One developer. No middlemen.

Why ScrubPony exists

A photo straight off a phone typically carries GPS coordinates accurate to a few metres, the exact capture timestamp, the device model and serial number, and sometimes the owner's name. All of it survives being emailed, uploaded to most forums, or sent through most chat apps. It also usually carries an embedded thumbnail generated at capture time — so if you crop something sensitive out of a photo, most editors leave the original uncropped version sitting in the metadata.

There are tools that remove all of that. Most of them either re-encode the picture on the way through, or hand you back a folder of sideways photographs, or quietly leave behind a vendor segment they did not recognise. ScrubPony exists because "remove the metadata and change nothing else" turned out to be a small, specific problem worth doing properly rather than approximately.

The shape of it

2,251 lines of C99 — non-blank, non-comment — against a test suite with more lines in it than the program. No dependencies beyond libc, no configure step, no runtime, no GUI, no network. It reads directories because nobody scrubs one photo — they scrub the folder they are about to upload.

Deliberately small scope is what makes the strongest claim defensible. There is no decoder in the program and no encoder either, which is why "provably did not touch the pixels" is a sentence worth writing down. Adding editing, or re-encoding, or another container format would each cost some of that, so none of them are here.

Trust you can check today

The pitch is not "trust me". The whole tool is public under the MIT licence at github.com/norsehorse-dev/ScrubPony, small enough to read in an afternoon, and the claim that matters most is two commands away from being confirmed or falsified. The verification script deliberately finds the SOS offset with its own scanner rather than asking ScrubPony where it thinks the scan starts, because using the tool under test to locate the bytes that vindicate it would prove nothing.

The rules of the family

Every tool in the Pony family follows the same rules:

• No accounts. Nothing to sign up for. ScrubPony does not even open a socket.
• No tracking. No analytics, no telemetry, no ad IDs, on the tools or the websites.
• Inspectable code. ScrubPony is public in full; across the rest of the family the crypto cores are open, with more on the way.

Get in touch

Questions, bug reports, ideas: NorseHorse@norsehor.se. Bug reports are best with the file that caused them — a JPEG this misreads is worth more than a description of how it misreads it. Strip it first if it is yours; scrubpony -i will do that, which is either reassuring or circular depending on the bug. Prefer to write encrypted? Grab the PGP key. One developer reads everything.

Curious about the rest of the family? See all seven apps on one page.