Every day, millions of people drag photos into online compression tools without thinking about where those images actually go. The answer, for most popular tools, is: to someone else's server. For generic photos this may be acceptable. For private images, it's a risk you should consciously evaluate.
Most reputable tools delete files within 1–24 hours. But "temporarily stored" still means your image existed on their infrastructure — subject to their security practices, their data residency, and their privacy policy.
| Tool | Processing | Images Uploaded | Retention Policy | Safe for Private Photos |
|---|---|---|---|---|
| TinyPNG | Server-side | Yes (HTTPS) | Deleted after ~1 hour | Use with caution |
| Compressor.io | Server-side | Yes | Deleted after session | Use with caution |
| iLoveIMG | Server-side | Yes | 2 hours (paid: 24 hours) | Use with caution |
| Squoosh | Browser (WASM) | No — local only | Never uploaded | Safe |
| ImgMin | Browser (Canvas API) | No — local only | Never uploaded | Safe |
You don't have to take a tool's word for it. You can verify client-side processing yourself in under 30 seconds:
Under GDPR, images containing identifiable people — faces, names, ID numbers — are considered personal data. Uploading them to a third-party processing service (in any country) technically means you're transferring personal data to a data processor.
This doesn't mean all online tools violate GDPR — reputable tools have Data Processing Agreements and comply with transfer mechanisms like Standard Contractual Clauses. But it does mean:
Tools like ImgMin use the browser's built-in Canvas API — the same technology that powers browser-based games and image editors. Here's the process:
Image object<canvas> element in memoryAt no point does any data leave your browser. The process is fast (sub-1 second for most images), works offline, and requires no server infrastructure — which is also why ImgMin can offer unlimited free compression without the costs that server-side tools must recoup.
TinyPNG uploads your images to their servers and states it deletes them after a short period. Your image data does traverse their infrastructure. For non-sensitive images this is generally fine; for passports, medical images, or confidential documents, use ImgMin or Squoosh instead.
ImgMin and Squoosh both process images entirely in your browser. No data is sent to any server. Verify yourself: open DevTools → Network tab → compress an image → you will see no upload requests.
Using server-side compressors for images containing personal data may raise GDPR compliance questions if servers are outside the EU and you haven't verified their Data Processing Agreement. Browser-only tools (ImgMin, Squoosh) avoid this entirely since data never leaves the user's device.
Zero upload. Zero server. 100% local processing. Your images never leave your device.
Try ImgMin Free →Last updated: April 2026. Privacy policies of third-party tools may change — always review the current policy before uploading sensitive images.