UNREFERENCE - Image Privacy Tool

Introduction

UNREFERENCE is a desktop application for preparing photographs.

The program has many ordinary uses, and they share one dual-paned window (before/after).

The first is day-to-day work on files you already have: make adjustments to a set, rotate, apply a stylish look, compress for the web, convert a folder to JPEG or PNG, burn a watermark, or set a photograph as the desktop background with the explorer context menu.

The second is EXIF data removal/injection. Before a photograph is posted, sent, or handed to a client, Unreference can take location, time, camera identity, serial numbers, MakerNotes, edit history, embedded previews, and signed provenance off a copy. The original file remains in place unless Update originals is chosen on purpose. A working photographer can strip a delivery and then write their own creator, copyright, credit, caption, alt text, keywords, and license back onto the file.

The third is sensor-level augmentation. For users concerned about images being computationally matched back to a specific device, Unreference applies subtle adjustments directly to the pixel data. These algorithms disrupt stable hardware signatures, such as sensor pattern noise and demosaic regularity, reducing hardware correlation without degrading the visible photograph excessively.

Presets and the window layout can sync through Steam Cloud. That sync does not include the photographs. It can be turned off per machine.

Metadata and provenance

Each control removes one class of data. The inspector shows what the open file is actually carrying.

GPS. Latitude, longitude, altitude, and the GPS clock. This is the address of the shot.

Timestamps. DateTimeOriginal, DateTimeDigitized, and the related clocks. When a photograph was made is often as identifying as where.

Camera and lens. Make, model, lens, and the software that last wrote the file.

Serial numbers. Body and lens serials. These tie separate files to the same physical camera.

MakerNotes. The camera maker’s private block. It is undocumented, often large, and commonly holds shutter count, focus information, and another thumbnail.

XMP. The block written by catalogs and editors: history, ratings, identifiers, and other fields the software chose to store.

Content Credentials (C2PA). A signed manifest of capture and edit history, when the file has one. Removing it leaves the file unsigned. It does not alter the picture into a forgery, and it does not write a replacement manifest.

Apple Reference material. Signature blocks the inspector can recognize, removed when that switch is on. A linked DNG beside a JPEG can be left out of the export. Unreference does not re-sign the file and does not claim the result will still pass Apple’s verifier. If the material is gone, verification should fail.

ICC profile. Kept by default. Maximum Privacy can drop it.

Orientation is preserved when the rest of the EXIF block is rebuilt, so a photograph does not silently turn on its side because the metadata was cleaned.

Material outside the metadata

A file can report no EXIF and still carry a second copy of the picture, or a name that identifies the camera.

Embedded previews. The EXIF thumbnail, a JFIF preview, and a Multi-Picture Format secondary image. That secondary image can be a full-size frame no viewer displays. A crop or redaction of the main picture does not touch it. Stripping previews removes those copies.

Trailing bytes. Data parked after the real end of a JPEG or PNG. Editors and phones leave caches there. Scanners that stop at the end marker never show them.

Filename. Keep the original stem, sanitize it so the camera’s counter is gone, number the batch, or replace the stem with an opaque token. A name such as IMG_4823 identifies both the body and the shutter count.

File times. The modified and accessed stamps on disk are not inside the photograph. They can be set to a fixed neutral value so the folder does not re-date a file whose internal clocks were just removed.

Identity, caption, and watermark

Removal runs first. Fields you choose to keep are written afterwards, so a caption does not restore the history that was just taken off.

Identity. Creator, copyright, credit, contact URL, and rights. Empty fields are omitted.

Publish. Title, description, alt text, keywords, a license URL, and plain-language usage terms. These are the fields a platform or a client reads. They can be written as EXIF and as a full XMP/IPTC packet, or as EXIF only.

Watermark. Text burned into the pixels: nine anchor positions or a repeating tile, with scale, opacity, margin, ink, and an optional shadow so the mark reads on both light and dark areas. The glyphs are drawn by the program, so the export does not depend on a font installed on the machine. A watermark is an authorship mark. It is not a privacy control.

