Privacy policy

• Your images are never uploaded. There is no endpoint to upload them to.
• There are no accounts, no analytics, no advertising and no cookies.
• Two small values are kept in your own browser: your theme choice and your recent colors.
• The one time a request happens is when you paste an image URL, and it goes to that image's host, not to this site.

What happens to your images

Nothing leaves your device. When you drag in a file, browse for one, paste a screenshot or take a photo, your browser decodes it locally and draws it onto a canvas inside the page you already have open. The tool then reads pixel values back off that canvas. There is no upload endpoint on this site, no storage bucket, and no processing server, because the work does not need one.

You can check this yourself. Open your browser's developer tools, switch to the Network panel, load an image and pick a dozen colors: no request appears. The project also has an end-to-end check that drives the real tool and fails if picking a color ever sends a request.

Because your images are never sent, this site has no copy that could be leaked, sold or handed over.

The one exception: pasting an image URL

The picker accepts the address of an image on the web as well as a file. If you paste a URL, your browser must fetch that address from whoever hosts it, exactly as it would if you opened the link in a tab. That host will see a normal web request from your device, including your IP address and your browser's user-agent string.

That request goes from you to them. It does not pass through this site, and the site never learns which URL you used. If you would rather not make that request at all, download the image first and drop the file in instead.

What is stored in your browser

Two values are written to localStorage, which is storage that lives in your own browser profile and is never sent anywhere:

• icp:theme: whether you chose the light or dark theme, so a reload does not flash the wrong one.
• icp:recent: up to 24 recently picked colors, stored as hex codes so the Recent strip survives a refresh. It holds color codes only, with no image data and no file names.

You can clear the recent colors from the tool itself with the Clear button beside them, and both values disappear if you clear site data for this domain in your browser settings. In private browsing they are discarded when you close the window. If your browser blocks storage entirely, the tool still works and forgets these two preferences.

Cookies, analytics and advertising

There are none. This site sets no cookies and runs no analytics, advertising, social, tracking or fingerprinting scripts. It collects nothing, so it cannot build a profile of you.

The typeface the site uses is served from this domain rather than from a font CDN, so loading a page does not tell a third party that you visited.

Server logs

This site is hosted on Cloudflare. To deliver pages and protect the site from abuse, Cloudflare processes standard request data: the IP address that requested a page, the time, which file was requested and the user-agent string. This site adds no analytics to that data, and it contains no image data, because no image data is ever sent. Cloudflare's privacy policy explains how it handles request data.

Children

This is a general-purpose design tool, not a service aimed at children, and it does not knowingly collect personal information from anyone of any age. Since there are no accounts and no data collection, there is nothing here for a child to hand over.

Your rights

Data-protection law gives you rights to access, correct and delete personal data that a service holds about you. In this case there is nothing to exercise them against: no account exists, no personal data is collected, and the only stored values are the two in your own browser, which you can delete yourself at any time without asking. If you believe that is wrong, write and say so and it will be investigated properly.

Changes to this policy

If a new feature ever changes any of the above, this page will be updated before the feature ships, and the date at the top will change. Images will never be uploaded: the whole tool is built around that rule.

Who runs this site

ExactHex is run by Md. Delwar Hossen, an independent developer, who is responsible for the site and for the request data described above.

Contact

Questions about any of this go to info@exacthex.com. If you need something specific in writing for a security or procurement review, say what you need and you will get a written answer. The contact page has more on what to include.