Privacy-first image tools: why we still process in your browser

The single biggest decision we made when building Motionix was that no tool on the site should ever upload your file to our server. There are three reasons we held the line, and they're worth understanding before you trust an image tool with anything private.

What runs client-side

Picture tools used to mean "send your file to a worker, wait, send it back." That pattern has costs:

• Round-trip latency. Even on a fast fiber link, a 200 MB video between your browser and a server takes 10-30 seconds just to transfer.
• Privacy. Once a file leaves your device, you lose control over it. Most services delete it eventually — but "eventually" is doing a lot of work.
• Cost. Server-side processing means GPU servers, egress fees, and scaling headaches. Those costs get passed to users somehow — through ads, subscriptions, or data harvesting.

How browser-based processing works

Modern browsers expose APIs that were previously only available to native apps:

• Canvas API — image resizing, cropping, format conversion, pixel manipulation
• WebGL / WebGPU — GPU-accelerated image processing
• ONNX Runtime Web — run AI models (background removal, object detection) entirely in the browser
• WebCodecs — hardware-accelerated video encoding and decoding

These APIs are built into Chrome, Firefox, Safari, and Edge. No plugins, no downloads, no extensions.

The privacy guarantee

When we say "your file never leaves your device," we mean it technically:

1. The JavaScript code runs in your browser's sandbox.
2. The file is read from your local filesystem via the File API.
3. Processing happens in memory using Canvas, WebGL, or ONNX Runtime.
4. The result is offered as a download via the Blob API.

At no point does fetch() or XMLHttpRequest send your file to our servers. You can verify this by opening your browser's Network tab while using any tool.

The trade-off

Browser-based processing has real limits:

• File size. Browser tabs have memory limits (typically 2-4 GB). A 4 GB video would crash most tabs.
• Speed variance. A MacBook Pro M3 is 10x faster at ONNX inference than a 2018 Android phone.
• Feature gaps. Some tasks (like multi-pass video encoding) are still better on a server.

We're transparent about these limits. Each tool page shows its maximum file size and browser compatibility.

What a privacy-first tool does — and doesn't

"Privacy-first" is an overused label, so it helps to be concrete about what it should and shouldn't mean.

A privacy-first tool does:

• Read your file locally through the File API and process it in the tab's memory.
• Keep every byte of your file on your device — no upload, no server copy, no temporary bucket.
• Work the same whether or not you are signed in, because there is no account to attach your data to.

A privacy-first tool does not:

• Send your file to a server "just for processing" and promise to delete it later.
• Require an email or sign-up before you can use it.
• Depend on a retention policy or a region setting to keep you safe — there is simply no data to retain.

The distinction matters because the moment a file leaves your device, its safety rests on someone else's promises. Local processing removes the promise from the equation entirely.

Verifying the claim yourself

You do not have to take our word for it. Every browser ships a network inspector that shows exactly what leaves the tab:

1. Open Developer Tools (F12, or right-click and choose Inspect) and select the Network tab.
2. Enable Preserve log so nothing scrolls away, then clear the existing entries.
3. Use the tool on a real file — compress it, resize it, remove its background.
4. Scan the request list for any POST or PUT whose payload is roughly the size of your file. There should be none.

You will still see requests for scripts, styles, and any model weights — that is the tool's code, identical for every visitor and containing none of your content. To run the same test against a cloud tool for comparison, see browser-based vs cloud-based image tools.

A checklist for choosing a privacy-first tool

Before trusting any image tool with something sensitive, run down this list:

• Does it upload? Confirm with the Network tab, not the marketing copy.
• Does it require an account? A no-login tool has nothing to link your files to.
• Does it state its limits? Honest tools publish maximum file sizes and browser support instead of pretending there are none.
• Does it work offline? A genuinely local tool keeps running after you disconnect.
• Can you inspect the processing? Client-side code can be read in the browser; server-side code cannot.

Our own tools are built to pass this list — try it on the background remover or the image compressor and watch the Network tab stay quiet. The economics behind that choice are covered in how Motionix stays free.

Frequently Asked Questions

What does "your file never leaves your device" actually mean?

The bytes of your file are read from your disk into the browser tab's memory and processed there. No copy is sent to our servers or any third party. The only thing downloaded is the tool's own code.

Can a website read my files without me knowing?

No. The browser only exposes a file after you explicitly choose it or drag it in, and that access is scoped to the tab you are using. A page cannot silently reach into your disk.

Is local processing less secure than an encrypted upload?

Encryption protects a file in transit and at rest on someone else's server — but the server still decrypts it to process it. Local processing avoids the transfer and the server entirely, so there is nothing in transit and nothing sitting at rest to protect.

Why do some cloud tools feel faster?

Server hardware is fixed and often powerful, so uploads can feel quick on a fast connection. The cost is that your file lands on their infrastructure. On most modern devices, skipping the upload makes local processing just as fast for everyday tasks.

Related reading

• How Motionix stays free — the economics of browser-based tools
• WebCodecs vs ffmpeg.wasm — our video compression architecture