Privacy policy

1. What RealTag collects

Nothing about your images. RealTag is a static website. There is no account system, no cookie of ours, no local storage of your images, no analytics script, no tracking pixel, no fingerprinting and no server-side log of your activity. The tool is a set of HTML, CSS and JavaScript files served as static assets, plus Google AdSense advertising, which is described in section 4.

2. Where your images go

Nowhere. When you select an image, the browser reads it into memory and hands it to the JavaScript running in the same tab. Parsing, metadata rewriting, noise simulation and encryption all happen there. When you close or refresh the page, the buffer is released by the browser. Images are never transmitted to us or to anybody else, because there is no endpoint that could receive them.

You can verify this yourself: open your browser's network panel while using the tool and observe that no request carries your file.

3. C2PA vault encryption

The optional vault feature encrypts a provenance manifest with AES-256-GCM using a key derived from your passphrase with PBKDF2-SHA256 (200,000 iterations). The passphrase itself is never stored or transmitted. If you forget it, the encrypted manifest cannot be recovered by anyone, including us.

4. Advertising and cookies (Google AdSense)

This site displays advertising supplied by Google AdSense (publisher ID ca-pub-3238112604836539). Loading the ads places third-party cookies and similar technologies in your browser, which Google uses to serve and measure ads, including personalised advertising based on your prior activity across other sites. Google's own use of that information is governed by the Google Ads policies and the Google Privacy & Terms; you can review and change your consent choices at adssettings.google.com.

Your images are never involved. Ad requests are made by the browser for advertising content only. No image, no filename, no metadata and no image-derived value is ever sent to Google or to any advertising party — the file never leaves your device at all.

If you are in the European Economic Area, the United Kingdom or Switzerland, you can decline non-essential advertising cookies through the "Privacy options" link that Google AdSense renders next to every ad, and through adssettings.google.com. Visitors who send a "Do Not Track" or "Global Privacy Control" signal will still receive ads, but they are not personalised for advertising purposes.

5. Hosting and server logs

The site is served as static files by a web host. Like any web host, that provider may keep ordinary request logs such as IP address, timestamp and requested path. Those logs are outside our control and contain no image data, because no image data is ever sent. We do not use them for profiling and we do not combine them with any other data.

6. Third-party links

Our pages link to this domain only. If a future version links out to another service, that service will have its own policy. Any change to the advertising provider will be reflected in this section before it takes effect.

7. Local storage

RealTag stores nothing in your browser between visits. Camera profiles, PRNU seeds and downloaded fingerprints live only in the tab while it is open. Your exported files are saved only where your own browser asks you to save them.

8. Children

RealTag is a general-audience developer and creator tool and does not knowingly collect data from anyone, of any age, because it does not collect data about you or your images at all. The advertising cookies described in section 4 are set by Google, not by us.

9. Changes to this policy

If the policy changes, the updated version will be published on this page with a new date. Because we do not track visitors, we cannot notify anyone directly — the page itself is the notice.

10. Contact

Questions about privacy can be sent to bashigestudio@hotmail.com. See the contact page for details.

Last updated: 27 October 2026.