The stage

The stage is two frames: the original, and the live result.

The live frame defaults to the photograph’s own resolution, so tone, crop, redaction, grain, and watermark are judged on the real pixels. While a frame is rendering, the controls stay usable and the picture updates when the render finishes. Settings can switch this machine to a 720-pixel preview when a full frame is too slow.

A loupe beneath the frames shows the same point on both, from 1× to 10×. Clicking or dragging either frame moves both crops.

The queue, the stage, and the inspector can be resized. Those widths, the loupe, and the last preset are saved.

Geometry

Rotation in 90-degree steps, horizontal and vertical flips, and a crop with an optional inset. Rotation and flips rewrite pixels. They are not an orientation flag left in metadata.

Output size can fit the long edge to a pixel count, or cap width and height. Zero leaves the native size. A DPI value can be written as a tag. It does not resample the image.

Tone, color, detail, and looks

Tone. Exposure, contrast, highlights, shadows, whites, and blacks, plus a parametric curve split into highlights, lights, darks, and shadows.

Color. Temperature and tint, then hue, saturation, and luminance per color band. Shadows, midtones, and highlights can be graded separately (lift, gamma, and gain). Named color presets fill the sliders.

Detail. Texture, clarity, dehaze, sharpening, and a photographic denoise. This denoise is separate from the sensor residual denoise below.

Looks. Styled starting points that set several of the above at once. Quickly browse through and apply stylish visual filters for a quick .

Redaction

A region is a rectangle in the frame, drawn as fractions of width and height. The pixels inside it are destroyed, not covered. There is no original underneath to recover.

Blur softens the region.

Pixelate replaces it with blocks.

Solid paints a flat color.

Noise replaces it with static.

Strength sets how hard the mode hits. Feather softens the edge of the rectangle. Regions are applied after geometry, so a box still lands on the subject after a crop or a rotation.

Encode

Untouched keeps the original bitstream when the pixels were not rewritten.

Lossless and Lossy force a new encode.

Quality applies to lossy JPEG and WebP.

JPEG can be written progressive, and as 4:4:4 instead of 4:2:0.

Output format can stay as the source, or become JPEG, PNG, or WebP. A HEIC source can be decoded and stripped. This build does not encode a JPEG into a new HEIC.

Sensor

The sensor stack is optional and off at zero. It operates on pixels, not on tags. Metadata removal does not require it. Raising a slider turns that operation on.

It is for cases where the concern is a faint, stable pattern in the raster itself: sensor pattern noise, demosaic regularity, JPEG block structure, dust, or a fingerprint that only matches if two files are still perfectly aligned. It reduces that correlation. It does not make a photograph untraceable, and it is not a laboratory pass or fail. The residual-energy figure in the rack is a proxy computed on a downscaled luma plane, not a PRNU score.

The same stack can sit beside ordinary finishing. A file can be cropped, captioned, and watermarked with the sensor controls left at rest.

Pixel washer

Amount mixes the washed frame back toward the original. 1 is the full stack. 0 is none.

Residual denoise softens the high-frequency residue where sensor pattern lives. Mild keeps texture. Strong begins to smear.

Denoise radius sets how wide that blur reaches.

Flat-field estimates a slow gain map from the frame and partly divides it out. It is experimental and can exaggerate large gradients.

Frequency notch attenuates a high-frequency band used in sensor-pattern correlation. Experimental.

Grain puts spatially correlated grain back after the denoise, so the file is not left with an empty or purely white residual. Size, chroma, and correlation control clump, color, and how much neighboring pixels share the same grain.

Pattern

Experimental. These controls disturb color-filter and demosaic regularity.

CFA amount modulates a Bayer-like 2×2 gain so the grid is less regular.

Remosaic period sets that grid. 2 is a classic Bayer cell. Larger is coarser.

