Privacy Policy

Effective date: 11 August 2026 Last updated: 11 August 2026

SynthCheck (synthcheck.app) is operated by [CONTROLLER NAME], [CONTROLLER ADDRESS]. You can reach us at hello@synthcheck.app.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, [CONTROLLER NAME] is the data controller for the limited processing described in this policy.

1. The short version

SynthCheck is a static website. There is no server that runs our code, no database, and no user accounts. When you check an image, the file is read by JavaScript inside your own browser.

Your image never leaves your device. No copy of it is ever sent to us or to anyone else, and no copy is ever stored anywhere.

We are not, however, going to claim that nothing at all is processed. Two third parties are involved in running the site: our host (Cloudflare) writes ordinary server logs, and our advertising provider (Google) sets cookies if you consent. Both are set out below in full.

2. What we do not collect

This is the most important section, so it comes first.

We do not collect, receive, store, or have any technical means of obtaining:

• Your images. They are parsed in your browser's memory. The file is never uploaded. There is no upload endpoint. You can verify this yourself: open your browser's network tab, run a check, and watch that no request is made. You can also save the page and run it offline with your network disconnected.
• Metadata extracted from your images. The EXIF fields, C2PA manifests, prompts, GPS coordinates and everything else SynthCheck displays exist only on your screen. None of it is transmitted or logged.
• Your name, email address, phone number or postal address. There is no sign-up, no login, no newsletter, and no contact form. Our contact link is a plain mailto: link that opens your own email client. If you choose to email us, you are emailing us directly and we hold that email like any other correspondence.
• Payment details. SynthCheck is free. We take no payments.
• Any account or profile about you. We have nothing to link activity to, because we have no accounts.

We also do not run any AI classifier over your image, and we do not use your images for training anything. SynthCheck only reads what is already written in the file.

3. How image processing actually works

1. You select a file, or drop it onto the page.
2. Your browser hands the file to our JavaScript as a local File object.
3. The script reads the bytes, looks for provenance markers (C2PA, IPTC, XMP, PNG text chunks, EXIF, and generator fingerprints) and renders the result.
4. When you close or reload the tab, that data is gone from memory.

No step in that sequence involves a network request carrying your file.

4. Server logs (Cloudflare)

The site's files are hosted on Cloudflare Pages. Like every web host, Cloudflare's servers record technical information about each request in order to deliver the page and to protect the service.

An IP address is personal data under the GDPR, so we disclose this even though we do not read these logs ourselves and have no interest in them.

• Legal basis (GDPR Art. 6(1)(f)): legitimate interests — operating a website securely and keeping it available.
• Who processes it: Cloudflare, Inc., acting as our hosting provider and processor. See the Cloudflare Privacy Policy.
• Retention: governed by Cloudflare's own retention periods for edge logs, which are short. We do not export, store, or analyse these logs.

5. Analytics

We use, or intend to use, Cloudflare Web Analytics.

• It sets no cookies and writes nothing to your device.

• It does not fingerprint your device or build a cross-site profile.

• It records aggregate page-level information: page views, referring site, country, browser type and device type.

• Legal basis (GDPR Art. 6(1)(f)): legitimate interests — understanding at a basic level which pages are used, so we can improve them. Because the tool is cookieless and stores no identifier on your device, no separate consent is required for it under the ePrivacy rules on terminal-equipment access.

Microsoft Clarity

We also use Microsoft Clarity, a product-analytics tool that records how pages are used: clicks, scrolling, mouse movement, and a replay of the page as it appeared on screen.

• It sets cookies and assigns a random session identifier.
• It runs only after you accept on the consent banner. Reject, and its script is never loaded at all — not blocked afterwards, simply never fetched.
• Legal basis (GDPR Art. 6(1)(a)): your consent. You can withdraw it at any time through Cookie settings in the footer.
• Microsoft acts as an independent controller for the data it collects. See the Microsoft Privacy Statement.

