Technical overview
How CleanMyPhoto Works: Client-Side Architecture
Last reviewed: September 16, 2026
The core technical philosophy: Zero remote uploads
CleanMyPhoto was engineered with a strict architectural principle: your personal files must never leave your computer or phone. Traditional online utilities upload user files to cloud servers, run backend scripts, and provide download links. This model introduces unacceptable security risks when dealing with personal photos, family pictures, and sensitive documents.
CleanMyPhoto eliminates the server from the media pipeline entirely. The entire application runs as a client-side single page application within your browser sandbox.
Step-by-step processing pipeline
Here is the precise technical process that occurs when you drop a file into CleanMyPhoto:
- • 1. Local File Ingestion: The browser HTML5 Drag and Drop API and File API receive the user-selected File object. Memory pointers are created locally using URL.createObjectURL. No network requests are initiated.
- • 2. Binary Header Parsing: For photos, the lightweight exifr library parses binary TIFF headers, XMP RDF blocks, and IPTC segments. For videos, our custom ISO-BMFF parser walks QuickTime MP4 boxes (ftyp, moov, udta, meta, ilst) in memory using JavaScript DataView.
- • 3. Risk Evaluation: Detected metadata tags are cross-referenced against privacy risk rules. Coordinates, timestamps, serial numbers, and device tags are formatted for clear human review.
- • 4. Clean Image Generation: For photos, the browser decodes the image onto an off-screen HTML5 Canvas element. The canvas is exported to a fresh JPEG Blob at high visual quality (0.94 quality factor). This strips all inherited metadata headers completely.
- • 5. Lossless Video Sanitization: For MP4-family videos, the parser zeroes out recognized metadata atoms (udta, meta, ilst) by replacing them with inert blank filler boxes (free atoms) without touching the video or audio streams.
- • 6. Memory Cleanup: When the user resets the scanner or downloads their clean file, object URLs are immediately revoked using URL.revokeObjectURL to release browser memory.
Verifying client-side execution
You can verify our privacy claims independently. Open your browser Developer Tools (F12 or Command+Option+I), navigate to the Network tab, and drop a photo or video into the tool. You will see zero outbound image uploads or analytics pings during the entire scan and cleaning workflow.