A converted file can stop saying who made it

[thousandflowers]

Two layers, separable on purpose.

Layer 1 — metadata, deterministic and ship-ready. Three levels (keep all / remove the location / remove identifying metadata) as a step in the chain like any other, so it comes from Settings, or a preset, or a batch, or from the file's own name, in that order of specificity — and history records that it happened.

What is never removed, at any level, is the colour profile and the orientation. They are not information about a person: without them the photograph arrives on its side, in the wrong colours. The tests assert both survive every strip.

What counts as identifying is a list, not a chain of ifs about formats, and a tag on no list is carried across — a conversion that quietly loses something is worse than one that keeps too much. Maker notes are the exception that proves it: they are named after the camera that wrote them, so the shape of the key is the rule rather than a list of cameras nobody can finish. PDFs lose author, creator and producer and keep their title; exports lose location, and at the thorough level go through AVFoundation's own sharing filter.

Reading the filename had to change: only the last piece was read, so holiday_10MB_privacy.jpg lost the size. Tokens are now read from the end and stop at the first piece that is not one, which keeps 10MB_notes.jpg meaning what it always meant.

Layer 2 — assisted redaction, behind its own types. Vision reads faces and text, Natural Language reads that text for names, places and organisations, and all of it arrives as suggestions with every box unticked. The type that burns a redaction into a file takes regions, not a session, so there is no argument it can be handed that means "whatever was found". It misses things, the sheet says so where it cannot be missed, and nothing in the app calls this anonymisation.

Also fixed: choosing a preset now clears every field the previous one set — the metadata level and the size ceiling were left behind, and touching any other field let the preset go and applied the stale answer for real.

Test plan

• swift test — green
• GPS gone, ICC + orientation kept, asserted on a real conversion
• PDF author cleared, pages and title intact
• _10MB_privacy applies both; _privacy classifies as explicit, so no popup
• Precedence: Settings < preset < name
• Nothing redacted without confirmation; only confirmed regions burned in; the original never touched
• Real binary: _privacy stripped GPS and camera make, kept orientation 6 and sRGB; without the token everything was carried across

🤖 Generated with Claude Code

https://claude.ai/code/session_018H9CZxWumc3ryumgEHd578