Zero-Knowledge Architecture & Privacy Policy

Effective Date: September 12, 2026. This policy establishes the legal and technical safeguards ensuring that your images, videos, documents, and vectors are never accessed, transferred, stored, or processed by any external server.

0 Server Uploads

Your files remain strictly inside your device's physical RAM.

Zero Cloud Storage

No database records, no cloud buckets, no file retention.

Zero Telemetry Fingerprinting

No third-party tracking cookies or device profiling.

1.Core Principle: Data Privacy by Design (GDPR Article 25)

Article 25 of the General Data Protection Regulation (Regulation (EU) 2016/679) mandates that software services implement technical and organizational measures at the time of architectural design to ensure data protection by default.

WCompress meets and exceeds this standard by removing the server completely from the computational loop:

Files are read into client browser memory using standard JavaScript Blob and ArrayBuffer APIs.

Quantization, transcoding, and minification execute entirely inside browser WebAssembly threads.

Compressed files are saved locally via browser DOM triggers without any network roundtrip.

2.Non-Collection & Non-Transmission of User Files

WCompress does not collect, receive, log, view, or retain any of the following:

User Files & Media: Photos, pictures, videos, PDF documents, vector SVGs, and document text.
Embedded File Metadata: EXIF records, GPS geolocation tags, device serial numbers, camera models, author names, or creation timestamps.
User Identifiers: Names, email addresses, phone numbers, IP addresses, physical locations, or account credentials.

3.Status Under Global Privacy Frameworks

EU / UK GDPR Compliance

Because user data never crosses network boundaries, WCompress does not process personal data on behalf of users. Consequently, no Data Processing Agreement (DPA) is required for corporate or enterprise usage.

California CCPA / CPRA

WCompress does not sell, share, or monetize any consumer personal information. We do not engage in targeted advertising or cross-context behavioral advertising.

HIPAA & Healthcare Compliance

Medical records, patient imaging, and sensitive healthcare PDFs compressed via WCompress remain strictly on the medical professional's local workstation, satisfying HIPAA technical safeguard requirements.

Government & Defense Compliance

Because WCompress can operate in completely air-gapped, offline environments, it is fully compatible with strict defense and public sector security guidelines.

4.Edge Hosting & Static Delivery Infrastructure

WCompress’s static web assets (HTML, JavaScript, CSS, and WebAssembly binaries) are served via Cloudflare Pages global static edge network.

Cloudflare acts solely as a Content Delivery Network (CDN) delivering compiled client application code to your browser. Standard edge network telemetry (e.g., HTTP request headers for DDoS mitigation and edge caching) is handled in accordance with Cloudflare’s strict privacy certifications.

5.Browser Security Headers & Memory Isolation

To guarantee that client-side WebAssembly execution cannot be tampered with by third-party scripts, WCompress enforces strict security headers:

Cross-Origin-Opener-Policy: same-origin (isolates browsing context)
Cross-Origin-Embedder-Policy: require-corp (enables safe SharedArrayBuffer access)
X-Frame-Options: DENY (prevents clickjacking attacks)
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

6.Independent Verification & Inquiries

WCompress is committed to absolute transparency. For technical architecture questions, enterprise privacy audits, or verification inquiries, refer to our comprehensive Architecture Whitepaper.

Your Privacy is Guaranteed by Architecture

Not by promises, but by the mathematical physics of client-side computing.

Back to Compressor