Last updated: October 2026.

What ImgSquash can see

Remarkably little. The compressor is a JavaScript program your browser downloads alongside the page — like the text you’re reading now. Once loaded it works with the network cable pulled: each image is decoded, re-encoded at the size you picked, and handed back as a download, all inside the tab. There is no upload endpoint in the code and no processing queue on a server — nothing exists for your files to land in.

That goes for single images and the bulk queue alike: compress a folder of visa photos or ID documents and every byte stays on your machine, in browser memory, gone when the tab closes.

What reaches the network

• Page requests. The site is served through Cloudflare, which logs ordinary request metadata — IP address, user agent, timestamp, requested URL — to deliver content, deter abuse and count aggregate traffic. With no accounts and no forms, there is nothing to join those logs to.
• Ad impressions. ImgSquash is free because it shows ads from Google AdSense. When ads load, Google may set or read cookies to measure impressions and — where allowed — personalise what you see. Turn that off in Google’s Ads Settings or block third-party cookies; the compressor works the same either way.
• One usage-count ping. A small cookieless signal from us (page address, referring site, time on page) — the “Usage counts” section on this page describes it.

What we never learn

File names, dimensions, the before-and-after byte counts, the images themselves — none of it leaves the tab. We also don’t run an analytics product that builds profiles; the traffic figures available to us are the host’s aggregate counts plus that ping.

Questions and changes

Privacy questions: hello@photopassport.online. If this policy is revised, the new text replaces this page and the date above moves.

Usage counts

What travels for usage counts is one cookieless ping per page view — page address, the domain of the referring site, the page language and any campaign tag in the link — and a second one when you leave, with the time the page was open.

Our server adds the time, Cloudflare’s country and network-provider readings, a device type (phone, tablet, desktop or bot) inferred from the browser’s user-agent, a rough source category and a bot-filter label. Daily visitors are counted with a code hashed from your IP address, browser, the date and a secret value; it resets each day and the IP address is not stored. No cookies, and nothing about your images — no pixels, file names or sizes — is in it.