Nothing leaves your browser, and here is exactly what that means

The summary

• Your photo is never uploaded. It is read locally with the browser’s own File API and drawn to a canvas on your device.
• There is no account and no sign-up. Nothing identifies you to this site.
• The last photo you opened stays in your own browser, so that reloading the page or moving to the play view does not lose it. It is on your disk, not on a server. Section two explains how to remove it.
• This site sets no cookies of its own, and no advertising or tracking cookies today.
• The only third party is Cloudflare, which serves the site and counts visits in aggregate. Section three and four cover what that means.

Where your photo goes

When you choose a file, the browser reads it into memory on your machine. The crop, the grid, the cut lines and the print sheet are all computed there, by JavaScript served from this domain. No request carries the image anywhere: you can confirm this yourself by opening your browser’s developer tools, switching to the Network tab, and loading a photo — every request in that list is for a font, a stylesheet, a script or an image this site already ships.

One thing is stored, and it is stored by you rather than by us. So that a page reload, or the trip from the generator to the play view, does not throw away the photo you just chose, the site keeps the most recent one in the browser’s own local database — IndexedDB, database name puzzleduo, one entry keyed pf:last. It never leaves your device. It is not synced, not backed up to us, and not readable by any other website, because browsers do not allow one origin to read another’s storage.

If the browser refuses storage — private mode, or a policy that blocks IndexedDB — the generator still works. It simply forgets your photo on the next page load. Nothing is written anywhere else as a fallback.

What the server sees

The pages are static files served by Cloudflare. Serving a file means receiving a request, and a request carries the usual things: your IP address, your browser’s user agent string, the page you asked for, and the time you asked for it. Cloudflare processes this to deliver the page and to keep the service running, and retains operational logs under its own policies. This site has no application server, no database and no login, so there is nothing here that joins those requests to a person.

This site also sends a small set of security headers that stop other sites from framing these pages, and a Content Security Policy that blocks scripts from any origin other than this one. Those headers affect what your browser will run; they do not collect anything.

Analytics

Visits are counted with Cloudflare Web Analytics. It is deliberately not Google Analytics, and the difference is worth stating plainly:

• It sets no cookies and stores nothing in your browser.
• It does not build a profile of you and does not follow you to other sites.
• What it reports is aggregate: page views, referrers, country, browser, and Core Web Vitals timings.

Two honest caveats. Content blockers — uBlock Origin, Brave, DuckDuckGo’s extension and others — block the analytics script, and Cloudflare acknowledges this openly in its own documentation. So the numbers here are lower than reality, and they are used to see which guides are worth writing, not to make claims about audience size. Second, the measurement is a JavaScript request; if you block it, the site works exactly the same.

Cookies

This site sets no cookies. Not for sessions, not for preferences, not for advertising. There is no cookie banner on this page because there is nothing to consent to. If that changes, this section changes first, and the date at the top of the page changes with it.

Advertising

This site displays no third-party advertising at the time of writing. It is free to use and has no paid tier, no subscription and no upsell.

If advertising is introduced in future, it would be served by Google AdSense, and the following would then apply and would be published here before any ad was served:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of third-party vendors’ use of cookies for personalised advertising at aboutads.info.

Advertising would never affect the print output: no ad script has any access to a photo you have loaded, because the photo is never in a network request for a script to see.

Deleting your data

Under the GDPR, the UK GDPR and the CCPA you have rights over personal data held about you, including access, correction, deletion and objection. In practice, on this site those rights are unusual to exercise, because there is nothing to look up: no account, no email address, no profile, no purchase record. The only data that exists is the one photo in your browser’s local database, which you delete yourself in your browser settings, and aggregate visit counts, which contain nothing that identifies anyone.

This site does not knowingly collect anything from children, and there is nothing to collect. A child can use the generator, and the result is a file on the family printer.

Changes to this page

The date at the top is the date of the last substantive change. When a change affects what is stored or who receives it, it is described here rather than edited silently — the previous wording is replaced, and the new behaviour is stated in the same place. There is no mailing list to notify, which is a consequence of collecting no addresses.

Contact

Questions about any of the above, or a correction to something stated here: kuizi@puzzleduo.com. There is more on what is and is not answered on the contact page, and on who maintains the site on the about page.