How browser image processing works, and what privacy it actually gives you

When you choose a file, the browser hands the page a reference to it. The page reads the bytes into memory, decodes them into a bitmap, draws that bitmap onto an HTML canvas at the size you asked for, and asks the canvas to encode a new image.

Every one of those steps runs on your device, in the tab. No network request carries the image, because none is made. Closing the tab discards everything.

It removes the class of risk that comes from a server holding your photograph: a breach of that server, a retention policy you did not read, or a resale of the data. There is no copy on our side to leak, because there is no copy.

It also means the tool keeps working with no connection once the page has loaded.

It is not anonymity. The site is served over the network like any other, so the request for the page itself is visible to your network and to the hosting provider.

It does not cover third-party scripts in general. Where analytics or advertising scripts are present on a page, they see ordinary page-visit information — the page you are on, the referrer, your approximate region from your IP address. They do not see your image, because your image never enters a network request.

It does not verify your photo will be accepted. The tool matches dimensions and file size. Head position, expression, background and lighting are judged by the portal or by a human.