File privacy checklist
You are about to send a file — attach it to an email, upload it to a form, drop it in a shared folder. Before you do, a thirty-second check can prevent the kind of data leak that no one notices until it causes a problem. This is not about paranoia. It is about the gap between what a file shows on screen and what it actually contains.
Photos (JPEG, HEIC, PNG, WebP)
Check for these before sharing any photo taken with a phone or camera:
- GPS coordinates. Most phones embed your exact location in every photo by default. This is the single most sensitive piece of metadata in a photo file. If the photo was taken at your home, your workplace, or a location you would prefer to keep private, strip the coordinates before sharing.
- Date and time. The timestamp tells the recipient exactly when the photo was taken, down to the second. Usually harmless, occasionally revealing.
- Device information. Camera make, model, and sometimes a unique serial number. This fingerprints the device that took the photo.
How to check: drop the file into MetaScrub's photo metadata viewer to see every field. On Windows, right-click the file, Properties, Details. On iPhone, use the share sheet's Options menu to remove location when sharing.
PDFs
PDF metadata is less dramatic than photo GPS coordinates but still worth checking:
- Author name. Often pulled from your OS username or the application that created the PDF. If you are sending a document on behalf of someone else or anonymously, your name should not be in the metadata.
- Creation software. Reveals what application and operating system you use. Minor, but potentially useful for social engineering or targeted attacks.
- Document title. Sometimes carries an internal title that differs from the filename — and might be more revealing than the filename you chose.
- Hidden layers or redacted content. If you placed a black rectangle over sensitive text in a PDF editor, the text underneath may still be selectable and copyable. This has caused real data breaches in legal and government documents.
How to check: use MetaScrub's PDF metadata remover or open the PDF in Adobe Acrobat and go to File, Properties.
Word documents (.docx)
Word files are the most metadata-rich common format:
- Author and last saved by. Your name and possibly your colleague's name if they edited it last.
- Company name. Pulled from your Office installation settings.
- Revision count and total editing time. Tells the recipient how many times the document was saved and approximately how long you spent on it. In a consulting context, this can undermine a billing narrative.
- Track Changes history. Even after accepting all changes, hidden revision markup can persist in the file. Someone opening the file and enabling Track Changes display could see deleted text, earlier drafts, and editor comments.
- Comments. Internal notes that were meant for collaborators, not for the final recipient.
How to check: in Word, go to File, Info, Check for Issues, Inspect Document. The Document Inspector lists every category of hidden data and lets you remove them selectively.
The thirty-second version
Before sharing any file with someone outside your immediate team, answer three questions:
1. Does this file contain my location? Only applies to photos, but it is the highest-stakes question. A single GPS coordinate can identify your home address.
2. Does this file contain my name or my organisation's name? Check the metadata, not just the visible content. Author fields are populated automatically and easy to overlook.
3. Does this file contain content I thought I removed? Track Changes in Word, hidden layers in PDF, previous versions embedded in the file structure. If you deleted or redacted something sensitive, verify it is actually gone — not just invisible in the default view.
If the answer to any of these is yes and you did not intend it, clean the file before sending. The tools exist, they take seconds, and the alternative is finding out too late that you shared more than you meant to.