Loading…
Loading…
Last updated 23 September 2026. The short version: your photo is processed by your own browser and is never sent to us, so there is nothing for us to store, share or lose.
When you select a photo on this site, the file is read by your browser using the standard File API and decoded into an image in memory. Every subsequent step runs on your device: face landmark detection, background segmentation, cropping, background replacement, JPEG encoding and print sheet layout. The result is written to your downloads folder by the browser.
At no point is the image data placed in a network request. There is no upload endpoint on this site, and no server-side image processing exists to send it to. You can verify this yourself: open your browser's developer tools, switch to the Network tab, and use the editor. You will see the page assets and the machine learning model files download, and no request carrying your image go out.
This is a statement about architecture rather than policy. We are not promising to delete your photo after some period; we never receive it in the first place.
To detect faces and separate you from the background, the tool downloads two machine learning models and a small WebAssembly runtime the first time you use the editor. These are served from public content delivery networks. Requesting them tells that network your IP address and browser user agent, as any file download would, but the request contains no information about you or your photo.
The models are cached by your browser, so subsequent visits load them without further requests.
No account is required and there is no login or stored history of the photos you have made. To unlock a download we ask for an email address. That email is sent with operational metadata about the download (tool, format, file size). Your photo file is never uploaded.
Like most websites, page requests reach our hosting provider's infrastructure. That provider may keep standard access logs (typically IP address, user agent, requested path and timestamp) for security and operations, on their own retention schedule. We do not operate a separate IP-tracking product on top of that.
When configured in our deployment environment, we use Google Analytics 4 and Microsoft Clarity to understand which pages are used and how the product performs. These tools may set first-party cookies or similar storage and collect standard usage data such as pages viewed, device and browser type, approximate location, and (for Clarity) masked session recordings and heatmaps. They do not receive your photo file.
If those environment variables are not set, the analytics scripts are not loaded.
When you unlock a download, the site may send small metadata events to our own API so we can see which tools are used and whether the product is working. Those events can include the email you entered, the tool name, the format or option you picked, output type, approximate file size and dimensions, the original filename (not the image bytes), and the page URL. They never include the photo itself.
If the relevant environment variables are configured, those events are forwarded to a private Discord channel used by the team. If they are not configured, the events are discarded. This is operational feedback, separate from Google Analytics or Clarity.
This site does not set advertising cookies for third-party ad networks. After you unlock a download, your browser may keep the email you entered in session storage so you do not have to retype it on the next download in the same visit; you can clear that through your browser. Analytics cookies or similar storage may be set by Google Analytics or Microsoft Clarity when those services are enabled. Other cookies may be limited to what the browser or hosting platform needs to deliver the page itself.
Emailing info@getnorthpath.com means we hold your message and email address for as long as needed to respond and keep a record of the correspondence. Please do not attach your photo to a support email. We have deliberately built the tool so we never see your photo, and we would prefer to keep it that way; a description of the problem is sufficient.
Links from this site to https://www.getnorthpath.com carry UTM parameters so GetNorthPath knows the visit came from the photo tool. That tells them the source of the referral, not who you are. Once you are on GetNorthPath, that site's own privacy policy applies. If you go on to book a walkthrough or join a waitlist, you will provide contact details to them directly under their terms.
The tool is used to make photos of children, including infants, and that is a normal and intended use. It is not directed at children as users. Since no photo is transmitted to us, using the tool to make a child's passport photo does not result in us holding the image. Metadata events described above may still fire if an editor is used.
Under Canadian privacy law and equivalents such as the GDPR you have rights to access, correct and delete personal information an organisation holds about you. In practice the personal information we are most likely to hold is an email you provided to unlock a download, or an email exchange you initiated, since we hold no photos and no account data. Write to info@getnorthpath.com and we will act on such a request.
If we change this policy we will update the date at the top of the page. Any change that would weaken the core commitment, that your photo is processed on your device and never uploaded, would be a fundamental change to what this tool is, and we would say so prominently rather than quietly editing this page.
This page describes how we handle data. Nothing on this site is legal advice, and the photo specifications we publish are our reading of requirements published by issuing authorities. Those requirements change; confirm them with the authority before you submit.