Every day, millions of people drag photos into online compression tools without thinking about where those images actually go. The answer, for most popular tools, is: to someone else's server.

For generic photos this may be acceptable. For private images, it's a risk worth understanding.

1. Your image is uploaded via HTTPS to the tool's servers (or a third-party CDN)
2. The image is processed by their algorithm on their hardware
3. The compressed result is returned to your browser for download
4. The original and/or processed image is stored temporarily (duration varies by policy)
5. Depending on the tool, your image data may be logged, analyzed, or used for model training

Most reputable tools delete files within 1–24 hours. But "temporarily stored" still means your image existed on their infrastructure — subject to their security practices, their data residency, and their privacy policy.

Which Images Should You Never Upload?

• 🛂 Passport & ID photos — Biometric data. Use a local tool.
• 🏥 Medical images — May be subject to HIPAA or GDPR
• 🏢 Unreleased product designs — Proprietary IP
• 📋 Signed contracts & legal documents — Confidential PII
• 💳 Financial statements — Account numbers, balances
• 👤 Photos of children — Parental responsibility
• 🔐 NDA-covered client work — You may be contractually prohibited

Tool-by-Tool Privacy Comparison

How to Verify a Tool Processes Locally (30 seconds)

You don't have to take anyone's word for it:

1. Open the image compression tool in your browser
2. Open DevTools (F12 / Cmd+Option+I on Mac)
3. Click the Network tab and clear the log
4. Drop an image to compress
5. Watch the Network tab — if your image is sent anywhere, you'll see it here

For browser-only tools like Squoosh or ImgMin, you'll see zero upload requests. Your image never leaves your browser.