Privacy

What is received

The server receives one local audio or video body, your selected conversion profile or compression options, and your permission statement. The original filename stays in the browser and is not sent as a server path.

Image and JSON, CSV, or TSV conversions happen in your browser. Their file contents are never uploaded. Closing the page removes the local result; downloaded files remain on your device.

The media tools inspect a limited set of technical fields such as duration, dimensions, container, codecs, and stream counts. Arbitrary embedded metadata is not requested for normal processing and is stripped from output.

Aggregate usage and operator access

Convert stores daily aggregate page views, conversion counts, outcomes, bytes, and processing durations in SQLite for up to 90 days. It excludes filenames, file contents, raw addresses, query strings, and job access tokens. Browser conversion reports are separate from server-verified results and can be blocked by your browser.

The private operator dashboard uses Google sign-in and an explicit email allowlist. Only the operator signs in; public conversions do not require an account. A secure, HTTP-only cookie holds the operator session for a limited time.

Job access

A job uses a random opaque identifier and a separate high-entropy bearer token. The server stores only a SHA-256 digest of that token. Anyone who obtains the live token before deletion may control that job, so keep the browser tab private.

The token is sent in an Authorization header. It is not placed in a URL, public result page, analytics event, or filename.

Retention and deletion

Source media is deleted after successful or failed processing. Completed output expires no later than 60 minutes after completion and may be deleted sooner after the first download plus a short grace period.

You can request immediate deletion from the result state. A restart removes abandoned work directories and honestly invalidates in-progress jobs.

Abuse controls and logs

A trusted deployment may use a short-lived, keyed representation of the client address for in-memory rate limiting. Raw addresses are not metric labels and are not written to application logs by design.

Operational metrics are aggregate counts and durations. Logs are designed to exclude media contents, filenames, tokens, client addresses, embedded metadata, and unredacted media-tool errors.

Network services and advertising

Public requests pass through Cloudflare and an operator-controlled reverse proxy before reaching Convert. Those network services process client addresses and request metadata and may keep separate access or security records under their configured retention policies; Convert's application logs intentionally exclude raw client addresses.

The operator may enable a clearly labeled text sponsor after converter content. The sponsor uses no third-party scripts, pixels, cookies, or automatic requests. Clicking its link opens the sponsor's HTTPS site in a new tab without sending a referrer; that site then applies its own privacy practices.

Google AdSense may be enabled on Convert's public converter pages after Google approves the site and its certified consent messages are verified. Its SDK retrieves Google's consent messages before an ad can be requested. Google and its advertising partners may process device and request information, cookies, and local storage according to the consent choices and regional rules. Convert does not add filenames, file contents, job IDs or access tokens to advertising requests.

The manual ad unit remains paused when consent is missing, refused, unknown or withdrawn, and when Global Privacy Control is enabled. Use Privacy and cookie settings on a converter page to revisit European choices, or Google's Do not sell or share link when US state rules apply. Changing choices removes the unit without clearing your selected file. Normal free conversions and downloads remain available. Google explains its data use at https://policies.google.com/technologies/partner-sites and its privacy policy at https://policies.google.com/privacy.

The operator dashboard, policy pages and error pages load no advertising or consent SDK. Sponsor or Google display-ad views and clicks do not grant extra conversions. Survey and Arbor integrations are not active.