MiniFiles.io
All articles
Privacy6 min13 April 2026

Is TinyPNG Safe? What Happens to Your Uploaded Images

TinyPNG is one of the most popular image compression tools on the internet, trusted by teams at Airbnb, Microsoft, and Samsung. But as awareness of data privacy grows — especially in business and legal contexts — a simple question keeps coming up: is TinyPNG actually safe to use? What happens to your images when you upload them? Are they stored? Could they be accessed? This article examines exactly how TinyPNG works under the hood, what its privacy policy says, and when you should consider a client-side alternative instead.

How TinyPNG Actually Works

TinyPNG is a server-based compression tool. When you drop an image into TinyPNG's interface, the image is uploaded over HTTPS to Tinify's servers (owned by Voormedia, a Dutch company). Tinify's algorithms — primarily smart lossy compression using selective colour palette reduction for PNGs and MozJPEG for JPEGs — process the image on their hardware. The compressed result is then sent back to your browser and offered for download. At no point in this process does any compression happen locally on your device. Your original file travels over the internet to a third-party server, is processed there, and the result is returned. This is fundamentally different from browser-based tools that use WebAssembly to compress images locally.

What TinyPNG's Privacy Policy Says About Your Images

According to Tinify's documentation and privacy policy, uploaded images are stored temporarily and automatically deleted after a short period (typically within a few hours). Tinify states that images are not retained, shared with third parties, or used for training AI models. The company is based in the Netherlands, which means it falls under GDPR jurisdiction and EU data protection law. For most individual users and small projects, this is acceptable. However, the key word is 'temporarily' — the image does leave your device, does exist on a third-party server, and is only deleted subject to Tinify's own policies and infrastructure. You are trusting a third party's promise about deletion.

When TinyPNG Is Not Safe to Use

There are several categories of images where uploading to TinyPNG (or any server-based tool) creates genuine risk. (1) Confidential business assets: unreleased product photos, internal documents with embedded images, NDA-protected materials. (2) Personal data images: photos containing visible PII such as ID documents, medical scan images, passports. (3) Client work: if you are a designer or photographer handling work under contract, the client's files should not be uploaded to third-party servers without explicit consent — this may constitute a data processing violation under GDPR Article 28. (4) Healthcare: any image containing patient information is subject to HIPAA in the US. (5) Legal: court documents, evidence photos, legal filings with embedded images.

The GDPR Reality of Server-Based Image Compressors

Under GDPR, uploading images containing personal data to a third-party service makes that service a 'data processor', and your organisation a 'data controller'. This requires a Data Processing Agreement (DPA) with the service. TinyPNG does not offer DPAs for free-tier users. The Pro/API plan includes more robust documentation, but the free tool used by most individuals has no formal DPA. If your organisation handles personal data and routinely uses TinyPNG to compress images (such as profile photos, employee headshots, or customer-submitted images), you may be in violation of GDPR Article 28 without a DPA in place. The maximum fine is 4% of annual global turnover or €20 million, whichever is higher.

Client-Side Alternatives: How Browser Compression Works

Browser-based compression tools like MiniFiles, Squoosh (Google), and imagecompressor.com use WebAssembly to run compression algorithms directly inside your browser, using your device's CPU and RAM. Nothing is ever uploaded. The process is: your image file is read from disk into browser memory, the compression codec (such as MozJPEG, libwebp or UPNG.js, depending on the tool) runs locally, the compressed result is written back to your browser's memory, and you download it. There is no network request carrying your image data. It is technically impossible for the tool's server to access your image because the image is never sent there. This is the most private way to compress images.

TinyPNG vs MiniFiles: Side-by-Side Comparison

TinyPNG: server-based upload, PNG/JPEG/WebP/AVIF supported, 20 images free (5 MB each), Pro plan for API access, developer-focused, trusted by major brands. MiniFiles: client-side browser processing, JPEG/PNG/WebP/GIF supported (also PDF compression and PDF password protection), no upload ever, 10 files per day as a guest and unlimited with a free account, no file data leaves the device. For pure compression quality, both tools produce excellent results using comparable codecs. The material difference is the privacy model: TinyPNG is upload-based, MiniFiles is local-first.

Key takeaways

  • TinyPNG uploads images to Tinify's servers (Voormedia, Netherlands) — images are temporarily stored and deleted after processing.
  • GDPR Article 28 requires a Data Processing Agreement when uploading personal data to third-party services; TinyPNG free tier has no DPA.
  • Categories where TinyPNG is not safe: unreleased business assets, personal data images, client work under NDA, healthcare, legal documents.
  • Client-side alternatives (MiniFiles, Squoosh, imagecompressor.com) use WebAssembly — images never leave the device.
  • MiniFiles also offers PDF compression and PDF password protection, all client-side.
  • Switching from upload-based to client-side compression eliminates GDPR data processor obligations entirely.

Frequently asked questions

Does TinyPNG keep my images?

TinyPNG temporarily stores your images on Tinify's servers during processing and deletes them automatically after a short period. However, your image does leave your device and exists on a third-party server, even briefly. For confidential images, this is a risk to consider.

Is TinyPNG GDPR compliant?

TinyPNG is operated by a Dutch company (Voormedia) and is subject to GDPR. However, the free tool does not include a Data Processing Agreement (DPA), which GDPR Article 28 requires when processing personal data with third-party processors. For business use with personal data images, TinyPNG's free tier may not be sufficient.

What is a safe alternative to TinyPNG that doesn't upload images?

MiniFiles, Squoosh (by Google), and imagecompressor.com all process images entirely in your browser using WebAssembly. Your image never leaves your device. For GDPR-sensitive work, these client-side tools are the safest option.

Is TinyPNG safe for personal photos?

For general personal photos, TinyPNG is safe in practice — images are encrypted in transit and temporarily deleted. The risk increases significantly when images contain personal data (faces, IDs, medical info) or confidential business assets.

Try it now — free

Compress PNG, JPEG, and PDF files in your browser. No upload, no installation.

Compress PNG