What a camera writes into every shot
A photograph is two things at once: the picture, and a record the camera keeps about how and where the picture was made. That record holds the GPS coordinates to within a few metres, the make and model of the device, which lens was used, the exact second of capture, and on many cameras a serial number unique to that body. None of it is visible when you look at the image.
Reading it without special software
Right-clicking a photo and opening Properties or Get Info shows a portion of this on any operating system, usually the camera and the date. What it rarely surfaces is the GPS block, the owner name, or the embedded preview that may pre-date your crop. That is the part this page reads.
What the score means
The report groups findings by what they actually disclose rather than by which part of the file they came from. Location and identity are treated as high risk because they point at a person. Device and timestamp are medium, because they narrow a field rather than name someone. Software is low, because it describes your tools rather than you.
Checking is not the same as cleaning
Reading the metadata changes nothing about your file. If you want it gone, the same page will rewrite a copy without it and then re-check that copy to prove it worked. The original on your disk is never touched.