Privacy
What Tracemute knows about you.
Nothing.
Your photo and video files are processed entirely in your browser, in a Web Worker, on bytes that never leave the page. There is no server endpoint that sees your files. There is no log of what you uploaded because nothing was uploaded.
We don't use cookies. There is no cookie banner because there is nothing to consent to. We don't track sessions, page views, scroll depth, mouse movement, or which buttons you click. We don't have an analytics account anywhere.
What does cross the network
- 1. The pages themselves. HTML, CSS, fonts, and JavaScript come from tracemute.com's static origin. Same source as everyone else's; we don't fingerprint requests.
- 2. The OSM map tile and reverse-geocode lookup — only when you click "Reveal on map".
The GpsCallout on each dossier explicitly names
nominatim.openstreetmap.organdtile.openstreetmap.orgbefore sending anything. Don't click? Nothing goes out. These are the only outbound requests this site is configured to make — the Content Security Policy blocks every other origin.
No third-party scripts. Period.
No Google Analytics. No Tag Manager. No Hotjar. No Intercom. No CDN-hosted React. No Font Awesome. No Cloudflare scripts. No Sentry. No PostHog. No anything. Inspect the Network tab on any page — at idle you'll see zero third-party requests. Open DevTools and search the source for "google", "facebook", "doubleclick" — zero hits.
The CSP in our _headers file enforces this at the browser level. Even if a maintainer accidentally adds a third-party script, the browser refuses to load it.
Hosting
The static site is served from Cloudflare Pages. Cloudflare sees the IP addresses of visitors as part of operating its CDN. We do not request, retain, or log any of that data on our side. Cloudflare's own privacy policy covers their handling; we have no additional cookies, headers, or scripts that would identify you to us.
No accounts, no email collection
We don't have user accounts. We don't have a mailing list. We don't ask for your email. If a future "notify me on v1" form lands, it'll route through a self-hosted endpoint we run ourselves — not Mailchimp, not ConvertKit. We'll update this page when that happens.
Verify in your browser
If any of what's on this page conflicts with what the site actually does, you can see
it directly: open DevTools → Network, drop a file into /clean,
and watch the request log. Zero outbound bytes for the file itself. The same
verification works in private/incognito mode. Report discrepancies to
[email protected].