A Practical Privacy Checklist Before You Share a File

DevOkk’s file tools are designed to run in the browser: inspect and strip metadata, compress a PDF, compress an image. Use them when the alternative is a converter you cannot name. Use a vendor you already contract with when the job is regulated exchange, e-sign, or a 10,000-file pipeline.

Decide what “done” means before you touch a compressor

Name the recipient and the channel. A photo to a group chat is not the same as a PDF to a client. A file that will be downloaded as the original (email attachment, issue tracker) keeps whatever you did not remove. A file that will be re-encoded by a social app might lose EXIF and still show a street in the pixels.

Write down, even mentally:

• Does this person need the original pixels / full PDF, or a smaller copy?
• Do they need location, author, or camera tags? Almost nobody does.
• Are there pages or crops that should not leave the building?
• Is the filename itself a leak?

If you cannot answer those, you are not ready to compress. You are ready to look.

Look at the file you will actually send

Open the candidate, not a memory of it.

Pages and slides. Scroll to the end. Extra appendix, extra client, extra “internal only” sheet. Split or export a range before you do anything else. Sending page 8 “by accident” is not a metadata problem.

Pixels. Badge, monitor, notification, whiteboard, reflection. Crop or do not send. A black rectangle in a preview is not redaction if the text is still in the PDF.

Filename. layoff-model-v3.xlsx tells a story in the download bar. Rename on purpose.

Metadata. Drop the file in Metadata Viewer. For photos, look at GPS, camera, time. For PDFs and office exports, look at author, software, dates, comments. Details live in What File Metadata Reveals About You.

If you were about to upload the file to a website in order to inspect it, stop. Inspection is the step that should not create a new custodian.

Strip tags, then confirm the output

When GPS, author, or camera should not travel:

1. Keep the original.
2. Strip with Metadata Remover - EXIF, IPTC, XMP, GPS, timestamps, author, comments as needed.
3. Inspect the cleaned file in the viewer. If the field is still there, do not send.
4. Attach the cleaned name, not IMG_2048.jpg from the camera roll.

Stripping is not redaction. Read How to Remove EXIF and Document Metadata if you need the failure modes (embedded images, thumbnails, “Save for web” lies).

Screenshots: usually no GPS, still plenty of on-screen secrets. Do not treat “I screenshotted it” as the whole checklist.

Size is a separate pass

Gmail-style limits are why people reach for the first “compress PDF online” result. That result is an upload. If the content is boring, maybe you do not care. If it is a contract, ID scan, or unpublished deck, you do.

On DevOkk, compress after you are happy with pages and metadata:

• PDF Compressor for documents
• Image compressor for photos and screenshots

Then open the compressed output once. Check page count, readability at 100%, and - again - metadata. A compressor can add a producer tag. If that bothers you, strip after compress, or accept a generic software field.

Do not loop PNG → JPG → PNG to chase size. You will lose quality and still maybe keep tags. One intentional export, then one compress.

If the browser runs out of memory, split the PDF or shrink the image’s dimensions on purpose. A failed local compress is still better than a successful upload of the original.

Where the file is going

Email and tickets. The attachment is the original you picked. Recipients forward it. Assume the file will outlive the thread.

Chat. Some apps transcode images (and drop EXIF); some store the original. If you can download what you sent and still see GPS, the app did not save you.

Forms and “quick converters.” Each site is another copy. Prefer a local tool or a named vendor. “Free, no signup” is not a processing agreement.

Your own extras. Cloud drive versions, “send to myself,” a second compress on a phone. Delete the intermediates you do not need so the next share cannot pick them by accident.

Tokens and passwords are not files, but the same rule applies: do not paste them into a random site to “just decode.” That is the security-tool cluster. This checklist is the attachment.

A short list you can reuse

Copy this into a team doc if you want. Keep it ugly and specific.

1. Confirm recipient and channel.
2. Open the file. Check extra pages and visible content.
3. Rename if the filename is loud.
4. Inspect metadata locally. Strip if GPS / author / camera should not travel. Inspect the cleaned copy.
5. Compress locally only if size requires it. Re-open the result.
6. Attach the final file. Keep the original until the recipient confirms they can read it.
7. Do not add a bonus upload “to be sure.”

Skip steps only on purpose (for example, you want IPTC on a press photo). Skipping because you are late is how the GPS photo ships.

What this checklist is not

It is not GDPR advice, a penetration test, or a substitute for redaction software that removes content from PDF objects.

It is not a claim that a browser tab makes you anonymous. Pages load over the network. DevOkk discloses analytics. Networking tools on the site send hostnames because they must. File and encoding tools are the ones built so the document stays in the tab to finish the job.

It will not help if you send the file to the wrong person. Access control is still “who is on the thread.”

Start with the file already on the desktop

Take the file on your desktop and start at step 2. If metadata is the unknown, open Metadata Remover after a pass through the viewer. If size is the blocker after that, use PDF Compressor or image compressor.

If you want a freelance-oriented workflow that stays off random uploaders, read Freelance document workflow. The checklist above is the part you can run even when you are not thinking about workflows at all.