Image Compression & Privacy: Why You Shouldn't Upload Private Photos to Online Tools

#imgmin #tinypng #tinyimg

Every day, millions of people drag photos into online compression tools without thinking about where those images actually go. The answer, for most popular tools, is: to someone else's server.

For generic photos this may be acceptable. For private images, it's a risk worth understanding.

Your image is uploaded via HTTPS to the tool's servers (or a third-party CDN)
The image is processed by their algorithm on their hardware
The compressed result is returned to your browser for download
The original and/or processed image is stored temporarily (duration varies by policy)
Depending on the tool, your image data may be logged, analyzed, or used for model training

Most reputable tools delete files within 1–24 hours. But "temporarily stored" still means your image existed on their infrastructure — subject to their security practices, their data residency, and their privacy policy.

Which Images Should You Never Upload?

🛂 Passport & ID photos — Biometric data. Use a local tool.
🏥 Medical images — May be subject to HIPAA or GDPR
🏢 Unreleased product designs — Proprietary IP
📋 Signed contracts & legal documents — Confidential PII
💳 Financial statements — Account numbers, balances
👤 Photos of children — Parental responsibility
🔐 NDA-covered client work — You may be contractually prohibited

Tool-by-Tool Privacy Comparison

Tool	Processing	Uploaded?	Safe for Private Photos
TinyPNG	Server-side	✅ Yes	⚠️ Use with caution
Compressor.io	Server-side	✅ Yes	⚠️ Use with caution
iLoveIMG	Server-side	✅ Yes	⚠️ Use with caution
Squoosh	Browser (WASM)	❌ Never	✅ Safe
ImgMin	Browser (Canvas API)	❌ Never	✅ Safe