What Clarity cannot see. The panel that displays your analysis results is excluded from recording at the markup level. That panel is where your file name, camera make and serial number, capture timestamp and GPS coordinates appear, and none of it is captured in a session replay. The image itself was never uploaded in the first place — see section 3.

If we adopt any further analytics product, this policy is updated before that product goes live, not after.

6. Advertising (Google AdSense)

SynthCheck is free and is funded by advertising. We serve ads through Google AdSense.

Google and its advertising partners are independent controllers for the data they process through the ad tags. They may:

• set and read cookies or similar identifiers in your browser;
• collect your IP address, user agent and the pages you view on this site;
• use that data to select ads, measure ad performance, and limit how often you see the same ad;
• use it for personalised advertising, which may combine information about you gathered across other sites and services.

How consent works

• If you are in the European Economic Area, the United Kingdom, or Switzerland, we ask for your consent before any advertising cookie is set. Until you make a choice, no advertising or measurement cookie is set. This is handled by a consent management platform certified under Google's requirements, using the IAB Transparency and Consent Framework (TCF v2.2).

• You can accept all, reject all, or open the detailed settings and choose per purpose and per vendor. Rejecting is as easy as accepting.

• If you reject, ads may still be shown but they will be non-personalised: selected on the basis of the page content and coarse location rather than a profile of you. Non-personalised ads still require limited processing (including frequency capping and fraud prevention), which Google carries out on its own legal basis.

• Outside those regions, ads may be personalised by default where local law permits. You can still change your choice at any time, as described in section 9.

• Legal basis (GDPR Art. 6(1)(a)): your consent, for storing and reading advertising cookies and for personalised advertising.

• Further reading: How Google uses information from sites that use its services and the Google Privacy Policy.

We do not receive the personal data that Google collects through these tags. We see only aggregate revenue and performance reports in our AdSense dashboard.

7. Local storage on your device

SynthCheck writes exactly two values to your browser's localStorage. Both stay on your device. Neither is ever transmitted to us or to anyone else, and neither is a tracking identifier.

You can delete both at any time by clearing site data for synthcheck.app in your browser settings. Nothing breaks; the site just forgets your theme and asks about ads again.

Note that the consent management platform and Google may set their own cookies once you have consented. Those are described in section 6 and in our Cookie Notice.

8. Who your data goes to

We have no data of yours to share, sell, or transfer. There is no mailing list, no CRM, and no data broker relationship.

The only third parties involved in the operation of the site are:

We may disclose information if we are legally required to do so, but in practice we hold almost nothing that could be disclosed.

9. Changing or withdrawing your consent

You can change your advertising consent at any time:

• Use the "Cookie settings" link in the site footer. This reopens the consent panel; your new choice replaces the old one immediately.
• Or clear site data for synthcheck.app in your browser, which removes the stored choice entirely and causes the banner to appear again.

Withdrawing consent is as easy as giving it, and does not affect the lawfulness of processing carried out before you withdrew it.

You can also control advertising directly at Google, independently of us, at Google Ad Settings and youradchoices.com / youronlinechoices.eu.

10. Your rights under the GDPR and UK GDPR

If you are in the EEA or the UK, you have the right to:

• Access the personal data held about you;
• Rectify inaccurate data;
• Erase data ("right to be forgotten");
• Restrict processing;
• Object to processing based on legitimate interests, including on grounds relating to your particular situation;
• Data portability — receive data you provided in a structured, machine-readable format;
• Withdraw consent at any time, where processing is based on consent;
• Complain to a supervisory authority.

An honest word about how these work here. We do not hold an identifiable record of you. There is no account, no email list and no log we control. If you send us an access or erasure request, in almost every case the truthful answer will be that we hold no personal data about you at all, and there is nothing for us to return or delete. We will tell you that clearly rather than pretending to run a search.

The processing that does exist sits with our providers. To exercise rights over it:

• Server logs: contact Cloudflare, or contact us at hello@synthcheck.app and we will pass the request on.
• Advertising data: contact Google, which acts as an independent controller for it. Google's tools are linked in section 9.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

Complaints. You can complain to your national data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU, it is the authority in the country where you live, work, or where you believe the issue occurred; the list is at edpb.europa.eu. We would appreciate the chance to resolve it first, but you do not have to come to us before going to a regulator.

