Photo privacy: inspect fields, choose a removal policy, recheck the copy

Choose a path from the file in your hand

• Read JPEG GPS — The dedicated reader supports JPEG EXIF only in this release.
• Inspect sharing privacy fields — Read supported categories with stored values hidden by default.
• Remove GPS with limited camera rebuilding — Static JPEG, exact allowlist and explicit whole-container impact.
• Choose metadata categories to remove — Static JPEG/PNG/WebP; embedded ICC can be kept.
• Compare metadata before and after — Value multisets, original sources and reading warnings.
• Read and export metadata — Choose groups and preview JSON or CSV before downloading.

Three reproducible scenes, with real downloadable files

These scenes are defined by the project, not a retention-rate study or a collection of independent photographs. They share a self-authored 4 × 3 JPEG and fictional stored claims. Their value is that the input and expected output are explicit. No real person's location or camera history is published in them.

• Download the synthetic GPS JPEG — Project-authored 4 × 3 image and fictional stored fields, fixture v1. It is not a camera capture or a private person's photograph.
• Download the no-GPS scene — Use it in both readers and compare their different scopes.
• Download the cleaned scene — Compare it with the GPS original and inspect the five retained fields.

Carry one actual file through the workflow

1. Step 1

   Inspect the original

   Use the privacy checker first if you do not know what might be stored. Use the GPS viewer when the question is specifically JPEG coordinates. Save a report only after reviewing its values and inclusion settings.

2. Step 2

   Choose the fields you can afford to lose

   The GPS remover retains a limited camera allowlist but discards descriptions, author/serial fields, MakerNote and whole location-capable containers. The category remover removes selected whole categories. Removing EXIF in that tool also removes orientation, which can change display. Neither operation re-signs Content Credentials.

3. Step 3

   Download and reopen the copy

   Run the removal, read its result, download the output and inspect that exact file again. Compare original and output if you need a retained/missing table. The original file remains unchanged; the sharing app will use whichever file you actually select.

When to stop or change tools

GPS writer support is static JPEG only. The broader remover rejects APNG, animated WebP and multi-picture JPEG rather than silently creating a single-frame output. Oversized, unsupported and unreadable inputs are different from no findings. MakerNote internals and unknown custom storage are not a complete privacy scan.

Review faces, labels, street signs, watermarks and other visible information yourself. A screenshot can lose earlier metadata while still displaying identifying details. A previously shared copy is unaffected when you clean a local file. If the photo came from Instagram, begin with the actual saved image and keep platform claims separate from what you observe locally.

• Inspect an Instagram image you saved — Use an authorized local file; a post URL is not a direct image file.
• Understand the platform evidence boundary — Our documented local exports are not Instagram upload tests.

Sources and reproducible inputs

• Download the synthetic GPS JPEG — Project-authored 4 × 3 image and fictional stored fields, fixture v1. It is not a camera capture or a private person's photograph.
• Eight-photo metadata survival experiment — Original-source attribution and exact local export settings. The originals are Thomas Bresson / CC BY 2.0; the experiment did not upload them to social platforms.
• Machine-readable scene definitions and actual readings — Deterministic input hashes and bounded GPS, metadata and privacy results for all three synthetic scenes.