What is EXIF data, exactly?

Exif (Exchangeable image file format) is a published standard — currently Exif 3.0, CIPA DC-008, released May 2023 — for metadata written inside image files. Typical fields include GPS coordinates and altitude, the exact capture timestamp, camera make and model, lens and body serial numbers, editing software and exposure settings. In a JPEG it lives in an application marker segment inside the same file as the picture, so it survives cropping, renaming and redaction of the visible image.

Can ChatGPT or Claude read the EXIF data in a photo I upload?

Two separate questions. The file itself, metadata included, is uploaded in full — there is no upload that sends only pixels. Whether the model is shown the metadata is different: a vision pipeline normally decodes the image and hands the model pixels, so a chatbot will often say it cannot see Exif, and that is accurate about its input. With a code or file-analysis tool in the session, the raw bytes can be read directly. Treat "the model didn't mention it" as unrelated to "it wasn't sent".

Does cropping or blurring a photo remove its location data?

No. Cropping, blurring, redacting and renaming change the pixels or the filename; the Exif block is a separate part of the file and is normally rewritten untouched. You need an explicit strip — Windows' "Remove Properties and Personal Information", macOS Preview, ExifTool, or re-exporting to a new file. A screenshot of the image also drops it, since the screenshot is a new file with no camera data.

Do PDFs and Word documents carry hidden data too?

Yes, and often more consequentially than photos. PDFs carry a document information dictionary with Title, Author, Subject, Keywords, Creator, Producer and timestamps. Word and Excel files keep author, "last modified by", revision count, company, total editing time, comments and tracked changes — which is why Microsoft ships a Document Inspector to remove them. Anonymising the visible text does not touch any of it.

Does Secret Chat AI strip metadata from files I attach?

Yes, by default and unconditionally. Every attached image is re-encoded with its metadata stripped, after the orientation flag is baked into the pixels so the picture stays upright; every PDF is rebuilt with Title, Author, Subject, Keywords and Creator blanked, including on the rasterised fallback path. There is no setting and no file that skips it. Two honest limits: the cleaning happens on our servers rather than in your browser (the intermediate copy is deleted once the result is collected, with an hourly sweep), and stripping metadata is not redacting content — visible text and visible images reach the model exactly as they are.

EXIF: What AI Providers See in Your Files

Published August 5, 2026 · Facts last verified August 5, 2026

This article is general information, not legal advice. For advice about your own situation, consult a qualified lawyer.

You crop the photo so the street sign is out of frame. You black out the client's name in the PDF. You look at the file on screen, and what you see is exactly what you meant to send.

What you see is not what you send.

Every image file and every document has a second compartment: a block of machine-written fields that no viewer shows you by default, describing where the file was made, when, by what hardware, with which software, and often by whom. It rides inside the same bytes as the picture. It survives cropping, redacting and renaming, because none of those operations touch it. And when you attach the file to an AI chat, it goes with it.

This article is about that compartment: what is actually in it, who receives it, what the difference is between "the provider has it" and "the model read it", and what to do about it — including the part that stripping metadata cannot fix.

The Compartment You Have Never Opened

The format is called Exif — Exchangeable image file format — and it is a real published standard, not a vendor quirk. It is maintained by Japan's Camera & Imaging Products Association; the current edition is Exif 3.0 (CIPA DC-008), released in May 2023, whose headline change was UTF-8 support so that non-Latin scripts could finally be written into the fields. In a JPEG, the block lives in an application marker segment alongside the compressed pixels. It is part of the file in the same way the picture is.

Photographs commonly carry up to three overlapping metadata systems: Exif for camera data, IPTC for editorial fields such as creator and copyright, and XMP, Adobe's XML-based container that editing software writes. A file that has been through a phone and then a photo editor can carry all three, saying slightly different things.

The fields that matter for privacy are the mundane ones:

GPS latitude, longitude and altitude, plus a GPS timestamp — written by phones when the camera has location permission. This is the field that ends careers.
DateTimeOriginal — the instant the shutter fired, to the second, distinct from the file's modification date. It tells anyone reading it when you were somewhere, not when you sent the picture.
Make, Model and LensModel — the device. "iPhone 17 Pro" narrows a population; combined with anything else it narrows it a lot.
Body and lens serial numbers — written by many interchangeable-lens cameras. A serial number is a durable identifier that links every photograph one body has ever taken, which is why press photographers and leak investigators both care about it.
Software — the OS build or the editor that last wrote the file, including whether it was retouched and with what.
Orientation, exposure, ISO, focal length — harmless individually, and a decent fingerprint collectively.

