# CreatorPrivacyKit

Strip C2PA Content Credentials, EXIF, GPS, and XMP from images and videos in your browser.

- Live tool: https://creatorprivacykit.com/
- Agent index: https://creatorprivacykit.com/llms.txt
- Last updated: 2026-09-15

## What it is

CreatorPrivacyKit is a free, static, client-side metadata sanitizer for creators. It removes file-level provenance and metadata blocks from files you already control so a sharing copy is less likely to expose location, device identity, authoring details, or signed provenance claims.

Nothing you drop on the page is uploaded to CreatorPrivacyKit. There is no media API, no account, and no server-side processing of your files.

## What it strips

| Signal | What it stores | Where it lives | Why creators strip it |
| --- | --- | --- | --- |
| C2PA / Content Credentials | Signed provenance claims, edit history, tool identity, credential URL | JPEG APP11 / JUMBF, PNG `caBX`, MP4 UUID boxes | Removes the file-level credential from the sharing copy; platforms may still label content from other signals |
| EXIF / GPS | Camera make/model, serial, lens, timestamp, decimal GPS | JPEG APP1 TIFF, PNG eXIf, WebP EXIF chunk, QuickTime `udta` | Keeps home, studio, and device fingerprints out of files you publish or deliver |
| XMP | Lightroom history, contact fields, rights strings, nested C2PA pointers | APP1 XMP, PNG iTXt, ISO `meta` XML | Removes client names, job codes, and software fingerprints from the sharing copy |

## How it works

1. **Local sandbox.** Inspection and sanitization run in the browser’s Canvas and ArrayBuffer memory. There is no upload endpoint and no server-side log of your media.
2. **Images.** The still is decoded, drawn onto a Canvas at native width and height, then exported. PNG is lossless. JPEG and WEBP are re-encoded at high quality (~0.95). Pixel dimensions are unchanged. Source container metadata is not copied.
3. **Video.** MP4 and MOV are walked as ISO-BMFF boxes. Metadata boxes (`udta`, `meta`, C2PA UUID / `c2pa`, leftover `free`) are omitted. Compressed samples in `mdat` are copied, not transcoded.
4. **Export.** Clean blobs download as a ZIP or as individual files. You can rename the batch by date or random digits before saving. Closing the tab discards in-memory blobs.

## Supported formats and limits

- Images: JPG, PNG, WEBP
- Video: MP4, MOV (ISO-BMFF / QuickTime)
- Batch: up to 50 files (files or folders)
- Size: limited by tab memory, not a server quota. Very large 4K masters can exhaust RAM.
- Classic non-ISO QuickTime files may be rejected if they lack a parseable box structure.

## What it does not do

- Invisible pixel watermarks (SynthID-class) live in the raster and are not removed by metadata stripping.
- A third-party platform can still use on-platform generation history, visual classifiers, reports, or other signals.
- It does not decrypt DRM or forge C2PA signatures.
- Re-opening a sanitized file in software that re-attaches Content Credentials on export can put provenance metadata back.

## Why creators use it

- **Provenance and AI labels.** Some platforms publicly use provenance signals such as C2PA for transparency labels. Removing the file-level credential controls what travels with the upload; it does not guarantee reach, ranking, or label outcomes.
- **Raw footage privacy.** Phone stills and video can contain GPS, camera identifiers, timestamps, and software tags.
- **Client-contract residue.** XMP can keep job titles, emails, copyright strings, and authoring details in otherwise normal-looking exports.

## FAQ

**Does any file leave my device?**  
No. Inspection uses FileReader on bounded local slices of the file; the current inspector scans up to the first and last 1MB where applicable. Sanitization uses Canvas and in-memory ArrayBuffers, and JSZip also runs locally.

**Will image quality be preserved?**  
PNG is re-exported losslessly. JPEG and WEBP pay one high-quality Canvas encode. That tradeoff is what ensures source container metadata is not copied. Video `mdat` sample data is copied rather than transcoded.

**Does stripping C2PA guarantee Instagram will not show AI Info?**  
No. It removes the file-level Content Credential from the new sharing copy. Meta and other platforms can use additional signals, so metadata cleanup should not be described as a guaranteed label bypass.

**Is this for files I do not own?**  
No. Only process files you own or are authorized to modify. Follow client disclosure requirements, platform rules, and applicable law.

## Related

- [Instagram AI Info / C2PA guide](https://creatorprivacykit.com/blog/how-to-remove-ai-info-label-instagram.md)
- [Discord image privacy](https://creatorprivacykit.com/blog/discord-image-privacy-exif-metadata.md)
- [X (Twitter) metadata and AI labels](https://creatorprivacykit.com/blog/x-twitter-image-metadata-privacy.md)
- [Telegram send-as-file metadata](https://creatorprivacykit.com/blog/telegram-send-as-file-metadata-privacy.md)
- [WhatsApp HD photo metadata](https://creatorprivacykit.com/blog/whatsapp-hd-photo-metadata-privacy.md)
- [Xiaohongshu AI labels and C2PA](https://creatorprivacykit.com/blog/xiaohongshu-ai-label-c2pa-metadata-guide.md)
- [Privacy policy](https://creatorprivacykit.com/privacy.md)
- [Terms of use](https://creatorprivacykit.com/terms.md)