Privacy··7 min read

What Your Photos Say About You: EXIF, GPS and When to Strip It

Every photo carries a hidden record: where it was taken, when, on what device, sometimes down to the serial number. Here is what is actually in there, who can read it, and the simplest ways to remove it.

You photograph a desk to sell a monitor online. The picture shows a monitor. The file also records the coordinates of your home to within a few metres, the exact minute you took it, and which phone you own.

This is EXIF metadata. It is genuinely useful — it is how your photo library sorts by date and place, and how editing software knows which way is up. It is also the part of a photo people forget they are publishing.

What is actually stored

EXIF (Exchangeable Image File Format) is a block of key-value data written into the file alongside the pixels. Typical contents:

  • GPS coordinates — latitude, longitude, often altitude and compass heading. Accurate to a few metres outdoors.
  • Timestamp — capture time to the second, sometimes with time zone.
  • Device — make and model, lens, and on many cameras the body serial number.
  • Capture settings — ISO, aperture, shutter speed, focal length, flash.
  • Software trail — which app last wrote the file, and often an edit history.
  • Orientation — the flag that tells a viewer which way to rotate the image.

Some formats carry more. Photos from phones can include depth maps and, on Apple devices, references to the motion component of a Live Photo. Scanners and screenshot tools write their own fields.

Who can read it

Anyone who has the file. No special tooling is required — the operating system's file inspector shows most of it, and free viewers show the rest. If you email a photo, attach it to a ticket, or upload it to a forum that stores originals, the metadata travels with it.

The common assumption that "social media strips it anyway" is only half true. Large platforms usually do re-encode uploads and drop EXIF from the public copy — but the original you uploaded is still what they received, and behaviour varies by platform, by upload path, and over time. Messaging apps that send "as a document" rather than "as a photo" typically preserve the file byte for byte. Marketplace listings, forums, wikis, self-hosted galleries and file-sharing links frequently serve the untouched original.

When it matters

  • Selling something from home. Marketplace photos with GPS publish your address to every browser of the listing.
  • Photographing children. A school run, a house, a routine — location plus timestamp across several photos describes a pattern.
  • Anything anonymous. A device serial number links every photo you have ever published from that camera, including the ones under your real name.
  • Journalism, activism, whistleblowing. The metadata can identify a source or a location the content itself carefully does not.
  • Business documents. Photographed contracts and whiteboards record where and when — occasionally contradicting what a document claims.

Equally, there are times to keep it. Your own photo library is far more useful with dates and places intact, insurance and legal evidence is stronger with an unbroken metadata trail, and photographers rely on capture settings to learn from their own work. Strip for publication, keep for the archive.

How to remove it

There are three practical routes.

1. Operating system tools. Windows offers "Remove Properties and Personal Information" in a file's Properties dialog. macOS can drop location data when exporting from Photos. Both are fine for one file and tedious for forty.

2. Turn it off at the source. Denying your camera app location permission stops GPS being written in the first place. This is the strongest option, and the one most people never change. It does not help with photos already taken.

3. Re-encode the image. Any operation that decodes a picture and writes a fresh file leaves the metadata behind, because only the pixels are carried across. This is a side effect of how image processing works rather than a special privacy feature — but it is reliable and it handles a whole batch at once.

That is what happens in AinnoBox. Every image tool here decodes your picture, redraws it onto a canvas and encodes a new file, so Convert, Compress, Resize, Crop and HEIC to JPG all produce output with no EXIF block — no GPS, no serial number, no timestamp. Running a batch through Resize at their existing dimensions is a quick way to clean a folder.

The tool you use to strip it also sees it

There is an obvious problem with uploading photos to a website in order to remove the coordinates of your home from them: you have just sent that website the coordinates of your home. The upload happens before the stripping does.

This is the specific reason AinnoBox processes files in the page rather than on a server. Your photo is decoded, redrawn and re-encoded by code running in your own browser tab; no request carries the file anywhere. You can confirm it — open your browser's network panel, process an image, and watch for a request that never appears. Our How It Works page walks through the check.

A short checklist

  • Turn off location for your camera app unless you actively want geotagged photos.
  • Before posting anything publicly from home, re-encode it — resize, convert or compress.
  • Keep originals with metadata in your own archive; publish the cleaned copies.
  • Do not assume the receiving platform strips anything. Some do, some do not, and that changes.
  • Remember that stripping EXIF does not anonymise the image itself — visible reflections, street signs, and window views are metadata of a different kind.

Related reading

Continue reading