None of this is hidden in a sinister sense. It is documented, standardised, and mostly there for good reasons: your photo app sorts by capture date and shows a map because these fields exist. The problem is not that they are secret. It is that they are invisible at exactly the moment you decide what to share.

The Canonical Demonstration

In December 2012 the software magnate John McAfee was a fugitive, publicly insisting he was still in Belize. Vice published an exclusive from the road, illustrated with a photograph of him taken on a reporter's iPhone 4S. The photograph had not been stripped.

Readers pulled the Exif block within hours. It contained GPS coordinates placing the shot at a location in Guatemala, near Río Dulce — not Belize. McAfee first claimed on his blog that he had faked the coordinates to mislead police; by the following morning he had posted again, admitting the metadata was accurate. He was picked up by Guatemalan authorities days later.

Nobody hacked anything. Nobody read a private message. A magazine published a picture, and the picture said where it was taken. That is the entire failure mode, and it has not changed in fourteen years — only the number of places people upload photographs has.

Look Inside Your Own File in Thirty Seconds

Do this once with a photo from your own phone; it is more persuasive than any paragraph.

Windows — right-click the file → Properties → Details. Scroll. The same dialog has "Remove Properties and Personal Information" at the bottom, which will write you a cleaned copy.
macOS — open in Preview → Tools → Show Inspector → the (i) tab, then the GPS tab if one appears. A GPS tab appearing at all is your answer.
Anything, thoroughly — ExifTool, the reference command-line utility, which reads every block including the ones the OS dialogs do not surface.

One caution: the built-in viewers show a curated subset. A blank Details tab is weak evidence of a clean file — it means Windows found nothing it displays, not that there is nothing there. Verify with a tool that dumps everything, or with the "strip everything" approach below, which does not require you to be right about what is present.

It Is Not Only Photographs

Images are the famous case. They are not the most damaging one, because the documents people attach to AI chats tend to be the documents that matter.

PDFs carry a document information dictionary: Title, Author, Subject, Keywords, Creator, Producer, and creation and modification timestamps — often duplicated in an XMP packet. "Creator" is the application the original was written in; "Producer" is what converted it to PDF. Author is usually populated from the account name of whoever made the file, which on a work machine is a real person's real name, sometimes with their employer alongside it in a company field.

Word and Excel files are worse, because they keep a history rather than a snapshot. A .docx is a zip archive, and inside it docProps/core.xml holds the creator, the "last modified by" name and a revision count, while app.xml can hold a company name and the total editing time. Microsoft's own guidance is explicit that Office documents carry hidden data and personal information — author names, comments, tracked changes, and the email addresses attached to those changes — which is precisely why Word ships a Document Inspector to remove it.

The failure pattern here is specific and extremely common. Someone carefully anonymises a contract: names replaced, figures generalised, the visible text scrubbed. Then they upload it with the client's real firm still sitting in the company property and their own full name in "last modified by". The text was redacted. The envelope was not, and the envelope is the part nobody proofreads.

Scans inherit the scanner's make and model, sometimes with an operator or department string. Screenshots are the thin ones — a screenshot is usually born clean of GPS and camera data, which is why "send a screenshot instead of the file" is decent advice. But a screenshot has a different exposure: everything else that was on your screen. Browser tabs, a name in a title bar, a notification banner, the corner of another document. The metadata risk drops to nearly zero and the visual risk goes up, so crop deliberately rather than assuming a screenshot is inherently safe.

What Actually Happens When You Attach It

Three different questions get collapsed into one here, and separating them is most of the clarity available on this topic.

1. What travels? The whole file, byte for byte. This one is not a policy question and has no exceptions: there is no such thing as an upload that sends "just the pixels", because the pixels are encoded inside the container that holds the metadata. If you attached a JPEG, the Exif block went with it. If you attached a PDF, its author field went with it. Whatever else is uncertain, this is not.

2. What does the model see? Usually not the metadata, and this is where most of the confusion lives. A vision pipeline typically decodes the image to pixels and hands the model an array of pixels — the Exif block is not part of what the model is shown. So if you ask a chatbot where a photo was taken, you will often be told it has no access to metadata, and that answer is honest about the model's input. It is not a statement about the server. Attach a file to a session with a code or file-analysis tool available and the bytes can be read directly, metadata included. "The model didn't mention my GPS" and "my GPS was not uploaded" are entirely different claims.

3. What is kept? Whatever the provider's terms and configuration say, on the provider's clock. Your file is now a file in someone else's system, subject to their retention, their logging, their subprocessors and their legal obligations, exactly like any other document you send to any other company. Providers document how they treat conversation content; the metadata inside an attachment is not usually addressed as a separate category, because to them it is not one — it is part of a file you sent.