11. California and other US state privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you rights over personal information.

Categories we or our providers process: identifiers (IP address), internet or network activity (pages viewed, referrer, user agent), and coarse geolocation inferred from IP. We do not process sensitive personal information, biometric data, or the contents of your images.

Sale and sharing. We do not sell personal information for money. However, personalised advertising through Google AdSense may amount to a "sale" or "sharing" for cross-context behavioural advertising as those terms are defined in the CPRA. We treat it as such rather than argue the point.

Your rights: to know, to access, to delete, to correct, to opt out of sale or sharing, to limit the use of sensitive personal information (not applicable — we process none), and not to be discriminated against for exercising any of them.

How to opt out: use the "Cookie settings" or "Do Not Sell or Share My Personal Information" link in the site footer and reject advertising cookies. We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out request.

Residents of other US states with comparable laws (including Colorado, Connecticut, Virginia, Utah, Texas and Oregon) may exercise equivalent rights through the same controls.

12. International transfers

Cloudflare and Google are US-headquartered companies operating global infrastructure. Processing your request may therefore involve a transfer of data outside the EEA or the UK.

These transfers rely on:

• the European Commission's adequacy decision for the EU-US Data Privacy Framework (and the UK Extension to it), where the recipient is certified under that framework; and
• Standard Contractual Clauses, with the UK Addendum where relevant, in any case where the framework does not apply.

Details are published by each provider in their own privacy documentation.

13. Children

SynthCheck is a general-purpose utility. It is not directed at children, and we do not knowingly collect personal data from children under 16 (under 13 in the United States).

We do not treat the site as child-directed content for advertising purposes. If you believe a child has provided personal data to us by emailing us, write to hello@synthcheck.app and we will delete that correspondence.

14. Retention

We hold no personal data of our own, so we have nothing to retain. Retention of server logs is set by Cloudflare and is short. Retention of advertising data is set by Google and described in its privacy policy. Your two localStorage values persist on your own device until you clear them.

15. Security

The site is served over HTTPS. Because it is static and has no database, no server-side code and no stored user data, there is no store of personal information that could be breached at our end. That is a design decision, not an accident.

No method of transmission over the internet is completely secure, and we cannot guarantee the security of third-party infrastructure.

16. External links

SynthCheck links to third-party resources, including Google's SynthID Detector and the Content Authenticity Initiative's verification tools. Once you follow such a link, you are on someone else's site under their privacy policy. We have no control over what they do.

17. Changes to this policy

We may update this policy when the site changes — for example if we add a feature, change host, or change advertising provider. The "last updated" date at the top always reflects the current version.

If a change materially affects how your personal data is handled, we will make it obvious on the site, and where the change concerns consent we will ask you again rather than assume your earlier choice still applies.

18. Contact

Questions about this policy, or about privacy generally: hello@synthcheck.app.

Postal address: [CONTROLLER NAME], [CONTROLLER ADDRESS].

We have not appointed a Data Protection Officer, because the scale and nature of our processing does not meet the threshold in GDPR Article 37. Requests go to the address above.

Note on this document

This policy is a template. It was drafted specifically for a website with the technical characteristics described above: a fully client-side static site with no backend, no image storage and no user accounts, hosted on Cloudflare Pages, serving Google AdSense advertising, cookieless Cloudflare Web Analytics, and consent-gated Microsoft Clarity.

It is not legal advice and no lawyer-client relationship arises from reading it. It has not been reviewed by a qualified lawyer, and it does not account for the specific circumstances, jurisdiction, or regulatory obligations of the operator.

Before publishing, have this reviewed by a qualified lawyer in the operator's jurisdiction, and confirm that every factual statement in it still matches how the site actually works. If any technical detail changes — a new third-party script, an analytics change, a contact form, anything server-side — this document must be revised before that change goes live.