Privacy Policy

1. Data Controller

EXIF Scanner is a web tool operated by zirzibit. zirzibit is responsible for applying this policy and for the personal data processing described below. You can reach us at [email protected].

2. What Data We Process

• The photo you upload: the image file itself and any EXIF/XMP/IPTC metadata it contains (e.g. capture date, camera/lens info, GPS location, author/copyright fields, and device serial number if present).
• Connection information: your IP address is processed transiently by our rate-limiting mechanism to prevent abuse. Because the site is served through Cloudflare, Cloudflare also processes connection-level data for security and performance (see Section 6).
• Admin access logs: sensitive actions (viewing/downloading a file) are recorded in an audit log against a one-way hashed identifier, not your real identity.

We don't require an account, we don't ask for your name or email, and your photo is never given a public link.

3. How We Use Your Data

• To read and display the metadata in your uploaded photo and perform the export/cleaning action you request.
• To keep the service secure: preventing abuse, excessive load, and unauthorized access.
• To audit sensitive admin actions and allow investigation of a potential security incident.

Your data is never used for advertising, profiling, or sold to third parties.

4. Legal Basis

Uploading a photo processes it on the basis of your consent, given in order to receive the service you explicitly requested (metadata analysis/export). Security logging and rate limiting rely on our legitimate interest in keeping the service secure and stable.

5. Retention Periods

6. Third-Party Service Providers

• Cloudflare: used for content delivery, DNS, and DDoS/security protection; all requests pass through Cloudflare. Cloudflare is a US-headquartered global provider and relies on Standard Contractual Clauses for international transfers.
• Hetzner Online GmbH: hosts the server our application runs on (Germany/EU).
• OpenStreetMap: only when your photo contains GPS data and you view the location card, the coordinates are sent to OpenStreetMap's servers to render a map. This is opt-in by nature of using the feature; nothing is sent until the map is displayed.
• Resend: used to send zirzibit's own administrator a once-daily aggregate usage summary (counts like analyses and exports performed) to confirm the system is working as expected. This summary carries no filenames, photos, or EXIF content, and it is never sent to you, the visitor.

Your data is never shared with or sold to any other third party.

7. Cookies

No tracking or advertising cookies are used for regular visitors. Only when someone signs into the admin panel is a strictly necessary session cookie (admin_session) set for authentication; it expires after 8 hours or on logout.

8. Security Measures

• All connections are encrypted via HTTPS.
• Uploaded files are validated against their file signature (magic bytes).
• Admin access is protected by rate limiting and timing-safe authentication.
• Sensitive file operations are recorded in an audit log.
• Photos are never retained on our server for more than 24 hours.

9. Your Rights

Depending on your location, you may have the right to know whether we process your data, request information about it, request correction of inaccurate data, request deletion, object to processing, and request portability, under GDPR (EU/EEA) or Turkey's KVKK. Contact [email protected] to exercise these rights. Since photos are automatically deleted within 24 hours in the normal course of operation, most requests are already satisfied by default.

10. Children's Privacy

Our service is not directed at children, and we do not knowingly collect data from users under 13.

11. Changes

We may update this policy from time to time. The "last updated" date above will reflect any material change.

12. Contact

Questions: [email protected]

This document is for general information only and is not legal advice; consult a lawyer for guidance specific to your situation.