Privacy Policy

Two different things get conflated in privacy policies, so this one separates them. Your files are never uploaded. Your visit does involve advertising and third parties, like most free websites. Both are described plainly below.

Last updated: 12 September 2026

1. Your files are not uploaded

Every conversion — images, HEIC photos, PDFs, Word documents, spreadsheets, configuration files, EPUB books, audio and video soundtracks — runs as JavaScript inside your own browser, on your own device. Generating a QR code and reading one out of an image work the same way.

Files are read into your device's memory, processed there, and written back out as a download. They are not transmitted to this website, to its host, or to any third party, including the advertising described in section 4. No copy is created anywhere outside your device, so there is nothing to retain, inspect, sell or lose in a breach.

Files are discarded when you close or reload the tab. Nothing about them persists between visits.

How to verify this yourself

Do not take the claim on trust. Two checks, both about a minute:

• Network tab. Open your browser's developer tools, switch to the Network tab, and convert a file. You will see the page itself, the conversion library for the format you chose, web fonts, and requests to Google's advertising servers. You will not see your file being sent anywhere. The ad requests are worth noticing rather than hiding — they are described in section 4, and your file is not part of them.
• Offline test. Load the page, use the format you want at least once so its library downloads, then disconnect from the internet and convert another file of that type. It still works. One caveat, for accuracy: libraries load on demand, so if you go offline before ever using a given format, that format will not work until you reconnect once.

2. What the site does not do

• No user accounts, logins or profiles.
• No first-party analytics — no Google Analytics, no visitor counter, no heatmaps, no session recording.
• The tool sets no cookies of its own and writes nothing to your browser's local storage.
• No email address or other contact detail is requested or collected.
• Your QR codes are not recorded. They are static codes: scanning one never contacts this site, so no scan data exists.

This list is about the tool and the site operator. It is not a claim that no tracking happens on the page at all — the advertising in the next section does track, and pretending otherwise would make the rest of this document worthless.

3. Hosting and server logs

The site is hosted on Cloudflare Pages. As with any web host, Cloudflare processes standard request data when a page is delivered: your IP address, the time and page requested, approximate region, and browser and device type. It is used to serve the site and protect it from attacks.

Cloudflare acts as a service provider here, under its own privacy terms. The site operator keeps no separate logs and does not combine this data with anything else.

4. Advertising

This site is free and carries no paid tier. It is funded by advertising served through Google AdSense. Being direct about what that involves:

• Google, as a third-party vendor, uses cookies to serve ads on this site.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and to other sites on the internet. That is cross-site tracking, and it is how the advertising is funded.
• Other third-party vendors and ad networks in Google's system may also set or read cookies, use web beacons, or process device identifiers to serve and measure ads.
• Advertising may be personalised based on that data, or non-personalised where you have refused consent or where required by law.

More detail on how Google uses information from sites that use its services is at policies.google.com/technologies/partner-sites.

Your choices

• Opt out of personalised advertising by Google in Google Ads Settings.
• Opt out of participating vendors' use of cookies for personalised advertising at aboutads.info/choices or youronlinechoices.com in Europe.
• Block or delete cookies in your browser settings at any time.

None of these choices restricts the tools on this site. Every conversion and QR feature works identically with all cookies blocked, because the tools do not use cookies at all.

The site operator does not receive, store or have access to the personal data involved in ad serving, and sees only aggregate reporting such as impression and click totals.

Visitors in the EEA, the UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, a consent message is shown before advertising cookies are set, and you may accept or refuse them. Refusing means you see non-personalised advertising instead; it has no effect on any feature of the site. You can change your choice later through the same message.

These messages are provided through Google's consent management, so the choice you make is passed to Google and its advertising partners automatically.

Visitors in the United States

If you are in a US state with a consumer privacy law — including California, Colorado, Connecticut, Virginia, Texas, Oregon and others — a privacy message is shown giving you a choice about personalised advertising, and you may change that choice at any time through the same message.

Stated plainly, because the terminology is confusing: no money is received for your personal information, and the site operator does not sell data in the everyday sense. However, allowing advertising partners to use cookies for cross-context behavioural advertising may itself qualify as a "sale" or "sharing" of personal information under the California Consumer Privacy Act as amended, and as targeted advertising under other state laws. Opting out through the privacy message directs Google to apply restricted data processing, meaning advertising is served without that personalisation.

Depending on your state, you may also have rights to know what personal information is collected, to request its deletion or correction, to obtain a portable copy, and not to be discriminated against for exercising any of these. This site operates no account system and holds no visitor records, so in practice there is nothing for the operator to disclose or delete. Requests concerning advertising data are handled by Google, and can be exercised through the privacy message or the opt-out links above.

5. Legal bases for processing

For visitors covered by the GDPR or UK GDPR:

• Consent — for advertising and measurement cookies and any personalisation based on them. Requested before those cookies are set, and withdrawable at any time.
• Legitimate interests — for the server request data needed to deliver the site securely and keep it available, as described in section 3.

Your files are not covered by any of this, because they are never processed by anyone but you.

6. Third-party code loaded by the page

Conversion libraries download only when you first use a feature needing them, from cdnjs (operated by Cloudflare) with jsDelivr as a fallback if the first fails. They are: pdf.js and pdf-lib for PDFs, SheetJS and PapaParse for spreadsheets, Mammoth for Word documents, jsPDF for PDF creation, Marked and Turndown for Markdown and HTML, JSZip for archives, heic2any for iPhone photos, lamejs for MP3 encoding, jsQR for reading QR codes, js-yaml for YAML, and qrcode-generator for creating QR codes.

Requesting a file from a code network reveals your IP address and browser details to that network, as loading any external resource on any website does. Only program code is downloaded; your files are never part of those requests. Web fonts load from Google Fonts on the same basis.

7. Data retention

Your files: not retained, because never received. Server request data: retained by Cloudflare under its own schedule. Advertising data: governed by Google's retention practices, described in its policies. The site operator maintains no database of visitors and therefore retains nothing directly.

8. International transfers

Cloudflare and Google operate globally, so delivering this page and its advertising may involve processing outside your country, including in the United States. Those providers rely on their own transfer safeguards, such as standard contractual clauses, set out in their privacy policies.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to data portability, to opt out of targeted advertising or the sale or sharing of personal information, and to complain to a supervisory authority. Section 4 describes how these choices are offered to visitors in Europe and in US states with consumer privacy laws.

The site operator holds nothing to act upon, running no account system and keeping no visitor records. Requests about the server data in section 3 or the advertising data in section 4 should go to Cloudflare and Google respectively, or be exercised through the opt-out links above. EU and UK visitors may complain to their national data protection authority.

10. Children

This is a general-purpose utility, not directed at children, and does not knowingly collect personal information from anyone under 13. Since the site collects nothing directly from any visitor, nothing is held about anyone regardless of age.

11. Security

The site is served over HTTPS with HSTS enabled, so connections are encrypted and browsers are told to refuse an unencrypted connection to this domain. The more meaningful protection is structural: files that are never transmitted cannot be intercepted in transit or exposed by a breach of a server, because no server ever holds them.

12. Changes

If this policy changes, the date at the top is updated. Material changes to what is collected or who receives it will be described here rather than made quietly.

13. Contact

Questions about this policy or about privacy on this site can be sent to [email protected].