The productive mental model is not "can the AI read my Exif". It is: I uploaded this document to a company. Everything in the document went. Behave accordingly.

The Inversion: Metadata They Add

Traffic runs both ways. Images generated by AI increasingly arrive carrying provenance metadata, deliberately attached.

OpenAI began attaching C2PA Content Credentials to images created and edited by DALL·E 3 in ChatGPT and the API — a signed manifest recording the tool that made the image and the actions applied to it — and joined the C2PA steering committee in 2024. Google's SynthID takes a complementary approach with an invisible watermark in the pixels, which survives operations that destroy metadata.

This is a good development, and it has two consequences worth holding at once. If you download an AI-generated image and post it, it may carry a machine-readable statement about how it was made. And in the other direction: the absence of Content Credentials proves nothing whatsoever about an image, since metadata is trivially removed — by stripping tools, by format conversion, by a screenshot, and by many platforms as a matter of routine. Provenance metadata is evidence when present and silence when absent. Never read it as a negative test.

Stripping Is Necessary. It Is No Longer Sufficient.

Here is the part that changed recently, and it is the reason this article does not end with "install an Exif cleaner and relax".

In April 2025, OpenAI's o3 and o4-mini brought visual reasoning that could crop, rotate and zoom into an uploaded image as part of working through it, and pair that with web search. Within days people had discovered these models were formidable at deducing where a photograph was taken — cities, landmarks, individual restaurants and bars — from vegetation, architecture, road markings, signage, light and shadow. TechCrunch, reporting the trend, noted that in many cases the models did not appear to be drawing on Exif data at all. They were reading the picture.

So the boundary has moved. Metadata is the part of a file you can remove. The photograph is the part you cannot. A stripped, cropped, screenshotted image of your street still shows your street, and a competent model may well name it — which matters most for exactly the people who most need it not to: journalists protecting a location, activists, anyone photographing something they should not be near.

The honest conclusion is unglamorous. Strip metadata, because it is free, certain and removes the easiest attack. Then decide separately whether the visible content is safe to send, because that is a judgement no tool makes for you.

A Short Note on the Law

Under the GDPR, "personal data" is defined in Article 4(1) as information relating to an identified or identifiable natural person, and the definition expressly names location data and online identifiers among the factors that can make a person identifiable. A geotagged photograph of an identifiable person is therefore doing two things at once, and a device serial number embedded in a file is the kind of durable identifier that definition contemplates.

The practical consequence is about responsibility rather than penalties. If you upload a file containing someone else's personal data — a colleague's name in a revision history, a patient's face in a scan, a client's address in a document property — that disclosure is yours. It is not made lawful by the recipient being a machine, and no chatbot's privacy policy transfers your obligation to the company you sent it to. This is the same principle that runs through our writing on what the right to erasure actually gets you: rights and duties follow the data, and the data went where you sent it.

What Actually Helps

Turn off location tagging at the camera. The most reliable fix is not writing the coordinates in the first place — iOS: Settings → Privacy & Security → Location Services → Camera → Never; Android: the camera app's own location toggle. Nothing to remember later.
On iPhone, use the share sheet's Options. Open the photo → Share → Options at the top → turn Location off. Know its limit: that switch removes location and editing data for that share, not the entire Exif block. It is a good habit, not a full strip.
On Android, there is no single universal switch — the behaviour depends on the OEM, the gallery app and the Android version. Google Photos can share without location; otherwise use a metadata-removal app or strip on a computer.
Strip everything on a desktop — Windows' "Remove Properties and Personal Information", or exiftool -all= file.jpg, which is exhaustive rather than selective. Selective is where mistakes live.
Run Office files through the Document Inspector (File → Info → Check for Issues → Inspect Document) before they go anywhere, and use your PDF tool's sanitise/remove-hidden-data function.
Re-export rather than trusting a viewer. Opening a file, exporting it to a new one and sending that copy discards most of what was riding along — and does not depend on you having correctly identified what was there.
Prefer a screenshot of the relevant part to the source document, and crop it deliberately. You lose the file's whole history; you gain responsibility for what else was on screen.
Check before, never after. An upload cannot be recalled. Deleting the conversation afterwards does not un-send the file, and on most services it does not reach the copies the file spawned on the way in.

How Secret Chat AI Handles Attachments

This is one of the few items on the list a service can genuinely fix for you, because the metadata sits in known places in known formats. On Secret Chat AI it is fixed by default, on every file, with no setting to find.

