Privacy Policy & Chain of Custody
Last updated: March 2026
Zero Cloud Upload & Ingestion Guarantee
OverlayCheck is engineered on a strict zero-knowledge architecture. All 12 forensic modules—including EXIF scrubbing, Error Level Analysis, steganographic bit-plane slicing, binary file carving, PNG chunk bruteforcing, and pixel XOR math—execute entirely within your device's local browser memory. No images, extracted strings, carved archives, or cryptographic keys are ever transmitted across a network.
1. Data We Do NOT Collect
Because our entire platform operates strictly client-side using JavaScript, Web Workers, HTML5 Canvas, and TypedArrays, we do not ingest, log, or transmit:
- Source Imagery & Files: Uploaded images remain exclusively in local browser RAM.
- Extracted Strings & CTF Flags: Secret messages, LSB strings, and carved payloads are processed volatilely in client memory and discarded on page close.
- Geographical & Device Metadata: Extracted GPS coordinates, altitudes, camera serial numbers, and device models are never transmitted.
- Cryptographic Hashes & Queries: SHA-256 and perceptual pHash computations happen in-memory via the Web Crypto API.
- User Identity & Accounts: No user registration, accounts, or tracking cookies exist.
- Telemetry & Session Recording: We do not log keystrokes, sliders, or image processing activities.
2. Client-Side Execution Across All 12 Modules
To ensure complete forensic transparency for legal examiners, OSINT investigators, and security engineers, here is how our engines handle your files:
Metadata & EXIF Scrubber
Direct binary segment slicing strips APP1, APP13, and XMP chunks from raw Uint8Arrays without recompressing pixel streams.
Error Level Analysis (ELA)
Recompresses image frames to offscreen canvas elements at variable quantization levels, subtracting RGB deltas locally.
Steganography & LSB Slicer
Bitwise AND/OR operations parse 8 bit planes (Bit 0 to Bit 7) in RGBA typed arrays and scan strings matching ASCII ranges.
Binary File Carver
Scans container EOF delimiters (e.g., JPEG FF D9) via DataView and carves trailing ZIP/PDF byte ranges into local Blobs.
PNG IHDR & CRC32 Bruteforce
Computes CRC32 checksums over chunk data permutations in local memory loops without transmitting any PNG dimensions.
Pixel Flood & DoS Auditor
Inspects dimensions purely from raw header markers via DataView without allocating pixel memory, preventing browser crashes.
3. Local Storage (localStorage)
We store only non-sensitive interface preferences in your browser's standard localStorage (such as your chosen Light/Dark theme preference). We never store photo thumbnails, hashes, or analysis results in persistent browser storage.
4. Contact Information
If you have questions or inquiries regarding our zero-knowledge architecture and chain of custody standards, please reach our desk: