Blur the faces you cannot publish.
Open a class photo or a whole sports day. Shadecote finds the faces and lists them beside the picture. You choose who stays out, and the finished file saves to the machine in front of you. The photograph itself never leaves your device: processing is 100% in the browser, with no upload and no server involved, so there is no DPA to sign.
- 100% in-browser
- No upload
- UK GDPR-aligned by design
Free to use today, with nothing to install.
- Photograph pixels sent
- 0 bytes
- Other servers contacted
- None
A photo goes in, and a publishable photo comes out.
Four steps, in order. No setup and nothing to learn — pick it up and work through your photos.
-
1.0
Open the photographs.
Drag in one class photo or a whole event. They open directly in your browser, so nothing installs and nobody has to ask IT. Add more part-way through and earlier work stays as it was.
-
2.0
The faces are found and numbered.
The detector runs on the machine and lays out every face it finds in a review grid beside the photograph, so a small back-row face is shown at a size you can judge.
-
3.0
Mark the ones who stay out.
Work down the grid with the consent register beside you. Click on a face to blur it, click again to put it back. If the detector missed someone, draw a rectangle or an ellipse over them and they get the same blur.
-
4.0
Export, onto the machine you are sitting at.
One photo saves as
<name>-redacted.png. Two or more save as a single zip. Marking a photo reviewed records that you looked at it.
Why this is GDPR-simple.
The meter above is the proof. This is what it means under UK GDPR.
-
Data minimisation
We collect no photograph data whatsoever. Face detection and blurring run entirely in your browser; only the image's byte count is ever measured, never its pixels.
-
No data transfers
No photograph ever leaves your device, so there is no cross-border transfer, no Schrems II question, and no sub-processor to name for the redaction step.
-
No processor relationship
Your browser is the processor. Shadecote never receives, stores or processes the photograph itself, so there is no data processing agreement to sign for it.
-
Erasure by design
Once a face is blurred, there is nothing left to erase. The original pixels are discarded in your browser and never sent anywhere to be deleted later.
“…blurring the picture with no retroactive ability to recover the personal data that the picture previously contained, the personal data are considered erased in accordance with GDPR.”
— EDPB, Guidelines 3/2019 on processing of personal data through video devices , §103
“Available techniques include blurring, masking, or using a solid fill to completely obscure parts of the footage.”
— ICO, Guidance on video surveillance, including CCTV
Your school remains the data controller throughout.
A soft blur, shaped to the head.
Shadecote blurs through a mask cut to the head and feathered at its edge. Black rectangles and pixel mosaics announce that something was hidden. A feathered blur leaves the photograph looking like a photograph, with one child in it who cannot be recognised.
There is no strength slider to get wrong. Every face gets the same soft blur, whether the tool found it or you marked it by hand, so a whole batch comes out looking like one set.
What it is, exactly.
For whoever has to sign this off — exactly what Shadecote does with your photos, in plain terms.
| Runs in | The browser already on the machine. Nothing installs and no administrator is needed. |
|---|---|
| Photographs uploaded | None. Detection, masking, blurring and export run in the page. No photograph pixels are sent off the device. |
| Photographs stored | None. Close the tab and the session is gone. There is no history and no cache of the photographs, so there is nothing to purge later. |
| Account | There is a sign-in, a free 60-day trial and one yearly price for the whole school. Your photographs stay out of it. |
| What gets sent to the server | How many photographs you put through and how many faces you blurred in each. Those counts are your own usage record. The subscription is not metered on them, and the image itself is never part of it. |
| Missed faces | Drawn by hand as a rectangle or an ellipse, then treated exactly like a detected one. |
| One photo out | <name>-redacted.png |
| Two or more out | A single zip, shadecote-redacted-<timestamp>.zip |
| Export size | Up to 1280 px on the long edge, which suits a website, a newsletter or a social post. |
One yearly price for the whole school.
Try it free for 60 days. After that, one subscription covers the whole school, however many photographs you put through. There is no monthly option and nothing is metered per photograph.
Full access for the whole 60 days. No card needed.
The whole school, unlimited photographs and up to five sign-ins. Billed once a year.
