Amey-Thakur Metadata stripping
A photograph often carries the exact coordinates where it was taken, the device that took it, and sometimes the owner's name. A document carries authors, revision history, and occasionally deleted text. Users rarely know, and publishing it for them is a privacy failure with real consequences.
Method
- Strip by default on ingest. Opt-in preservation for the cases that need it, because defaults are what protect the users who never read settings (see data-minimization).
- Know what each format hides. Images carry location and device; office documents carry authors, comments, and tracked changes; PDFs carry creation software and sometimes removed content.
- Keep what the product genuinely needs. Orientation must be applied then discarded, and capture time may be needed for sorting. Everything else goes.
- Strip before the file is reachable. Doing it after publication leaves a window where the original was served, and caches may retain it (see cdn-strategy).
- Warn when preserving. If a feature depends on retaining metadata, say so at upload, since users assume stripping.
- Handle documents beyond visible content. Hidden slides, off-canvas text, and revision history are not visible in a viewer and are fully present in the file.
- Verify by re-reading the stored file. Confirming the metadata is actually gone is a cheap test and the only proof.
Boundaries
Stripping removes embedded metadata; the image content itself may still reveal location, which no metadata tool addresses. Some workflows legitimately require metadata, such as photography and forensics, where preservation is the requirement. Stripping cannot recover privacy for files already shared.