Blog
· Privacy · 3 min read

What tmp0 removes from your files, and what stays

Photos and PDFs carry more than their content: where you were, which phone you used, who wrote the document. We remove some of it before a file is stored. This is the exact list, including the gaps.

A photo carries more than the picture. Many cameras write the time it was taken, the phone model and often the GPS position into the file, and a PDF remembers who wrote it and in which program. Nobody sees any of that when they open the file, which is exactly why it gets shared by accident.

So for files that tmp0 can read, we remove part of it before the file is stored. "Part" is the honest word. Here is the exact list.

What is removed

  • JPEG photos: the EXIF block, which is where the GPS position, the camera or phone model and the time of the shot live. We remove that block and leave the picture itself alone.
  • PDFs: author, title, subject, keywords, the program that created the file, both dates, and the XMP block some programs add. The one field we fill in ourselves is the producer, which now reads tmp0.cc.

The copy we store is no longer byte for byte the file you sent, so its checksum differs from the one on your disk.

What is not removed

  • PNG, GIF, WebP, BMP and TIFF. Taking these apart means decoding and re-encoding them, which costs a lot of processor time, so we skip them. The reasoning was that they rarely carry a location. That holds less well than we'd like: WebP and TIFF can carry EXIF too.
  • Everything else. HEIC, the format many phones save photos in by default, is not handled. Neither are video, audio, Word or Excel files and archives. A ZIP full of photos keeps the EXIF of every photo in it.
  • Large files. Stripping stops at 25 MB for any file and at 10 MB for PDFs. Bigger uploads are streamed to disk as they are.
  • Anything inside the content. A name written on a page, the author of a PDF comment, a street sign in the background: that is content, not metadata, and we have no business changing it.
  • The file name and size. The name stays as you chose it and is visible to the server in every mode. The size is not padded either, and a size can be telling by itself.

It is also best effort. If removal fails, or all of the slots for it stay busy for 30 seconds, the file is stored as it arrived instead of being refused. Nothing in the response tells you when that happens.

Where nothing is removed at all

End-to-end encrypted files and direct transfers. In both, the server never sees the file, so it can't strip anything, and your browser doesn't do it either. The metadata is still inside, and everyone who can open the file sees all of it. The strictest privacy modes protect the file in transit and at rest, not what the file says about you.

If the file matters

Remove the metadata yourself before you upload it, and look at the result. On Windows, right-click the file, choose Properties, then Details, then "Remove Properties and Personal Information". With ExifTool, exiftool -all= photo.jpg clears a photo. Neither replaces looking at the picture and asking what else it shows.

We would rather tell you where the gaps are than have you find them.