What happens to your image.
Your image is processed to find public sources. Completed reports and resized images are saved at public links. Please use images you are comfortable making public.
On this page
At a glance
- Processing. Images are sent to external services for supported provenance checks and source searches.
- Storage. A resized image and completed report are saved in public storage, with no scheduled expiry.
- Access. Report links are unlisted. Anyone with the link can open the report and image.
- Training. SourceTrace does not use submitted images to build training datasets.
To request removal, email hello@sourcetrace.app with the saved report URL. Cached copies may remain temporarily after removal.
Uploads and retention
Uploads up to 4 MB are validated without browser compression. When provenance verification is enabled, the original image, including any metadata, is sent to OpenAI before source searches. AVIF images are converted to PNG for that check. Images may be resized and re-encoded on the server afterwards for search. Do not submit images containing sensitive information.
Completed searches automatically save a resized image copy and the report in public storage on Vercel. This also applies to images resolved from submitted public links and searches stopped by an image provenance check. Saved copies have embedded image metadata removed and have no scheduled expiry. Do not submit private, confidential, sensitive, or unpublished work.
Separate temporary image copies used by search services are still deleted after the search where possible. Saved report images remain until the site owner removes them. Cached copies may remain briefly after deletion.
Public saved reports
Each successfully saved report has an unlisted URL. Anyone with that URL can view the report and its saved image, and the underlying storage URLs are public too. These links are not password protected. Report pages are marked not to be indexed by search engines; this does not make them private. There are no user accounts or private search histories. The site owner can review saved reports and images through the connected Vercel project. For operational quality checks, a short-lived server log may record the report path, likely creator, attribution status, and up to three public source titles and links. The audit event does not include your uploaded image, submitted image URL, or raw IP address. It is visible to people with access to the site's Vercel project logs. To enforce a shared search limit, the app converts the request IP to a keyed hash and keeps that identifier and recent attempt times in private Vercel storage. The raw IP is not saved in this counter. Attempts expire after 24 hours; expired entries are removed when the counter is next updated. Vercel Hobby runtime logs are retained for about one hour. If storage is unavailable or an image could not be retrieved, the result is shown without a saved URL. Refreshing or leaving that page can clear an unsaved result. Reopening a saved report does not run another search. Source previews and profile photos can become unavailable if their original public hosts remove them.
No dataset building
SourceTrace does not use submitted images to imitate an artist's style, build image-generation datasets, or sell or license the images. They are processed to find public sources and prepare the report you requested.
External search processing
When enabled, OpenAI checks supported generation or editing provenance signals. A detected signal stops the source search; an absent signal or unavailable check does not prove an image is human-made. Images and public image URLs are sent to external search services for matching and creator research. Those services process requests under their own privacy and retention terms.
SourceTrace may retrieve public source pages, candidate images, and profile photos to inspect credits and compare accessible images. Credentials remain on the server and are not sent to your browser.
Public previews and analytics
Public source thumbnails and profile images may be temporarily cached for delivery. Basic web analytics are enabled to understand site usage; SourceTrace does not send your submitted image or report contents as custom analytics events. The separate short-lived operational log described above helps the owner review search outcomes.
Public URL fetching
Only HTTP and HTTPS resources are accepted. Private networks, local addresses, embedded credentials, and cloud metadata endpoints are blocked. Redirects, response size, and fetching time are limited.
SourceTrace does not bypass logins, CAPTCHAs, paywalls, or platform access controls, and it does not execute scripts from inspected pages. Some source previews and profile photos will therefore be unavailable.