What your files say about you that you did not write
Every file carries a second layer that nobody composes deliberately. Social platforms usually strip it on upload; email attachments and file transfers do not — they deliver the original bytes, metadata and all.
Photos: EXIF
A photo from a phone typically carries the exact GPS coordinates of where it was taken, the timestamp to the second, the device make and model, and the camera settings. Location is on by default on both iOS and Android for the camera app, and it is stored inside the file rather than alongside it — so it travels with every copy.
This matters in ordinary situations, not just paranoid ones. A photo of an item for sale carries your home address as coordinates. A picture of a child carries the school. A screenshot does not carry GPS, but a photo of a screen does.
- iPhone: in Photos, tap Share, then Options at the top and turn off Location. This strips coordinates from the copy you send while leaving the original intact.
- Android: varies by phone; Google Photos offers "Remove location" when sharing, and the camera app has a "Save location" toggle for future shots.
- Windows: right-click → Properties → Details → Remove Properties and Personal Information. Works on a selection of files at once.
- macOS / anywhere: re-exporting through Preview drops most of it;
exiftool -all= file.jpgremoves everything if you have it installed.
Office documents
A .docx, .xlsx or .pptx carries the author name, the organisation the copy of Office was registered to, total editing time, and the revision history. If the document was built from an older file, the original author is often still in there — which is how a proposal to one client can arrive carrying the name of another.
Worse, if change tracking or comments were ever used and not accepted, the earlier text is still present in the file even when it does not display. Someone opening it with tracking shown reads what you deleted.
The fix is built in: File → Info → Check for Issues → Inspect Document, then remove what it finds. Do this on the copy you are sending, not on your working file.
PDFs
PDFs carry the producing application, the author field, creation and modification timestamps, and frequently the original filename and full path of the source document — C:\Users\yourname\Desktop\draft-v7-DO-NOT-SEND.docx is a real category of mistake.
And the big one: drawing a black rectangle over text does not remove the text. The characters are still in the file, selectable and copyable, with a graphic on top. This has produced a long line of public embarrassments involving redacted court filings and reports. Real redaction removes the content; a shape does not. If you need text gone from a PDF, use a tool with an actual Redact function, then verify by selecting the area and copying.
Everything else
- Audio and video: recording device, timestamps, sometimes location. Video edits can retain the project name.
- Archives: a zip preserves the timestamps and the folder structure it came from — and in an encrypted zip, the names stay readable without the password. See how safe a password-protected zip really is.
- Source code and exports: commit history in a
.gitfolder, absolute paths in build output, and credentials in configuration files that were never meant to leave a machine. - Screenshots: no GPS, but they capture whatever else was on screen — the tab titles, the notification, the other conversation.
A working habit
Stripping metadata file by file does not scale and gets forgotten precisely when it matters. Two habits do scale: turn off location tagging in the camera app so it never gets written in the first place, and run Inspect Document on anything leaving the organisation. Both are one-time settings rather than per-file discipline.
And be aware of the asymmetry: platforms that re-encode your upload — social networks, most chat apps — strip metadata as a side effect. A file transfer that preserves your file exactly, which is the entire point of a file transfer, preserves the metadata exactly too.
More guides
Six ways to get a file from your phone to a computer — and where each one breaks
Cable, cloud drive, email, messaging apps, local network and transfer services compared: size ceilings, what each one costs you in privacy, and the specific situation where each method falls apart.
Email attachment size limits — and why your file is bigger than you think
The attachment ceiling for Gmail, Outlook, Yahoo, iCloud, Proton and Zoho, why encoding makes your file about 33% larger in transit, and the four ways past the limit.
What end-to-end encryption actually protects — and what it does not
The difference between HTTPS, encryption at rest and true end-to-end encryption, why the key matters more than the cipher, and the four things E2EE will never save you from.
Try SendMyFile
Encrypt a file in your browser and hand it over with a 9-digit code. No account, and it deletes itself.
Try SendMyFile