Long before AI provenance records existed, cameras and phones were already writing detailed metadata into every photo they took. That metadata is called EXIF — Exchangeable Image File Format — and most people have never seen it, even though it travels along with nearly every photo they take.
EXIF usually travels alongside two siblings that serve different purposes:
The most concrete risk is GPS data: a photo posted online with embedded coordinates can reveal where you live, work, or were standing at a specific moment — even if the image itself shows nothing identifiable. This has been a well-documented issue for journalists, domestic abuse survivors, and anyone who doesn't want their home location tied to a public photo. Camera serial numbers can also, in rare cases, link a set of anonymous photos back to a specific device.
Many major platforms (Facebook, Instagram, WhatsApp, Twitter/X) do strip most EXIF data on upload, specifically because of these privacy concerns — but not all platforms do, and not all of them strip everything (some still leave orientation or basic technical tags). If you're sharing a photo directly — via email, a personal website, a messaging app that doesn't scrub it, or a cloud storage link — the original EXIF data usually travels intact unless you remove it yourself first.
Use the View mode on Nullframe's homepage to see exactly what's embedded in a JPEG, PNG, WebP, or HEIC file before deciding whether to share it, and Remove mode to strip it entirely in your browser — nothing is uploaded for these formats.