How it works
DetectMark is a static site with two consent-gated relays, one for provider verification and one for the rewrite. Scanning and cleaning run as code in your browser tab, and no server receives your content during a scan or a cleanup. The exceptions are the optional OpenAI requests described below, each of which runs only after you confirm in a dialog.
- No account required
- No file storage
- No text retention
- Works offline after first load
The exceptions: provider verification and the rewrite
Some watermarks can only be verified by the provider that made them. One such check is live on this site: OpenAI's Content Provenance API, which verifies the SynthID watermark and the Content Credentials that OpenAI embeds in its own images. If you request it after a local image scan, DetectMark shows exactly what would be sent and where, and asks before sending. It never happens automatically, and it never runs on a cleaned copy. That check covers OpenAI-supported signals only: a not-detected result says nothing about other providers or about a file whose marks were stripped.
Send this image to OpenAI’s verifier?
the original file · its exact byte count · api.openai.com · nothing else included
This is the dialog that gates the check, filled in with the real file name and byte count of the image you selected. The same dialog gates the text rewrite, with the character and byte count of the text. Both pass through a relay on this domain that forwards to OpenAI and keeps nothing. Anthropic's text detector is in private preview; when DetectMark gains access, the same dialog will gate it.
Text is decoded to Unicode code points; images are parsed for EXIF, XMP, C2PA and format-specific chunks.
Every finding maps to one of four states: Clean, Found, Unknown, Unsupported. No probabilities, ever.
Removable marks are stripped and receipted. Anything not removable is labeled unchanged, never hidden.
Two consent-gated requests, never automatic. Verify: the original image goes to OpenAI’s Content Provenance API, for OpenAI-supported signals only; a not-detected result says nothing about other providers. Rewrite: the text goes to OpenAI for a full rewrite, shown with a count of how much wording changed and no claim about what it removed.
Questions about privacy
Not during a scan or a cleanup. Detection and cleaning run as code in this tab, on the string or the File object, and zero bytes of your content are uploaded to DetectMark or anyone else. The two exceptions are optional and consent-gated: the OpenAI verification on the Image tab, and the OpenAI rewrite on the Text tab. Each sends your content only after you approve a dialog that states the exact byte count, and the upload counter then shows those bytes.
Yes, and the distinction matters. The browser loads HTML, JavaScript, CSS and font files, and the Image tab lazily loads the Content Credentials module and its WebAssembly file. None of those requests carry your content. The "0 B uploaded" counter tracks your content specifically, not total network activity.
There are no account cookies and no session replay. Cloudflare serves the site, keeps standard request logs the way any host does, and uses the cookieless Cloudflare Web Analytics beacon, which measures page-load timing and cannot read what you scan.
No. There is no server-side processing or storage of scanned content, and the site is prerendered static files. The optional OpenAI check and the optional OpenAI rewrite each use a small relay endpoint on this domain that forwards your content to OpenAI and keeps nothing, because the API keys have to live on a server rather than in your browser. What OpenAI does with content you send is governed by OpenAI’s own policies.
Because the claims are checkable. Open the network panel and watch a scan run without sending your text. Read the verdict labels and see that none of them is a percentage. Read the limits page, which lists what the tool cannot do.