Bayer phase shifts which pixel is treated as red, green, or blue.

Zipper adds false-color zipper along contrast edges, so the usual demosaic signature is scrambled.

Chroma period ripples chroma on a short repeat, against 4:2:0 and CFA sampling traces.

Ghosts

These follow compression structure, not the sensor gain map.

DCT scatter perturbs the high frequencies of each 8×8 block, the lattice a JPEG leaves behind.

Ghosting blends in a copy that has been scaled down and back up, which softens double-compression rings. High values look smeared.

Block jitter nudges each 8×8 block by a subpixel amount, so the block grid no longer lines up, without a global crop.

Recompress runs an extra in-memory JPEG pass at a different quality before the real encode.

Optics

Chromatic aberration shifts red and blue by a fraction of a pixel.

Vignette lifts the corners, flattening a lens falloff.

Dust pulls hot and dark specks toward their neighborhood. Stuck pixels and sensor dust are stable identifiers.

Fringe desaturates purple and green edges left by demosaic and by some lenses. Experimental.

Drift

A small geometric change so a leftover pattern cannot be registered to the original pixel grid. This is a break in alignment, not a deletion of the camera.

Micro scale scales the frame by a few hundredths of a percent.

Micro rotate rotates by a fraction of a degree. Above about 0.2° the turn can be seen if you look for it.

Translate shifts the frame by a subpixel on X and Y.

Warp applies a slow sine displacement. It is stronger than translate and visible at high amounts. It runs last.

Re-encode from this rack

Force re-encode writes a JPEG at the washer’s quality even when the main encode mode is Untouched. The point is a quantization table that is not the camera’s. Rebuild thumb is not a second hidden original: embedded thumbs from the source are already removed with the metadata strip, and the export raster is the picture.

Presets and the queue

Drop files or a folder. The active preset is applied to images that have not been edited individually. Moving a control on one photograph forks that image onto its own settings. The others keep following the preset.

Passthrough changes nothing. Other presets are defined as a departure from it.

Social removes identity and provenance. It is the default for a file that will be shared.

Archive keeps capture time and camera, and still removes GPS, serials, MakerNotes, C2PA, and Reference blocks.

Maximum Privacy extends Social, including removal of the ICC profile.

Residual Wash, Pattern, Ghosts, Optics, and Drift each enable one sensor department and do not strip metadata. Merging combines presets. Strip flags stay on once any source has armed them, so a merge cannot quietly weaken a privacy preset.

An image can be matched back to the preset, its settings can be pushed onto the preset, or the current state can be saved as a new preset. Each row in the queue shows which preset it will run.

Destinations:

A sidecar folder named _unreference beside the source

One chosen folder for the whole batch

The same folder, with _unreference added to the name

Update originals, which replaces the source and cannot be undone

Preview only runs the job without writing. Live Photo video is skipped. Several files can process at once. A sidecar report can be written next to the export. Overwrite, when enabled, replaces a previous export. It does not by itself replace the original.

File Explorer and Files

On Windows, Settings registers an Unreference menu on the File Explorer right-click. On Linux, the same menu is installed for Files (Nautilus). A selected photograph can be processed there without opening the studio first. The macOS Finder extension is coming at a later date (when we can sign the binary).

The stock menu includes:

Strip. GPS only, all provenance, or the Social, Archive, and Maximum Privacy presets

Compress. A light pass, a web pass, JPEG at quality 90, or WebP at quality 80

Convert. JPEG, PNG, or WebP

Resize. Long edge 2048, 1920, or 1080, or 50% and 25%

Rotate and flip

Effects. The five single-purpose sensor presets

Open. The selection opens in the running studio, or in a new window

Clipboard and wallpaper on Windows

Any preset can be pinned into that menu. Sections can be renamed, reordered, disabled, or replaced.

Further work

Further functions are in development. We are supporting Windows, Linux, and macOS at releas.