Users upload photos, and you must not keep their coordinates

Why this matters more than it looks

That is why stripping is not a setting you can forget to switch on. It is part of the intake path, and the path has no branch that skips it.

The whole intake, in order

1. The type is read from the bytes, not from the file name and not from what the client claims it is.
2. The file is scanned for viruses. If the scanner is unreachable, intake answers 503 instead of letting the file through: passing a file while the check is down would be a lie about work done.
3. The image is re-encoded into the named variants. This is where metadata is dropped.
4. SVG is refused. It is a script container, not a picture, and it is never accepted and never served.

POST /api/v1/put?kind=review&key=r-9912&variants=thumb,card&owner_ref=user-4471
X-Media-Tenant: yourapp   X-Media-Key-Id: k3
X-Media-Ts: 1758300000    X-Media-Sign: <HMAC-SHA256>

The owner_ref is the point where the next question is already answered: when that person asks you to delete their data, one call erases everything of theirs and tells you how many objects it erased. See storing user uploads.

If any object under this owner_ref is linked to a Keepix stock item, including a withdrawn item, erase returns 409 asset_in_stock before deleting anything. The original must stay available for existing licences. Keep stock and ordinary uploads under different owner_ref values; account closure needs a separate review.

What it costs

The free plan needs no card. Paid plans start at $5 a month, and the metadata stripping is not an extra: it is the same intake on every plan.