Security
Your files are yours. imgcanva processes images on your device and never stores them.
Data Privacy
They never leave your browser, with three exceptions. HTML to image sends the web address you type to our server, which renders the page and discards the result after the response. Send to phone uploads a copy encrypted on your device with a key only the QR code holds, deleted within an hour. The meme generator loads its template pictures from Imgflip.
No. imgcanva sets no cookies at all: no tracking, no analytics, no ads, not even for your language, which is part of the page address.
Nobody. Images processed on your device are never uploaded, and Send to phone files are encrypted so that even we cannot open them.
Our commitments
No uploads
Images are opened, edited and saved in your browser.
Minimal data
No accounts, no analytics and no cookies. Our servers keep only what a request needs, for as long as it needs it.
Open building blocks
Image processing uses well-known open-source libraries, listed in our licences.
Product Security
Processing on device
Images are decoded, edited and encoded in your browser with WebAssembly and Web Workers.
Encrypted connection
Every page is served over HTTPS with HSTS.
Strict content policy
A Content Security Policy stops scripts from sending data to other sites.
Yes: ten requests per minute per address, a twenty-second timeout and a block on private network addresses.
We keep no file contents. Our hosting provider keeps standard request logs (address, browser, page and time) for security, and the rate limits hold addresses in memory for up to ten minutes.
As static files from this site, cached by your browser after the first download.
The image processing libraries we use are open source, so anyone can audit them. Our own site code is not public yet.
Internal Security
- No image storage on our servers
- End-to-end encrypted phone hand-offs
- Strict Content Security Policy
- Rate limits on every server feature
- Private-network block on URL capture
- No third-party scripts