Your files
We never receive them. Conversions run in your browser. There is no upload endpoint on this site, no storage bucket, and no backend process — it is a folder of static files served over HTTPS. Nothing to delete afterwards, because nothing arrived.
The same is true of anything you type or paste: JSON, a JWT, a CSV, the two documents
in the diff checker. All of it stays in the tab and is discarded when you close it.
Nothing of yours is written to localStorage at all.
Cookies
Our own code sets none. Your light/dark choice is kept in
localStorage, which is not a cookie and is not sent with any request,
and it is the only thing this site writes there.
The Google tags we load do set cookies, and it would be a distinction without a
difference to call those someone else's. Analytics writes a first-party
_ga cookie on this domain when analytics is enabled. Google's consent
platform stores your choice in a first-party cookie too, which is how it remembers
the answer you gave — a consent record that vanished on reload would be worse than
useless.
In the EEA, the UK and Switzerland none of that is set until you agree: the consent dialog runs before the tags do, and analytics is held off entirely until you say yes. Everywhere else the law is an opt-out regime rather than an opt-in one, so they start enabled and you can turn them off at any time from the link in the footer.
Analytics
Google Analytics 4, page views only. It records that a page was viewed, from roughly where, on what kind of device. It does not and cannot record anything about a file you convert, because no event we send carries a filename, a file size or a MIME type. One careless event of that kind would make the headline claim untrue, and a sceptic would find it in the Network tab within a minute.
Advertising
This site carries Google AdSense. That is what pays for it, and it is the honest alternative to the thing every other converter does — which is to take your file.
What the ad scripts can see is what any script on any page can see: the URL you are
on, your IP address, your browser, and the cookies they set. What they
cannot see is your file. It is never in a request, never in a variable they
can reach, and never leaves the tab. An ad on /heic-to-jpg/ knows you
are on a page about HEIC. It does not know you converted anything, what it was, or
what was in it.
Ads are hand-placed. They sit in the article below the tool — never inside the drop zone, the options or the results — and each is labelled. We do not use Auto ads, which would let Google put one anywhere it liked, including in the middle of the thing you came here to use.
Who we are
This site is operated by ZW Studio LLC, a company registered in the United States, which is the data controller for the little that is described on this page. You can reach us at the contact page.
Because we are outside the EEA and every recipient named below is Google, data that does leave your browser — the access logs, and the advertising and analytics you have agreed to — is processed in the United States and in other countries where Google operates. Google publishes the transfer mechanism it relies on for that; we add nothing to it and hold nothing ourselves.
Server logs
The static host serving these files keeps ordinary access logs: IP address, the URL requested, timestamp, user agent, referrer. That is inherent to how the web works — your browser had to ask someone for this page. Those logs contain no information about any file you convert, because your file is never part of any request.
The lawful basis for keeping them is our legitimate interest in serving the site and in noticing when it is being attacked. They are the host's operational logs, kept on the host's schedule, and we do not export them, join them to anything, or use them to build a picture of you. Advertising and analytics run on consent instead, which is a different basis and one you control.
Third parties
Two, both Google: AdSense for the advertising and Analytics for page views. The consent dialog is Google's own certified consent platform, registered with the IAB Transparency and Consent Framework. Nothing else is in the page — no other tracker, no embedded widget, no CDN script, and the fonts are served from this domain.
An earlier version of this page promised that if advertising were ever introduced we would say so plainly here, with the exact wording of what those scripts can and cannot see, rather than a vague reassurance. The section above is that.
What you can turn off, and how
The Privacy choices link in the footer reopens the consent dialog on any page, whichever country you are in. It lets you withdraw as easily as you gave.
If your browser sends a Global Privacy Control signal, we act on it without your having to ask, and it is worth being exact about what that does. Analytics is switched off before it loads — nothing is sent at all. Advertising is marked as restricted data processing, which is the mechanism the US state laws actually specify: it opts you out of your data being sold or shared, and the adverts become non-personalised. Ads still load, and the request counter on every tool page will show them, because pretending otherwise would be a claim you could disprove in the Network panel in ten seconds.
Twelve US states require that signal to be honoured. Google honours it for eleven of them and not for California, so this does not leave it to Google — and it applies everywhere rather than guessing which state you are in.
Turning advertising off does not turn the tools off. Nothing on this site is gated behind consent, there is no "accept or leave" wall, and no feature works less well because you said no.
Your rights, and what they get you here
If the GDPR applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how it is processed, to receive it in a portable form, and to withdraw consent at any time without that affecting anything done before you withdrew.
Send any of those to the contact page and they reach a person rather than a queue. The honest answer to most will be that there is nothing to send: your files never leave your device, so there is no copy here to hand over, correct or delete. What can exist is the advertising and analytics described above, and those you can switch off yourself without asking anyone.
You also have the right to complain to a data protection authority. In the EEA that is the supervisory authority for the country you live or work in, in the UK it is the Information Commissioner's Office, and in Switzerland the Federal Data Protection and Information Commissioner. You do not need our permission or our involvement to do it.
Children
The site has no accounts and collects no personal information from anyone, of any age.
How to verify all of this
Do not take our word for it. Open your browser's developer tools, go to the Network panel, and convert a file — you will see the ad scripts doing their own thing, and nothing at all carrying your file.
Easier: load a tool page, turn off your Wi-Fi, and convert anyway. It works. A site that was uploading your file could not possibly still function.
The counter at the top of every tool page shows every request the page has made, itemised — “3 from this page, 24 advertising” — with the full list of URLs behind it. It counts the ads too. Hiding them would defeat the point of showing it.
Changes
If this policy changes in any way that affects what leaves your browser, the change will be described on this page in specific terms, not summarised as "we updated our privacy policy".