Your camera writes down where you were

Take a photo on a phone and it records the spot you stood on. Not as a guess — as coordinates, accurate to a few metres, in a block of metadata that travels with the file wherever it goes.

Social networks strip that on upload. They have done it for years, quietly enough that most people have stopped thinking about it. A static site has nobody to do it: blog.sh copied your photo into the archive byte for byte, and nothing in the engine had ever looked at metadata at all. So a picture of a cat on a windowsill published the windowsill.

From 1.2.1 it doesn't. A photo loses its location on the way into the archive — when you add it to a post, and equally when it arrives through any of the twenty-two importers, because they all end up in the same write.

Only the location

The camera, the lens, the exposure, the moment the shutter opened: those stay. They are your own record of your own photograph, and an archive that silently threw them away would be answering a question nobody asked.

One tag matters more than the rest, and it stays too: Orientation. A phone held upright stores the picture sideways and writes down that it should be turned. Delete that tag and every portrait photo on your site lies on its back. Turning the pixels themselves would need an image decoder, and blog.sh runs on the Ruby standard library and nothing else — no gems, by design. Keeping the one tag that matters is what makes this possible without a dependency.

If your site is the kind that wants the place kept — a walking diary, a photo blog where the map is the point — one line turns it off:

media:
  strip_location: false

The photos you already published

Those are left alone. An engine upgrade should not go back and rewrite pictures you put on the web years ago, so nothing happens until you ask.

Ask first what there is to ask about:

./blog.sh doctor

It counts the published photos that still carry a location and says so in one line among the rest of the checkup. If the answer is none, you're done.

If it isn't, this cleans them:

./blog.sh doctor --strip-location

That is the only thing doctor has ever written rather than reported, which is why it has to be asked for by name. It prints how many it changed, and one thing worth knowing before you run it: every rewritten photo gets a new checksum, so your next deploy uploads all of them again. On a big archive that's a real transfer, not a rounding error. Then rebuild as usual:

./blog.sh rebuild

What this doesn't cover

Written down rather than left to be discovered, because a privacy feature that quietly misses cases is worse than one whose edges you know:

• JPEG only. That's what phones produce, and a HEIC converted by the engine arrives as one. Exif in a PNG or a WebP is left alone.
• XMP isn't read. A file can carry a second copy of the coordinates in an XMP packet, and that copy stays.
• A GPS block holding nothing but its own version number isn't treated as a location, and the file isn't rewritten for it. This is more common than it sounds: in one real 2962-photo archive, three photos had exactly that shape — and not one of them had actual coordinates. Counting those would have been a headline made entirely of false alarms.