Nothing leaves your browser

MediaBastion Web is a static web page. When you add a picture, a video, an audio file or a PDF, it stays inside the browser tab as a JavaScript File object. Every chore, from converting and resizing to removing a background with an AI model, runs on your own computer using WebAssembly and the browser's built-in codecs. There is no upload endpoint on this site. Nothing to send it to.

What this site does download

• The page itself (HTML, CSS, JavaScript and the small metadata, resize and ZIP libraries, under half a megabyte) from winbastion.com.
• Engines, only when a chore needs them, and only from winbastion.com/mediabastion/app/vendor/ and /models/: ImageMagick (14.5 MB) for HEIC, RAW and other formats the browser cannot read and for animated WebP; the AVIF encoder (3.4 MB); the AI runtime (12.9 MB, shared) with the MODNet background-removal model (6.6 MB), the Real-ESRGAN upscaler (2.5 MB) or the Whisper tiny transcription model (43 MB); pdf.js, pdf-lib, the barcode reader and the video engine (each under 2 MB). Anything over 2 MB asks you first and shows its size. Once fetched, the browser keeps them in its cache so the next visit does not fetch them again.
• Nothing else. The adjustments, effects, LUTs, dithering, EXIF date and GPS writing, Content Credentials removal, annotation, redaction, comparison, forensics and scan clean-up are plain JavaScript inside the page and need no download at all. Speech is transcribed by the Whisper model inside your browser; the audio never leaves it.

That is the complete list. The page's Content-Security-Policy header restricts every connection (connect-src, script-src, img-src, worker-src) to this site, so even a bug could not send your files elsewhere. You can verify it yourself: open the browser's developer tools, watch the Network tab while you run a chore, and see that only winbastion.com files are fetched and that nothing is posted.

What this site does not do

• No analytics, no tag manager, no pixels, no fonts from third parties, no CDN scripts.
• No error reporting. If something breaks, it breaks quietly in your tab; there is no crash report to anyone.
• No account, no cookies. The only thing stored is a few preferences in your browser's local storage (light or dark theme, which engines you already approved) and the engine files in the browser cache. Clear site data and they are gone.
• No access to your files beyond the ones you add. When you use "Save into a folder" (Chrome and Edge), the browser asks you to pick the folder and the page writes only the results you see listed.

Metadata and the results

Results are new files that you download; your originals are never modified. "Clean for sharing" tells you exactly what it removed from a picture (location, camera, dates, serial numbers, software, XMP, IPTC, embedded thumbnail, hidden data after the image), and "What is inside this file?" shows what a file gives away before you share it. Conversions that re-encode a picture drop its metadata and say so in the report; choose "Keep dates, camera, location" if you want it carried across.

Offline

After the first visit the page works without a network connection; engines work offline once they have been fetched once. You can add the page to your home screen or install it as an app.

Who

MediaBastion is made by EBITA.AI (the WinBastion product family). The company Privacy Policy is at winbastion.com/privacy.html; the open-source components of this page are listed on the licences page.