How “on-device” is implemented
Object URLs instead of multipart POST
When you drop a file, the studio creates a blob URL and paints it in an image element. Export walks that DOM with html2canvas and triggers a download from the resulting blob. There is no collage API that accepts your JPEGs. Technical users can confirm in the Network panel: you should not see the photo payloads going to Convertify4u hosts as the board is built. Analytics or usage pings, if any elsewhere on the site, are not a substitute for “we stored your wedding album.” This spoke exists so that sentence is documented next to the tool, not buried in a legal footer.
What privacy is not
We cannot protect a laptop that is already malware-ridden, a shoulder-surfer, or a screenshot you later drop into Instagram (Instagram will then have the picture). Closing the tab drops the blob URLs; that is also not a secure-erase of your Downloads folder after you save. If the brief is HIPAA-grade document control, you still need organizational policy. What this page offers is narrower and real: Convertify4u is not an extra copy of the shoot.
Compare with “encrypted upload” marketing
Encrypted-in-transit still means a server holds a copy, even briefly. Auto-delete policies are promises about someone else’s disk. Local Canvas skips that class of risk. That is why journalists, clinics assembling a non-diagnostic photo grid, and families who simply do not want a new cloud account all land here. Pair it with the free spoke if the other fear was an email wall, and with the professional spoke if the other fear was a client portal.