image_privacy_scrubber #

Offline Flutter package that helps apps inspect and remove privacy-sensitive image metadata before images are uploaded, shared, saved, or sent.

It works completely offline. It never uploads image data, never makes network requests, never requires API keys or a backend, and never silently retains copies of the user's image.

Version 1 removes metadata only. Visible content inside pixels — faces, names, document numbers, addresses, number plates — is not altered.

Supported platforms #

Byte and XFile APIs work on every platform, including Web.
File-path APIs (inspectFile / scrubFile) require dart:io and are unavailable on Web.

Supported formats #

What gets removed (defaults) #

Privacy-first ScrubOptions defaults remove:

• EXIF
• GPS (detected via EXIF TIFF GPS IFD pointer — not string search)
• XMP
• IPTC / Photoshop APP13
• JPEG comments
• Unknown application (APPn) metadata
• PNG eXIf, tEXt / zTXt / iTXt, tIME

Preserved where present:

• JPEG quantization/Huffman tables, SOF dimensions, SOS/scan/EOI, ICC profiles
• PNG IHDR, PLTE, IDAT, IEND, transparency/color-profile structural chunks

What does not get removed #

• Faces, text, IDs, addresses, plates, or other visible pixel content
• Image pixels themselves (v1 does not re-encode JPEG/PNG scan/IDAT data)
• Formats without a scrubber implementation (returns a clear unsupported result)

Installation #

dependencies:
  image_privacy_scrubber: ^0.1.0

flutter pub get

Usage #

Inspect bytes #

import 'package:image_privacy_scrubber/image_privacy_scrubber.dart';

final report = ImagePrivacyScrubber.inspectBytes(bytes);

print(report.format); // ImageFormat.jpeg
print(report.hasSensitiveMetadata);
for (final item in report.items) {
  print('${item.kind}: ${item.label}');
}

Sensitive values (for example raw GPS diagnostics) are not included by default:

final diagnostic = ImagePrivacyScrubber.inspectBytes(
  bytes,
  includeSensitiveValues: true,
);

Scrub bytes #

final result = ImagePrivacyScrubber.scrubBytes(
  bytes,
  options: const ScrubOptions(), // privacy-first defaults
);

// result.bytes — cleaned copy (input unchanged)
// result.removed / result.retained
// result.pixelsReencoded == false for JPEG/PNG v1

XFile (picker / camera / Web) #

import 'package:cross_file/cross_file.dart';

final report = await ImagePrivacyScrubber.inspectXFile(xFile);
final result = await ImagePrivacyScrubber.scrubXFile(xFile);

File copy (native / desktop only) #

final result = await ImagePrivacyScrubber.scrubFile(
  inputPath: '/path/in.jpg',
  outputPath: '/path/out.jpg',
);

On Web this throws FileOperationUnsupportedException. Use bytes/XFile instead.

Privacy & security promises #

• Fully offline processing
• No analytics, upload, or backend SDKs
• Input Uint8List is never mutated
• GPS coordinates are not logged by default
• Docs avoid absolute claims such as “tamper-proof”, “fully anonymous”, or “removes all sensitive information”

Limitations #

• Metadata privacy only in v1
• Full scrub support is JPEG + PNG
• HEIC/WebP/GIF/TIFF: detect or return unsupported — files are never corrupted to pretend success
• Surgical rewrite of EXIF while keeping non-GPS tags is not offered; removing GPS removes the EXIF APP1 segment when GPS is present

Example app #

See example/ for a simple offline pick → inspect → scrub → save flow, including the disclaimer:

Metadata removed. Visible information inside the image, such as faces, text, IDs, and addresses, is not altered.

Roadmap #

• HEIC/HEIF metadata support
• WebP metadata support
• Optional integrations for visible-content redaction (separate, explicit APIs)
• Image quality / integrity checks after scrub
• Exportable metadata privacy reports

Contributing #

Issues and PRs are welcome. Please keep the package offline-only, avoid adding network/analytics dependencies, and add tests for parser/scrubber changes.

License #

MIT