Images in the public optimizer
Selected images are read by your browser and processed in a local worker. The public optimizer does not upload image bytes to a PikoZip processing server. Previews use local object URLs, and ZIP downloads are assembled on your device.
Optimizer retention and clearing
The public optimizer does not provide a server image gallery or saved image history. Results exist in the current page session. Clearing the batch releases the page’s preview URLs and stops its current processing worker. Files you have already downloaded remain in your own download location.
Saved settings and prepared packs
Named optimization profiles store their name and encoding preferences in this browser’s local storage. Profiles do not contain image bytes or a saved image gallery. Remove a profile from Output settings to delete it from this browser. Prepared website packs and image descriptions stay in the current page session and are released when you clear the pack or leave the tool.
Metadata in optimizer outputs
Newly encoded outputs generally remove source metadata, including camera and location tags. If a same-format, same-dimension original is retained because it is smaller, its original metadata is retained too. Keep your own source master for archival and color-critical work.
Website and hosting requests
Your browser requests page assets, images used in the website design, and codec files from the hosting service. Poppins font files are served from this website. These requests expose ordinary connection information to the receiving providers, such as the network address needed to deliver the response. This is different from uploading your selected optimizer image contents.
Administrator sign-in and cookies
Administrators use the configured owner email and password. A successful sign-in sets an essential, signed administrator session cookie that expires after eight hours and is cleared on sign-out. The cookie uses Secure, HttpOnly, and SameSite=Strict settings. Standalone login protection stores keyed hashes of the submitted email address and connecting IP address with attempt counts and window timestamps. Attempts are limited in 15-minute windows; records older than 24 hours are removed when another login attempt runs, rather than by a scheduled deletion job.
Administrative content and media
Pages, articles, settings, drafts, revision history, and administrator-uploaded website images are stored on the server. Revision history includes the editor’s email address and action timestamp. Media records include filenames, alternative text, file type, size, and upload time. These records and uploaded media have no automatic expiry in the current application.
Administrator media uploads are publicly retrievable by their media URLs and may retain embedded metadata because the uploaded bytes are stored as supplied. This media library is separate from images selected in the public optimizer. Administrators should only upload material intended for website publication.
Support requests and replies
The contact form sends your optional name, email address, category, and message to the server. The server stores them with a request reference, status, and creation and update times so the site owner can review and manage the request. The form accepts text only. Please leave out passwords, private images, and other sensitive information.
Submitting the form does not send an automatic email to you or to the owner. The owner reviews requests in the administrator support inbox and may reply manually using the email address you supplied. There is no automatic reply or promised response time.
Support retention and deletion requests
Support requests have no automatic expiry or self-service deletion in the current application. Marking a request resolved changes its status and does not delete its contents. You can ask the owner to remove a request through the contact form; include its reference and the email address used for the request. This submits a request for manual review, rather than deleting the record automatically.
To limit repeated submissions, the server stores a SHA-256 hash of the connecting IP address with a submission count and window timestamp. The limit uses a one-hour window. Each valid submission attempt removes up to 100 expired rate-limit records whose window timestamps are older than 24 hours. Cleanup runs when another submission is attempted, rather than on a schedule; it does not delete support requests.
Current tracking behavior
The current application does not include an advertising tracker, an image-upload analytics pipeline, or an email sign-up form. Search and guide checklists operate within the page. This policy should be reviewed if new account, billing, analytics, or file-storage features are introduced.
Spam protection
Contact requests and owner sign-in use Google reCAPTCHA v3 when it is configured. Google receives a verification token and browser, network and interaction information used to assess abuse. PikoZip verifies the action and score on the server; reCAPTCHA tokens are not stored in the content database. Google’s Privacy Policy and Terms of Service apply.
Learn more
Read the help center for practical questions about processing and downloads, or the usage and limitations page for the current product boundaries. Use the contact form for questions about these data flows.