Privacy policy

In short

• Uploaded files and results are only converted and deleted automatically — usually after 1 hour.
• No ads, no tracking, no analytics tools, no social media plugins.
• Only strictly necessary cookies, so there is no cookie banner.
• Your data is never sold or passed on, except to the service providers listed below who help run this website.

Uploaded files

When you convert a file, it is stored together with the result in Cloudflare R2 storage in the EU and converted automatically on my server. Nobody looks at the files; they are used for nothing but the conversion.

Files are deleted automatically: after 1 hour, for Pro accounts after 24 hours at the latest. The file name, format, size and time of the conversion are also stored — for guests as long as the file, for accounts as history for 7 days (Pro: 30 days).

The legal basis is Art. 6(1)(b) GDPR (carrying out the conversion you asked for).

Server log files

When you open the website, the web server stores technically necessary data: IP address, date and time, the address requested, status code and browser identifier (user agent). The application itself logs requests without IP addresses and without file names.

Log files serve security and troubleshooting and are overwritten automatically once they reach a fixed size — usually after a few days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Cookies

Only cookies that are strictly necessary for the website to work are set (§ 25(2) TDDDG); no consent is needed for them:

• convertr_visitor — a random identifier, so that you see only your own files. 30 days.
• convertr_session — keeps you logged in, only if you use an account. 30 days after your last visit.
• NEXT_LOCALE — the language you chose. 1 year.

Protection against abuse

To prevent overload and abuse, the website counts requests, uploads and login attempts per IP address. These counters live only in memory and expire at the end of their time window — after a minute, an hour or a day, at most after a month. The legal basis is Art. 6(1)(f) GDPR.

User account

An account is optional. It stores your email address, your password (only as an Argon2 hash), the date you signed up, your plan, your conversion history (see above) and how much of your limits you used (without IP addresses).

The data is kept until you delete the account — you can do this yourself at any time in your profile. The account, its files and history are deleted at once. The legal basis is Art. 6(1)(b) GDPR.

Emails

Your email address only receives messages you trigger: confirming the address and resetting the password. No newsletter, no advertising. An email service provider sends them as a processor.

Statistics

The website counts conversions only as daily totals (e.g. “120 conversions from JPG to PNG”) — without file names, accounts or IP addresses. These totals are not personal data.

Service providers and transfers outside the EU

Processors under Art. 28 GDPR help run the website:

Cloudflare, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework; transfers to the USA take place on this basis (Art. 45 GDPR).

• a hosting provider in the EU — the server the website and the conversions run on;
• Cloudflare, Inc. — domain, DNS and the R2 file storage (location: EU);
• an email service provider — sending the emails mentioned above.

Backups

The database (accounts, history, settings — no files) is backed up daily. Backups are kept for at most four weeks and then deleted automatically, so a deleted account also disappears from the backups within four weeks.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Write to the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live.

There is no automated decision-making or profiling.