One developer. No middlemen.

Why ScrubPony exists

A photo straight off a phone typically carries GPS coordinates accurate to a few metres, the exact capture timestamp, the device model and serial number, and sometimes the owner's name. All of it survives being emailed, uploaded to most forums, or sent through most chat apps. It also usually carries an embedded thumbnail generated at capture time — so if you crop something sensitive out of a photo, most editors leave the original uncropped version sitting in the metadata.

There are tools that remove all of that. Most of them either re-encode the picture on the way through, or hand you back a folder of sideways photographs, or quietly leave behind a vendor segment they did not recognise. ScrubPony exists because "remove the metadata and change nothing else" turned out to be a small, specific problem worth doing properly rather than approximately.

The shape of it

Over 5,000 lines of C99 — non-blank, non-comment — against a test suite with more lines in it than the program. No dependencies beyond libc, no configure step, no runtime, no network. The command-line tool reads directories because nobody scrubs one photo — they scrub the folder they are about to upload. There is now a phone app too, built on the very same C core, for the times the photo never touches a desktop at all.

Deliberately small scope is what makes the strongest claim defensible. There is no decoder in the program and no encoder either, which is why "provably did not touch the pixels" is a sentence worth writing down. It started JPEG-only; PNG, WebP and HEIC were added since, one careful container at a time, precisely because each one could be done the same way — identify the blocks, drop the metadata, copy the picture through untouched — without a decoder creeping in. Editing and re-encoding would cost that claim, so those stay out.

Trust you can check today

The pitch is not "trust me". The whole tool is public under the MIT licence at github.com/norsehorse-dev/ScrubPony, small enough to read in an afternoon, and the claim that matters most is two commands away from being confirmed or falsified. The verification script deliberately finds the SOS offset with its own scanner rather than asking ScrubPony where it thinks the scan starts, because using the tool under test to locate the bytes that vindicate it would prove nothing.

The rules of the family

Every tool in the Pony family follows the same rules:

• No accounts. Nothing to sign up for. ScrubPony does not even open a socket.
• No tracking. No analytics, no telemetry, no ad IDs, on the tools or the websites.
• Inspectable code. ScrubPony is public in full; across the rest of the family the crypto cores are open, with more on the way.

Get in touch

Questions, bug reports, ideas: NorseHorse@norsehor.se. Bug reports are best with the file that caused them — a JPEG this misreads is worth more than a description of how it misreads it. Strip it first if it is yours; scrubpony -i will do that, which is either reassuring or circular depending on the bug. Prefer to write encrypted? Grab the PGP key. One developer reads everything.

Curious about the rest of the family? See all nine apps on one page.