NearScrub

2026-10-05

Does Reddit remove your photo's GPS data? Only if you upload it there — not if you link to one, and its own pipeline already missed once

A huge amount of ordinary photo-sharing happens on Reddit: a used graphics card on r/hardwareswap, a month-twelve tretinoin check-in on r/tretinoin, a lost cat flyer on a local subreddit, a "is this mold" post in r/HomeImprovement. All of it raises the same quiet question — if that photo still has a GPS coordinate sitting inside it from the moment your phone took it, does posting it on Reddit hand that coordinate to everyone who opens the thread? The honest answer is: it depends entirely on which of two completely different things your post actually is, and Reddit's own bug-bounty history shows that even the half that's supposed to protect you has already failed once.

What happens when you actually upload a photo to Reddit

When you post an image through Reddit's own uploader — the button in the post composer, not a pasted link — the file goes to Reddit's media host (i.redd.it) and gets re-encoded before it's served back out. That re-encoding exists mainly for ordinary engineering reasons: consistent formats, smaller files, faster loading across the site's CDN. It isn't advertised anywhere as a privacy feature. But stripping most EXIF data — including GPS — is a predictable side effect of fully re-encoding an image, which is why a photo you upload directly to Reddit typically arrives at other people's screens without the location tag it left your phone with.

The one documented case where that pipeline kept the GPS tag anyway

"Typically" is doing real work in that sentence. A vulnerability report publicly disclosed on HackerOne as report #1069039, titled "Reddit: GPS metadata preserved when converting HEIF to PNG," documents a specific conversion path — HEIC/HEIF photos, the format iPhones save to by default unless you've changed Settings → Camera → Formats to "Most Compatible" — where Reddit's own server-side conversion to PNG kept the original GPS coordinate instead of dropping it, the opposite of what that pipeline is supposed to do. Reddit fixed it; the report is closed. The point isn't that this specific hole is still open — it's that the mechanism people rely on to make this a non-issue is a piece of server software with its own bug history, not a guarantee written into how Reddit works.

Two ways a photo ends up in a Reddit post Upload directly (i.redd.it) File goes through Reddit's own media pipeline and gets re-encoded for display. Usually strips GPS — but HackerOne #1069039 (2020) found one HEIC→PNG path that kept it instead, before Reddit fixed it. Link to a photo elsewhere Post just points to a URL — Imgur, a personal site, a cloud share — not a file. Reddit never touches it: whatever metadata that original file carries, GPS included, reaches every viewer unchanged.
Only one of these two paths is ever processed by Reddit at all. A link post isn't an edge case the pipeline missed — Reddit was never handed the file in the first place, so there was never anything for it to re-encode.

A link post was never going to be touched, pipeline bug or not

This half doesn't depend on Reddit fixing anything. When a post (or a comment, which renders an external image URL the same way) just points to a photo hosted somewhere else — Imgur, a personal website, a cloud storage share link — Reddit never receives that file. There's nothing to re-encode, because nothing was uploaded; Reddit is just displaying a URL you pasted. Whatever EXIF, GPS, or XMP data sat inside that image before you linked to it is exactly what every person who opens the image gets, forever, independent of anything Reddit's own upload pipeline does or doesn't strip. This is true of every link post regardless of file format, and it's true whether or not the HackerOne bug above was ever fixed.

What a scrub before you post changes here — and the one format it can't reach

Running a JPEG or PNG through a client-side scrub that drops EXIF/GPS and XMP data — entirely in the browser, no upload, no server, the way NearScrub works — before you post it anywhere removes the coordinate from the file itself. At that point it doesn't matter which of the two paths above your post takes: upload it directly and there's nothing left for Reddit's pipeline to strip or fail to strip; link to it from elsewhere and there's nothing left for that link to carry unchanged either. One honest limit, specific to this situation: NearScrub supports JPEG, PNG, PDF, and Office files, not HEIC — and HEIC/HEIF is the exact format an iPhone saves to by default (Settings → Camera → Formats → "High Efficiency") and the one named in the HackerOne report above. If your photo is still a .heic file, you need to convert it to JPEG first — your phone's own share sheet or Photos export will do that — before NearScrub has anything it can scrub. And a scrub only ever touches a file at the moment you choose to run it through: it does nothing for a photo someone else has already posted, a copy you shared before you started scrubbing, or an image you're linking to that's sitting on a server you don't control.