In our tested workflow, opening a local PSD and editing Chinese text did not send the image or its text to an image-processing server. The page still requested engine files, fonts and performance telemetry. Support attachments are uploaded only when you explicitly submit them; local editing is not a claim of zero network traffic.
What we actually observed
| Request group | Purpose | Observation |
|---|---|---|
| photocraft.pics engine and site assets | Load JavaScript, WebAssembly and fonts | GET requests for code/assets |
| Google Fonts | Website interface typography | External CSS/font requests |
| Cloudflare /cdn-cgi/rum | Performance measurements | POST timing/page metadata; no test file/text found in inspected payloads |
| Google Analytics | Optional usage measurement | No collect requests with consent declined; enabled after consent in separate GA test |
| Feedback form | Send your selected message and attachments | Explicit upload to Cloudflare, then support email |
Repeat the network check yourself
- Open a fresh browser tab, open developer tools → Network and enable Preserve log. In Cookie settings, decline optional analytics for the first run.
- Reload the page, then open a non-confidential local image. Filter to Fetch/XHR, inspect POST requests and their payloads, and distinguish asset downloads from file uploads.
- Edit a distinctive sample headline and export. Search inspected requests for that headline and the sample filename. Do not share HAR files containing cookies, tokens or private URLs.
- If you separately accept analytics, repeat the check and expect GA measurement requests. Sending a support attachment is a different, deliberate upload flow.
Test scope and what it cannot prove
Checked on 11 October 2026 in desktop Chrome on Windows: editor reload, local coffee PSD import, Chinese headline editing and save action, with analytics declined. Network events were captured from the tested browser tab. The production build before this guide release was 9bcd751f-184a-41ba-9046-01578dca123f.
This is an observation of one workflow, not a security audit, proof about every tool or a promise about future versions. Offline operation after loading has not been verified. Hosting, browser extensions and external resource providers may still process network metadata.
The hosted engine is based on upstream v0.7.0. Our hosted WebAssembly includes a presentation patch removing unavailable Discord links. The website wrapper also handles native-project opening and font delivery. Original release checksums and hosted-engine checksums are listed separately; a matching checksum does not certify security.
Your privacy controls
Use Cookie settings in the footer to change optional analytics consent. Your editor files are saved to your device, not to cloud storage. For feedback, select only necessary attachments and redact sensitive information. Support correspondence is handled through Cloudflare and our Google-hosted inbox; retention and request details are in the privacy policy.
Samples, licensing & test notes
Coffee source: Renee Comet / National Cancer Institute, public domain; our sample adds color changes, a mask and text. The native brush sample was made by PhotoCraft.pic and is free to reuse. Files and screenshots document specific tests, not a guarantee for every file or device.
Try it with a real sample.
If you get stuck, send a screenshot with your feedback. Your canvas is not automatically uploaded.