Trust Center
How Remove Metadata Online protects file privacy
Remove Metadata Online is built for short, private file-processing sessions. This page explains the practical controls behind uploads, downloads, indexing, temporary storage, and metadata cleanup.
Temporary by design
Uploaded and processed files are tied to short-lived sessions and are automatically deleted after the configured privacy window. The default product promise is 5 minutes after the download is ready.
No public file storage
Uploaded files are stored outside the public folder. They are not published as static assets and are not meant to be reachable by guessing a public URL.
Private download tokens
Downloads use temporary signed tokens. Download responses use no-store cache headers and X-Robots-Tag noindex, nofollow, noarchive.
Strict upload validation
The app checks extension, file category, MIME type, size limit, and magic bytes. Archives, scripts, executables, and unknown binary files are blocked for safety.
Search engines see pages, not files
Public tool pages and guides are indexable. Admin, API, temporary, processing, and download routes are marked noindex.
Cleanup layers
The app deletes session files automatically and also supports a daily Hestia cron cleanup as a second safety layer for stale temporary files.
What we do not do
- We do not store uploaded files in `/public`.
- We do not expose API keys or external-provider secrets to the browser.
- We do not index download URLs, temporary sessions, admin pages, or API routes.
- We do not extract archive files in this phase, because archives need a separate safe scanning system.
Best practice for users
- Scan the file first if you want to see what metadata exists.
- Use the specialized cleaner for your file type.
- Download the cleaned file promptly.
- Use “Scan cleaned file again” for sensitive files.
- Review visible content, filenames, comments, and tracked changes too.