web Analytics, on the live domain only. On changebgphoto.com each page loads Cloudflare’s small beacon script, and the beacon reports that page’s address, the referring page, a coarse country, the browser and device category, and load timings. It sets no cookie and no identifier that follows you to other sites. It is never handed a photograph, a mask, a colour or a setting. On preview copies, on a saved copy of a page and on anyone’s local build, the beacon is not loaded at all.
• Our model file server, only after you press a control that states a model’s size: the weights of whichever on-device model you chose — 6,163,938, 25,888,640 or 88,117,930 bytes. The request names the file and, unavoidably, the address that asked for it. Leave those controls alone and it is never made.
• The contact form’s service, only when you press send on the contact page: what you typed — your name, your email address and your note — plus this site’s domain, sent to a Google Form. Loading that page sends nothing.

That is the whole list.

The page opens on a selection worked out from colour and edges by arithmetic running in a worker thread on your own machine. That needs no download of any kind. Beside it there are three more ways to reach the same outline, all Apache-2.0 licensed and all run here, on your processor: PP-HumanSeg, a portrait segmentation network of 6,163,938 bytes that takes about 90 milliseconds; MODNet, a portrait matting network of 25,888,640 bytes that keeps hair and sheer fabric partly transparent; and ORMBG, a general cutout network of 88,117,930 bytes for products and pets, which is slow on a processor — around seventeen seconds.

Each is downloaded only after you press a control that states its size, and checked against its published SHA-256 before it is kept. The weights are then kept in this browser’s Cache Storage, so a second visit does not download them again; the runtime from this domain is kept by your browser’s ordinary cache, which usually holds it but may not. Both travel to you. Your photograph does not travel anywhere.

Say no to the download and nothing is fetched, nothing is kept, and every control on this page works exactly as it did — the colour-guided selection, the brushes, the feather, the unmixing, the shadow, the export and the receipt.

What the models are not: they find a subject against a background, which is what they were trained to do, and none of them is a face recognition system of any kind. No face embedding, template, descriptor or hash is computed, stored or compared against anything. No identity, age, expression or demographic estimate is produced. The crown and chin guides on the ID route are lines you place a photograph against; nothing finds a face. What a model returns is one grey image the same shape as your photograph saying how much of each pixel is subject, held in this tab’s memory and discarded with the tab.

Where your browser exposes a graphics adapter, the any-subject and hair-and-veil models are offered on the graphics card (WebGPU) instead of the processor; the button’s figure includes that runtime, and if it will not start the processor runtime takes over. Either way the model runs on your device.

Close the tab and the photograph is gone from the page as completely as if you had never opened it. Two things can be written to browser storage, both only after you ask. The first is any model file, in a Cache Storage bucket it names, after you agree to the download — with a control beside it that deletes it again. The second is your colour palette, as a list of colour values in local storage, only while you tick “Remember on this device” beside it; unticking it removes the list. Nothing about your picture is written anywhere: no history of what you opened, no cached result, no saved settings.

Open your browser’s developer tools before you choose a file, switch to the network panel, and use the tool normally. You will see the page, its stylesheet, its JavaScript and its fonts load from this domain; on changebgphoto.com itself you will also see the Cloudflare beacon script load and one small report go to Cloudflare. That is all — opening a photograph, painting, picking colours, checking and saving add no request of any kind, because there is no code here that could make one. Opening the backdrop library adds requests to this domain for its pictures. Share and Copy as PNG hand the file to your own device’s share sheet or clipboard, and nowhere else. Press a model’s button and two more appear: one to our model file server for the size that button named, and one to this domain for the runtime. Every one of them is a download, apart from the analytics report, which carries the fields listed above and nothing else.

This site carries no advertising, and no page loads an advertising script.

If any of this changes, the change will be on this page before it reaches the site. There is no mailing list to be removed from and no account to delete, because neither exists. You can write to us from the contact page.

• Change the backgroundOpen a photo, select the subject, put a new ground behind it.
• AboutWho makes this, and what it is for.
• TermsThe terms this page is offered under.
• White backgroundOpens on document white, with the off-white escape hatch beside it.