EXIF Data Stripper

Free — GPL coresize Splanned, not built

Generated from docs/plan/core/exif-data-stripper/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

EXIF Data Stripper removes location, camera model, and timestamp metadata from uploaded images before storage. A merchant’s product photo taken on their iPhone leaks their GPS location and camera model in the image metadata. Stripping EXIF is a privacy baseline, not optional. This is core GPL functionality: infrastructure, honest metadata scrubbing, no per-country obligation (but GDPR-aligned baseline).

The problem

Merchants’ product photos leak location data (GPS), camera model, and timestamps when uploaded to the web. EXIF metadata is invisible to humans but readable to anyone. This is a privacy and security risk, especially for merchants with physical locations.

What it does

• Auto-strip EXIF on upload: remove GPS, camera model, timestamp, software metadata
• Preserve color profile: ICC color space metadata retained (required for correct image display)
• Audit log: track EXIF removal per image (what was removed, timestamp)
• Batch strip: if merchant uploads 100 old photos, strip EXIF from all
• Validation: scan uploaded image for remaining sensitive metadata, log if found

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• EXIF-based geolocation service (show on map where photo was taken) — scope is removal only; geolocation is separate
• AI-based metadata inference (infer location from image content) — scope is EXIF stripping only; inference is separate

Data model

Extend asset metadata: stripped_exif_fields = [‘GPS’, ‘DateTimeOriginal’, ‘Model’]. No schema migration.

API

• No API changes; EXIF stripping is automatic on upload

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Asset detail view shows ‘EXIF data: removed’ with list of fields stripped. Audit log shows removal timestamp.

The seam — why this is core

Core owns: EXIF detection and stripping, audit log. No paid pack owns this; it’s infrastructure.

Core owns the interface + honest metadata scrubber; EXIF stripping is infrastructure, not a support commitment or credential.

Dependencies

• core-audit-log (EXIF removal logged)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Upload JPEG with EXIF GPS coordinates; stored image has no GPS metadata
• Upload JPEG with camera model ‘Canon EOS 5D’; stored image has no model metadata
• ICC color profile preserved after EXIF strip (image displays correct colors)
• Audit log shows ‘EXIF: removed GPS, DateTimeOriginal, Model’ for each image

Risks

Over-aggressive stripping removes ICC color profile; image displays wrong colors. EXIF stripping library vulnerability (malformed EXIF causes crash). Audit log missing removes verifiability of privacy protection. Merchant uploads image, EXIF stripped, but metadata persists elsewhere (filename, HTTP headers, reverse image search); education needed.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.