Like JPG, HEIC files embed EXIF metadata: capture time, GPS coordinates, device model, lens settings, even altitude. With Location Services enabled for the camera — the iPhone default — a selfie at your front door can ship with coordinates accurate to a few meters of your address.
📍 GPS coordinates: precise enough to identify a specific building
🗓️ Timestamps: down to the second — enough to infer daily routines
📱 Device model: an "iPhone 17 Pro" tag says something about spending habits
🖼️ Original resolution: hints at whether a pro camera was used
🔋 Serial details: in rare cases traceable to a specific device
Real-world incidents follow a pattern: work badges photographed with office GPS, school-uniform photos of kids with timestamps that reveal pickup routines, secondhand-listing photos carrying home coordinates.
Not necessarily. Many converters carry EXIF across deliberately — JPG's metadata support is even more mature than HEIC's. Treating "convert" as "sanitize" is the classic mistake. Keep the two jobs separate: conversion solves compatibility, metadata removal solves privacy. When you need the second, choose an explicit "remove location" option or use a dedicated scrubbing tool.