Privacy

Your photographs

Your browser decodes the original, resizes it and re-encodes it as a JPEG before upload. That re-encoding removes embedded EXIF metadata, including any location data. The original file never leaves your browser.

Know That Bug holds the resized copy only in memory while the request runs. It is never written to disk, put in a URL, sent to analytics or included in application logs. Our in-process copy is discarded when the request finishes.

The resized copy is sent to the Anthropic commercial API to produce the identification. Anthropic says commercial API inputs and outputs are not used to train its models unless the customer explicitly opts in. Its standard API retention is up to 30 days, with stated exceptions for usage-policy enforcement or legal requirements. See Anthropic’s training policy and retention policy.

We keep two things from an identification: a cryptographic hashof the image, and the resulting identification. The hash is a one-way fingerprint — it cannot be turned back into a picture. It lets us return an instant answer if the same photograph is submitted again.

Cookies

We set one cookie, named ktb_s. It is a signed session token with a 12-hour lifetime, and it exists solely to stop the identifier being called automatically by scripts — which would otherwise be an open invoice. It contains no personal information and is not used for tracking or advertising.

Analytics

We use Ahrefs Web Analytics to count visits and see which pages people actually reach. It is cookieless— it sets nothing on your device and does not follow you between sites. It records the page visited, the referring site, and coarse technical details such as country and device type.

We use it because we need to know whether the site is being found at all. We do not use Google Analytics, and we do not run any advertising or profiling script.

What we don’t do

• No accounts, so no names, emails or passwords.
• No advertising cookies and no ad network.
• No cross-site tracking or profiling.
• No selling or sharing of data for advertising.
• No location tracking. We never ask where you are.
• No opt-in to provider model training.

Rate limiting

To keep the identifier available and affordable we count requests per IP address over a rolling window. That count is held in memory, is never written to disk, and is discarded when the service restarts.

Changes

If any of this changes, this page changes with it and will say what changed and why. Most recently: the processor retention wording was clarified on 3 August 2026. See also about and how we identify.