Privacy Policy

1. Data Controller

EXIF Scanner is a web tool operated by zirzibit. zirzibit is responsible for applying this policy and for the personal data processing described below. You can reach us at privacy@zirzibit.com.

2. What Data We Process

• The photo you upload: the image file itself and any EXIF/XMP/IPTC metadata it contains (e.g. capture date, camera/lens info, GPS location, author/copyright fields, and device serial number if present).
• Connection information: your IP address is processed transiently by our rate-limiting mechanism to prevent abuse. Because the site is served through Cloudflare, Cloudflare also processes connection-level data for security and performance (see Section 6).
• Your rating (optional): if you rate the tool from 1 to 5 after an analysis, the rating is only added to aggregate counters. The analysis's random id is kept for 24 hours so the same analysis cannot be rated twice, and your browser stores a flag in local storage to remember that you voted. The rating is never linked to you or your file.
• File handoff with Image Share (optional): if you use "Share the cleaned copy", or "Remove the location in EXIF Scanner" on Image Share, the file is passed directly between two tabs open in your browser; our servers never send files to each other. A file that arrives from Image Share is sent to our server, like any other upload, only when you press "Check the file", and is kept for the same retention period (see section 5).
• Admin access logs: sensitive actions (viewing/downloading a file) are recorded in an audit log against a one-way hashed identifier, not your real identity.

We don't require an account, we don't ask for your name or email, and your photo is never given a public link.

3. How We Use Your Data

• To read and display the metadata in your uploaded photo and perform the export/cleaning action you request.
• To keep the service secure: preventing abuse, excessive load, and unauthorized access.
• To audit sensitive admin actions and allow investigation of a potential security incident.

Your photo data is never used for advertising, profiling, or sold to third parties. Page visits are reported to Google Ads for conversion measurement and counted in aggregate with Cloudflare Web Analytics to understand how the site is used and how fast it loads; both are explained in section 6 below.

4. Legal Basis

Uploading a photo processes it on the basis of your consent, given in order to receive the service you explicitly requested (metadata analysis/export). Security logging and rate limiting rely on our legitimate interest in keeping the service secure and stable.

5. Retention Periods

6. Third-Party Service Providers

• Cloudflare: used for content delivery, DNS, and DDoS/security protection; all requests pass through Cloudflare. Cloudflare is a US-headquartered global provider and relies on Standard Contractual Clauses for international transfers.
• Cloudflare Web Analytics: used to count visits and measure page speed. The address of the page visited, the referring site, browser and device type, country and page load time are processed as aggregate statistics. It uses no cookies or browser storage, does not track you across sites, and never includes your photo or its EXIF content.
• Hetzner Online GmbH: hosts the server our application runs on (Germany/EU).
• OpenStreetMap: only when your photo contains GPS data and you view the location card, the coordinates are sent to OpenStreetMap's servers to render a map. This is opt-in by nature of using the feature; nothing is sent until the map is displayed. To show a place name (neighbourhood, district, city) in the report, our server also sends the coordinates to OpenStreetMap's Nominatim service; that request carries no file, file name or IP address of yours.
• Resend: used to send zirzibit's own administrator a once-daily aggregate usage summary (counts like analyses and exports performed) to confirm the system is working as expected. This summary carries no filenames, photos, or EXIF content, and it is never sent to you, the visitor.
• Google Ads: your page views, and the fact that a file analysis was completed, are reported to Google to measure advertising conversions. This reporting never includes your photo or its EXIF content.

Your data is never shared with or sold to any other third party.

7. Cookies

Only when someone signs into the admin panel is a strictly necessary session cookie (admin_session) set for authentication; it expires after 8 hours or on logout. For regular visitors, no tracking cookies are used other than the ones Google Ads sets for conversion measurement. Cloudflare Web Analytics uses no cookies.

8. Security Measures

• All connections are encrypted via HTTPS.
• Uploaded files are validated against their file signature (magic bytes).
• Admin access is protected by rate limiting and timing-safe authentication.
• Sensitive file operations are recorded in an audit log.
• Photos are deleted from public access after 24 hours, kept for up to 24 more hours in an admin-only area, and then permanently deleted.

9. Your Rights

Depending on your location, you may have the right to know whether we process your data, request information about it, request correction of inaccurate data, request deletion, object to processing, and request portability, under GDPR (EU/EEA) or Turkey's KVKK. Contact privacy@zirzibit.com to exercise these rights. Since photos are deleted from public access after 24 hours and permanently deleted from the admin-only area at most 24 hours later, most requests are already satisfied by default.

10. Children's Privacy

Our service is not directed at children, and we do not knowingly collect data from users under 13.

11. Changes

We may update this policy from time to time. The "last updated" date above will reflect any material change.

12. Contact

Questions: privacy@zirzibit.com

This document is for general information only and is not legal advice; consult a lawyer for guidance specific to your situation.