Every image is stripped. Attachments are re-encoded through ImageMagick with its strip operation applied — but only after the Exif orientation flag has been baked into the pixels, so a phone photo still arrives the right way up. Everything else goes: GPS coordinates, capture timestamp, camera make and model, body serial number where present, editing software, the lot. There is no format that takes a shortcut past it and no size below which it is skipped.
Every PDF is rebuilt with its document information blanked. Ghostscript writes a new file with Title, Author, Subject, Keywords and Creator emptied. When a document has to take the fallback path and be rasterised instead, the result is a brand-new file — and the library that assembles it is explicitly told to blank the author, creator and title strings it would otherwise stamp on, so that route leaks nothing either.

Three limits, stated plainly, because a page about hidden data is a poor place to hide any.

The cleaning happens on our servers, not in your browser. The original file does leave your device with its metadata intact, is cleaned on our compression service, and only the cleaned version travels onward to the model. That intermediate copy is deleted as soon as the result is collected, with an hourly sweep for anything a closed tab orphaned. It is a real trade-off and we would rather you knew about it than discovered it.

Stripping metadata is not redacting content. Secret Chat AI removes you from your queries — it does not remove the data from your messages. If the visible text of that PDF names your client, that text reaches the model exactly as written. If the photograph shows the front of your house, the model sees the front of your house. We clean the envelope; the letter is yours to write, and redacting identifying details before sending remains your responsibility.

And what the provider does see is not you. Your prompt reaches the model through our gateway under our credentials, from our servers: no IP address of yours, no browser, no device, no account, no payment identity. Registration takes an email, but it is used only for account access and payment — never stored against your prompts or associated with them. Retention may still apply at the provider; your query simply arrives anonymized, so a cleaned file lands in an aggregate stream rather than in a file about you. We build no profile of you, no conversation is ever associated with you, and queries are never used for training. You use the model as a stranger.

Frequently Asked Questions

What is EXIF data, exactly?
Exif (Exchangeable image file format) is a published standard — currently Exif 3.0, CIPA DC-008, released May 2023 — for metadata written inside image files. Typical fields include GPS coordinates and altitude, the exact capture timestamp, camera make and model, lens and body serial numbers, editing software and exposure settings. In a JPEG it lives in an application marker segment inside the same file as the picture, so it survives cropping, renaming and redaction of the visible image.
Can ChatGPT or Claude read the EXIF data in a photo I upload?
Two separate questions. The file itself, metadata included, is uploaded in full — there is no upload that sends only pixels. Whether the model is shown the metadata is different: a vision pipeline normally decodes the image and hands the model pixels, so a chatbot will often say it cannot see Exif, and that is accurate about its input. With a code or file-analysis tool in the session, the raw bytes can be read directly. Treat "the model didn't mention it" as unrelated to "it wasn't sent".
Does cropping or blurring a photo remove its location data?
No. Cropping, blurring, redacting and renaming change the pixels or the filename; the Exif block is a separate part of the file and is normally rewritten untouched. You need an explicit strip — Windows' "Remove Properties and Personal Information", macOS Preview, ExifTool, or re-exporting to a new file. A screenshot of the image also drops it, since the screenshot is a new file with no camera data.
Do PDFs and Word documents carry hidden data too?
Yes, and often more consequentially than photos. PDFs carry a document information dictionary with Title, Author, Subject, Keywords, Creator, Producer and timestamps. Word and Excel files keep author, "last modified by", revision count, company, total editing time, comments and tracked changes — which is why Microsoft ships a Document Inspector to remove them. Anonymising the visible text does not touch any of it.
Does Secret Chat AI strip metadata from files I attach?
Yes, by default and unconditionally. Every attached image is re-encoded with its metadata stripped, after the orientation flag is baked into the pixels so the picture stays upright; every PDF is rebuilt with Title, Author, Subject, Keywords and Creator blanked, including on the rasterised fallback path. There is no setting and no file that skips it. Two honest limits: the cleaning happens on our servers rather than in your browser (the intermediate copy is deleted once the result is collected, with an hourly sweep), and stripping metadata is not redacting content — visible text and visible images reach the model exactly as they are.

Conclusion

The privacy conversation about AI attachments has been a conversation about what is in the document. The compartment beside it — the coordinates, the serial number, the author field, the revision history — travels on the same trip, was written by machines that were never asked, and is invisible in every application you use to check your work before sending.

It is also the tractable half. It sits in known fields, in known formats, and removing it is a solved problem: a share-sheet toggle, a right-click, one ExifTool command, or a service that does it for every file without being asked. What is not tractable is the picture itself — and now that models can read a location out of the pixels, that distinction is the one worth keeping straight.

So: strip the envelope, then decide about the letter. And send it through something that never learns who is asking.

EXIF and Metadata in Uploaded Files
What AI Providers See That You Don't