Guide · photo privacy

What your photos reveal about you

Every digital photo has two layers: the picture everyone sees, and a hidden data block most people have never looked at. That second layer, the metadata, is written automatically by your camera or phone, and it travels with the file wherever the file goes.

The hidden layer, item by item

• 📍 GPS position: modern phones write latitude and longitude (often altitude too) into every shot, precise enough to identify a building. A photo taken at home marks your home.
• 🕐 Timestamps: date and time to the second, revealing when you're at a place (or away from home).
• 📷 Device details: make, model, sometimes lens and firmware. Combined with a serial number, separate photos can be linked to the same camera, and to each other.
• 👤 Names: cameras and editors can embed an owner or author name (EXIF Artist, XMP Creator), typed in once and written into everything since.
• 💻 Editing trail: which software touched the file, and XMP/IPTC blocks that can include captions, keywords and location names added by apps.

Where the data hides, by file type

Metadata isn't one thing in one place; it lives in named blocks that different apps read and write:

• EXIF is the camera's own record: GPS, make and model, exposure, timestamps. It's what people usually mean by "photo metadata".
• XMP and IPTC are editorial blocks that photo software and agencies use for captions, keywords, copyright and creator names, often filled in once in an app's preferences and then stamped onto everything.
• JPEG and HEIC (the two formats phones produce) carry all of the above. PNG and WebP carry less, but still enough to matter. Screenshots are freshly generated and normally carry almost nothing personal.

The practical point: you can't tell from the picture whether a file is carrying a location or a name. You have to look inside, and that takes seconds.

How a leak actually plays out

It's rarely dramatic. You photograph a bike to sell it, standing in your driveway, and post the original file to a small classifieds site that doesn't strip metadata. The listing now quietly contains the GPS point of your front door, readable by anyone who downloads the image and opens its properties. Or you e-mail a "quick snap" of a document to a stranger; the attachment carries the timestamp and the phone model, and, if you've ever set an owner name on the camera, your name. None of it is visible, all of it travels, and once the file is out you can't recall it.

Who strips it for you, and who doesn't

The big social platforms (Facebook, Instagram, X and similar) remove most metadata from the displayed copies of your photos, mainly to save bandwidth and avoid liability. That protection stops the moment your file travels as a file:

• E-mail attachments: sent byte-for-byte as-is.
• Cloud-drive links (Drive, Dropbox, WeTransfer): the recipient downloads your original.
• Marketplaces & classifieds: policies vary; many smaller ones pass files through untouched.
• Forums, blogs and your own website: usually exactly the file you uploaded.
• Messengers: "compressed" sends usually strip metadata, but the send as file/document option keeps everything.

The safe habit is simple: if you're sharing the actual file, clean it first. It takes seconds and costs nothing.

When metadata is your friend

To be fair: metadata isn't evil. Photographers use timestamps and camera settings to organize archives; GPS makes holiday albums map themselves; insurance claims benefit from provable dates. The point isn't "metadata bad": it's that you should decide who gets it, and the default today is that everyone does.

What stripping it does, and doesn't do

Removing metadata rewrites the file's information blocks and leaves the picture untouched: no re-compression, no quality loss, orientation and colour kept so it still displays correctly. What it can't do is un-share a file you've already sent, or scrub a copy someone else has downloaded, so the habit matters more than any one clean-up. It also doesn't change anything visible in the image: a street sign, a house number or a face in the frame is content, not metadata, and stays exactly as photographed. And it isn't a claim of anonymity, metadata is one trail of many, but it's the one that's invisible, automatic, and trivial to remove, which is exactly why it's worth removing.

Three-second checklist before sharing a photo file

• Is this going somewhere public or to someone I don't fully trust?
• Was it taken at home, work, school or another sensitive location?
• Am I sending the file itself (not a social-media post)?

Any "yes" → strip it first. The clean copy shows the identical picture, just without the diary.

The field people worry about, and the one that actually matters

Ask someone what a photo "reveals" and most guess the camera model or the software name — the fields that sound the most technical. In practice those are close to harmless: they narrow a set of anonymous photos to one type of phone, nothing more. The field that actually does the damage is the one people barely register, because it's just a string of decimal numbers: GPS coordinates. Coordinates don't require any correlation or cleverness to read, unlike a serial number that only matters once you have two photos to compare. That mismatch — worrying about the technical-sounding fields, missing the quiet one — is the main reason this page exists as a standalone guide rather than a single line in the metadata remover's FAQ. The second mismatch is timing: people think about metadata when a photo feels sensitive (identity documents, a specific address) and forget about it for the boring ones, but a plant photo taken on a windowsill carries exactly the same GPS precision as anything else. The file doesn't know the photo is boring.

What a photo can say about you

Send someone the raw file instead of a social post and they see your photos exactly as the camera saved them, hidden fields included. People who mail their photos as attachments, rather than posting them, usually send the full metadata along without realising it. GPS coordinates travel with photo files wherever the file itself is sent, not just where it happens to be posted. An email sent with a photo attached as a file, rather than shared through an app, usually keeps every field intact. A street can be pinned down just by photos that seem to show nothing more than a driveway. Some of this location data leaks via photo sharing apps that don't strip it, not only through direct file transfers.

Upload a file to the remover linked above and you can see photo metadata laid out before anything is stripped. A photo of you taken at home can carry that address in its GPS field, accurate to a few metres. Photos of you on a school run or a doorstep carry the same GPS precision as a holiday shot. Most people only need to see photo metadata once to change how they share afterward — a fresh phone photo commonly carries 20 to 60 tags, more than most expect. What does this photo say about where you were? Location, device and timestamp all sit in the file until you check. What does this photo show that a caption never would? A camera's serial number, which can tie separate "anonymous" photos back to the same device once two of them are compared.

"What was hiding in my photo all along, besides the GPS point?" is often the bigger surprise: an editing trail, a caption, or an owner name typed in once and stamped onto every shot since. Is there GPS data on my photo right now? Upload it to the remover linked above and see the exact coordinates before they're removed. Open the remover any time to see photos with their metadata listed before deciding what to strip. Photos you took years ago can still carry the exact GPS point of an old address. What is my picture revealing about my routine, not just my location? A run of photos taken at the same time each day describes a pattern nearly as precisely as a single GPS point does.

Anything else

Check & clean a photo now →

By Sam Ridder — I build and run ShinobiTools on my own hardware, on my own. Who I am.