Everything you need, nothing inflated.

The one-liner

ScrubPony strips identifying metadata out of JPEG, PNG, WebP and HEIC photos without altering a single pixel.

The one-paragraph version

A photo off your phone carries GPS coordinates accurate to a few metres, the capture time, the device serial, and often an uncropped thumbnail of what you cropped out. ScrubPony removes all of it and provably does not touch the image: the image data is copied through verbatim. The core is written in C99 against POSIX.1-2008 with no dependencies beyond libc, runs on macOS and Linux as a command line tool, and ships as a native Android app on the same core. It reads JPEG, PNG, WebP and HEIC, is MIT-licensed at github.com/norsehorse-dev/ScrubPony (the app Apache-2.0), and iOS is in development.

Facts

Figures

CI runs the full suite on both platforms with both compilers on every push, plus a timed libFuzzer job.

The angles worth taking

• The marker code never decides. APP1 is EXIF or XMP; APP2 is an ICC colour profile or an MPF block that can hold an entire second photograph. One of each pair is kept and the other dropped, and only the identifier string tells them apart. Getting that wrong is how a naive scrubber either wrecks your colours or silently leaves behind the coordinates it promised to remove.
• It fails closed. Unrecognised APPn segments are dropped by default, because an undocumented vendor segment is exactly where a manufacturer parks a serial number.
• Your portrait photos do not come out sideways. Phones do not rotate pixels; they record an EXIF orientation tag. Drop EXIF and that instruction goes with it, which is why most metadata strippers leave you a folder of sideways photographs. ScrubPony writes back a minimal 36-byte block containing exactly one field.
• Losslessness is provable, not asserted. The test suite verifies it four ways and deliberately locates the SOS offset with an independent scanner rather than asking ScrubPony where it thinks the scan starts.
• It tells you what it found. The line people react to is 257 carried GPS coordinates.

Do not write

This is a privacy tool, and overclaiming about one is worse than underselling it. Please avoid:

• Not "removes all metadata from any image." It handles JPEG, PNG, WebP and HEIC. RAW, TIFF, AVIF and video are out of scope today.
• Please distinguish the formats by maturity. JPEG is verified on macOS and Linux since 1.0; PNG, WebP and HEIC are newer, each tested and fuzzed but not yet independently cross-verified to JPEG's depth. Do not present all four as equally battle-tested.
• Not "anonymises your photos." It removes container metadata. It cannot touch anything encoded in the pixels — invisible watermarks, a reflection in a window, a visible street sign.
• iOS is in development, not released. There is an Android app (direct download, with an F-Droid listing in progress) but no iOS app and no App Store link yet. Please do not imply one exists, or that it is on the Play Store.
• Not "Windows support." Out of scope by design; the safety guarantees rest on POSIX semantics that differ there.
• BSD is untested, not unsupported. Please word it that way.
• -i loses extended attributes (Finder tags, Spotlight comments, quarantine flags) and breaks hard links, because replacing a file installs a new inode. This is documented, not hidden.
• The mtime is deliberately reset — it is metadata too. Readers are surprised by this, so lead with it rather than let them discover it.
• ICC colour profiles are kept by default (dropping them shifts colour). --strict drops them. Please do not imply the default is maximum paranoia.
• Please do not invent a rating, an audit, a user count, or a roadmap commitment. None exist.

Sample output

Real, and safe to reproduce:

$ scrubpony -r -d ~/clean ~/Pictures
scrubpony: 834 scrubbed, 366 already clean, 3 unsupported, 4 skipped, 2 failed
scrubpony: 1148605 bytes of metadata removed
scrubpony: 257 carried GPS coordinates
scrubpony: 266 rely on EXIF orientation to display correctly (266 preserved)

Assets

Use freely when writing about ScrubPony.

• App icon, 1024×1024 PNG
• App icon, 512×512 PNG
• Social card, 1200×630 PNG

Accent colour #9d7cf5. Capitalisation: the project is ScrubPony, the binary is lowercase scrubpony. Keep that split — nobody wants a capital letter in a shell command.

The family

ScrubPony is one of nine tools by the same developer, all following the same rules: no accounts, no tracking, inspectable code. The others are listed here.

Questions

One developer, one inbox: NorseHorse@norsehor.se. Happy to answer technical questions on the record, and happy to be told a claim on this page is too strong.