The latest articles on DEV Community by Suzon Mahmud (@kim_heater_099b08ccb140e1). https://dev.to/kim_heater_099b08ccb140e1 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4192050%2F7e4e0198-0e0e-433b-8af1-7708159c33c5.png https://dev.to/kim_heater_099b08ccb140e1 en Suzon Mahmud Wed, 04 Nov 2026 11:33:38 +0000 https://dev.to/kim_heater_099b08ccb140e1/your-photos-know-where-you-live-what-exif-data-reveals-and-how-to-strip-it-41k8 https://dev.to/kim_heater_099b08ccb140e1/your-photos-know-where-you-live-what-exif-data-reveals-and-how-to-strip-it-41k8 <p>Post a photo of your lunch, and you may have just posted your home address.</p> <p>Not in the caption. Not in the pixels. In the metadata — a block of text your phone quietly writes into every photo it takes. I build privacy tools for a living, and this is still the leak I see most often, because nobody ever looks at it.</p> <h2> What a single photo carries </h2> <p>Open a photo from your phone in a metadata viewer and you'll typically find:</p> <ul> <li> <strong>GPS coordinates</strong> — latitude and longitude of where the photo was taken, often accurate to a few metres</li> <li> <strong>Device make and model</strong> — and sometimes the serial number</li> <li> <strong>Exact timestamp</strong> — date, time, and timezone offset</li> <li> <strong>Software</strong> — the app that edited or exported the file</li> <li> <strong>A thumbnail</strong> — a small embedded preview, which can show the <em>original</em> frame even after you crop the photo</li> </ul> <p>That last one surprises people. Crop yourself out of a group photo, and the thumbnail inside the file may still show you standing there.</p> <h2> "But the platform strips it, right?" </h2> <p>Sometimes. Some social platforms strip EXIF data on upload. Some don't. Some strip it from the feed version but not from the downloadable original. Messaging apps differ again — send a photo "as a document" or file attachment and it often travels with every field intact.</p> <p>The problem with "the platform probably handles it" is that it's a belief, not a test. The only way to know what a file carries is to read the file.</p> <h2> The 30-second check </h2> <p>Before you share a photo anywhere it matters:</p> <ol> <li>Read its metadata first. If you see GPS fields, the file knows where it was taken.</li> <li>Strip the metadata from a <strong>copy</strong> — keep your original, with its dates and organisation, in your own library.</li> <li>Re-read the cleaned copy. A strip you haven't verified is a hope, not a result.</li> </ol> <p>I built <a href="https://privacymetadata.com/" rel="noopener noreferrer">PrivacyMetadata</a> for exactly this workflow — it reads and removes metadata from photos, PDFs, documents, audio and video entirely in your browser, so the file never gets uploaded to a server in the first place. That design choice matters: a privacy tool that asks you to upload your private files to clean them has just moved the problem, not solved it.</p> <h2> The short version </h2> <ul> <li>Metadata is invisible, so it survives every "quick share"</li> <li>GPS is the dangerous field, but device, time and thumbnails leak too</li> <li>Platform stripping is inconsistent — verify, don't assume</li> <li>Clean copies, not your library</li> </ul> <p>Your camera roll is a diary you didn't know you were keeping. Read it before you publish from it.</p> <p><em>Originally published at <a href="https://privacymetadata.com/blog/can-someone-track-you-from-a-photo/" rel="noopener noreferrer">PrivacyMetadata</a>.</em></p> privacy security beginners webdev