Up to five schools on one account, with central billing and a single invoice.
Prices exclude VAT.
What schools ask before trying Shadecote.
Is Shadecote GDPR compliant?
No product can be "certified" against GDPR, so treat anyone who claims it with suspicion. What we can show you is the architecture: face detection and blurring run entirely in your browser, the photograph never reaches a server, and the "Why this is GDPR-simple" section above maps that onto the GDPR principles one by one, citing the EDPB and ICO's own positions on blurring as erasure. Check it against DevTools yourself rather than take our word for it.
Are my photos uploaded anywhere?
No. Open your browser's DevTools, switch to the Network tab, then open a photo and export it: no image ever appears there as a request going out. See the next answer for how the processing itself stays off the wire.
Do the photographs leave the computer?
No. Finding faces, cutting the masks, blurring and zipping all happen inside the page. The only thing that comes down the wire is the face models, once per session. The counter near the top of this page weighs every request the page makes while you read, so you do not have to take our word for it.
You said a subscription. What does the server see?
Your account, and counts: how many photographs went through and how many faces you blurred in each. Those counts are your own usage record, and the subscription is not metered on them. The server also checks whether a trial is still running. The photographs are not part of any of it. They stay on your machine, and the blurring happens there too. That is the boundary a school's data protection lead can assess.
What if it misses a face?
Sometimes it will. Small faces in a back row are the hard case: on the reference class photograph of 26 faces, the detector found 25. Draw over anyone it missed and they are blurred the same way. Noticing is still your job. The review grid makes a face hard to miss by accident. It does not make missing one impossible.
Can the blur be undone?
Not from the exported file. The blur is written into its pixels, and nothing saved with the file maps back to the original. Your original photograph is untouched, wherever it already was.
Where do the finished files go?
Wherever the browser puts downloads on that machine. Shadecote cannot put them anywhere else, because it has nowhere else to put them.
Does it work on a school laptop?
It is built for one: a managed Windows laptop or a Chromebook, with no graphics card assumed. We are still measuring which browsers run it well, so try it on the machine you will actually use before you plan around it.
What does it cost?
Nothing today. When the subscription opens, a school pays £120 a year excluding VAT, however many photographs it puts through, with a free 60-day trial first. Multi-academy trusts start at £500 a year. Nothing is metered per photograph, and the tool in front of you is free to use until then.
Do I need a data processing agreement for this?
Not for the redaction step. Your browser is the processor: Shadecote never receives, stores or processes the photograph, so there is nothing for a DPA to cover there. See "Why this is GDPR-simple" above for the rest of the mapping.
What happens when I close the tab?
Whatever was not exported is gone. Nothing is kept between sessions: no draft, no history, no cache of the photograph. Reopen it and start again if you need to.
Do you use cookies or analytics?
A single session cookie to keep you signed in, and nothing else. There is no analytics running on this site, of any kind, so there is none to name.
Are blurred photos safe to publish, email in a newsletter, or send in a subject access response?
Yes. The blur is written into the exported file's pixels: nothing saved with it maps back to the original, and there is no way to reverse it from the file alone. That is the same test the EDPB and ICO guidance above rely on for treating a blurred image as erased.
For your DPO.
Face detection and tracking run entirely inside the browser tab, drawing every mask onto a canvas local to that tab. The tool makes no outbound request carrying a photograph at any stage.
Data flow
File, browser memory, blurred download. No server, no queue, no retention.
Where this helps with a lawful basis
- Consent withdrawal. When one parent withdraws consent, blur that child rather than delete the whole photograph, keeping the rest of the record intact.
- Subject access request. Redact third parties from a photograph before disclosing it in response to a request.
- Safeguarding. Prepare a photograph for external use without exposing a child a safeguarding plan requires kept out of publicity.
Controller and processor
Your school remains the data controller for every photograph. Shadecote is not a processor for the redaction step: nothing is transmitted, so there is no sub-processor to name and no data processing agreement required for that step. Where the service does act as a processor, for account and usage records, that is limited to the counts described above.
Try the whole process on a synthetic class photo first.
Nothing is decided until you export, and nothing is kept after you close the tab.