What changed.

ScrubPony for Android 1.3.0 — the app

The same C core as the desktop tool, compiled through the NDK into a native app, scrubbing JPEG, PNG, WebP and HEIC entirely on the device.

• Two ways in — the system share sheet (Scrub metadata) and an in-app picker (the Photo Picker, or Pick from Files for anything outside the gallery) — and three ways out: save to Pictures/ScrubPony, save to any folder, or share clean copies onward.
• No network and no declared permissions. Originals are never changed; every scrub writes a fresh clean copy.
• Jetpack Compose and Material 3 interface, dark themed, with a first-run tour and scrub options (keep orientation, strict) in Settings.
• Localised in English, German, Spanish, French, Japanese and Brazilian Portuguese, switchable in-app.
• A direct APK download with a checksum and PGP signature; an F-Droid listing is in progress. Apache-2.0, at github.com/norsehorse-dev/ScrubPonyAndroid.

iOS is in development.

1.3 — PNG, WebP and HEIC

The core learned three more containers beyond the original JPEG, each detected by content rather than extension, each copying the image data through byte for byte exactly as JPEG does.

• PNG. Drops tEXt, zTXt, iTXt (including XMP), eXIf and tIME; keeps rendering-correctness chunks unconditionally and the iCCP profile by default. Orientation preserved in a minimal eXIf chunk.
• WebP. Drops EXIF and XMP chunks; keeps the image, alpha and animation chunks, and ICCP by default. The RIFF header and VP8X flags are recomputed in a two-pass write.
• HEIC. Excises the Exif and mime (XMP) items from the ISOBMFF structure and recomputes the surviving offsets, relocating the untouched image item. Keeps everything else — new item types are more likely image than metadata. Orientation rides on the native irot property. Elaborate layouts are refused and left untouched rather than risked.
• JPEG is unchanged and remains the most weathered path. PNG, WebP and HEIC each ship with their own unit suites and mutation fuzzing; what has and has not yet been independently cross-verified for each is set out on the guarantees page.
• AVIF, which shares HEIC's container, is the natural next format but is not tested yet and is not claimed.

1.0.0 — first public release

The complete tool: segment parser, keep/drop policy, EXIF reader, atomic writer, directory walker, and the test suite that holds them up.

• Removes EXIF, XMP and extended XMP, Photoshop/IPTC, JFXX, MPF, FlashPix, Ducky, JPEG comments, and any unrecognised APPn segment.
• Keeps ICC colour profiles, JFIF and Adobe segments by default; --strict drops all three.
• Identification by the payload's identifier string rather than the marker code, so ICC survives where MPF does not, both under APP2.
• Entropy-coded image data copied verbatim from the SOS marker to end of file.
• EXIF orientation preserved by re-emitting a minimal 36-byte block; --no-keep-orientation to drop it too.
• Four modes: scrub, -n dry run, --check for scripts, -l for structure.
• Sibling .scrubbed.jpg output, -d mirrored output trees, or -i atomic in-place replacement.
• Write-then-fsync-then-rename on every path; permissions and ownership carried onto in-place replacements; unchanged files left entirely untouched.
• Directory walking with sorted entries, symlink refusal, a 64-level depth limit, per-file error isolation, and skipping of its own outputs and temporaries.
• Exit codes 0 / 1 / 2 / 64, with an operational error outranking a dirty --check verdict.
• Verified on macOS 26.5.2 arm64 (Apple clang 21) and Linux aarch64 and x86-64 (gcc 11–13, clang 18): 741 checks, 8/8 suites, zero warnings under -Wall -Wextra -Wpedantic -Wconversion.
• 7,575,421 libFuzzer executions with zero crashes and zero leaks; 30 SIGKILLs mid-write on a 24 MB in-place scrub with zero partial files; 13/13 fixtures agreeing with exiftool.

MIT licence. Source at github.com/norsehorse-dev/ScrubPony.

Ahead

What is being worked on and what is merely being considered are kept apart on the roadmap. Nothing is listed as shipped here until it is.