Privacy Policy

The short version

Your files never leave your device.All file conversions on Convertful happen entirely in your browser using client-side technologies like WebAssembly and the Canvas API. We don't upload, process, store, or have any access to the files you convert. This is by design — not a policy choice, but a technical one.

What we collect

When you use Convertful without an account, we may collect:

• Analytics data — we may use privacy-friendly analytics services (such as Plausible Analytics) to understand usage patterns including page views and tool usage. These services do not use cookies and do not track you across sites.
• Rate-limit identifiers — for anonymous users, we store a cryptographic hash of your IP address to enforce daily conversion limits. The hash is one-way and cannot be reversed to reveal your actual IP address. These records are associated with a date and are used solely for rate-limiting purposes.
• Cookies — our site and third-party services (including advertising providers) may use cookies to function properly and deliver relevant content.

When you create an account, we additionally store:

• Email address — used for authentication and account communications only. We will never sell your email or send unsolicited marketing without your consent.
• Conversion metadata — tool name, file name, file sizes, and timestamps. This powers your dashboard history. We never store file contents.
• Authentication tokens — session cookies managed by our authentication provider to keep you signed in.

How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Enforce rate limits and prevent abuse
• Understand usage patterns and improve our tools
• Display advertisements (where applicable)
• Respond to your feedback and support requests

We do not sell, rent, or trade your personal information to third parties. We do not use your data for profiling or automated decision-making beyond the rate-limiting described above.

Advertising

We may display advertisements from third-party providers such as Google AdSense. These providers may use cookies or similar technologies to serve ads based on your browsing activity. You can opt out of personalised advertising through your browser settings or at adssettings.google.com. We do not share any personal information with advertising providers beyond what their scripts may collect independently through cookies.

Third-party services

We use the following third-party services that may process limited data:

• Supabase — authentication, account data storage, and database hosting. Subject to Supabase's privacy policy.
• Plausible Analytics — privacy-friendly, cookie-free analytics. No personal data is collected. Subject to Plausible's data policy.
• Google AdSense — advertisement serving (when enabled). May use cookies for ad personalisation. Subject to Google's privacy policy.
• Google OAuth — optional sign-in provider. Only your email address is shared with us during authentication.

We carefully select third-party providers but are not responsible for their privacy practices. We encourage you to review their respective policies.

Data retention

Account data (email, conversion metadata) is retained for as long as your account is active. If you delete your account or request deletion, we will remove all associated personal data within 30 days, except where retention is required by law. Rate-limit records are automatically purged on a rolling basis and are not associated with any identifiable person. Anonymous analytics data is aggregated and cannot be traced to individuals.

Data security

We implement reasonable technical and organisational measures to protect your personal information, including encryption in transit (TLS/HTTPS), secure authentication protocols, and access controls on our infrastructure. However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Children's privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us.

Your rights

Depending on your jurisdiction (including under GDPR, CCPA, and similar regulations), you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate personal data
• Deletion — request deletion of your personal data
• Portability — request your data in a structured, machine-readable format
• Objection — object to certain processing of your personal data
• Withdraw consent — where processing is based on consent, withdraw it at any time

Since we store minimal data and never access your files, there is very little personal data to request. We will honour any valid request promptly and within the timeframes required by applicable law. To exercise any of these rights, contact us at the email below.

International data transfers

Our service providers may process data in jurisdictions outside your country of residence, including the United States. Where such transfers occur, we rely on our providers' compliance with applicable data protection frameworks and standard contractual clauses to ensure adequate protection of your data.

Changes to this policy

We reserve the right to update or modify this Privacy Policy at any time, at our sole discretion. Changes will be effective immediately upon posting to this page. We will indicate the date of the most recent revision by updating the “Last updated” date at the top of this page. It is your responsibility to review this policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

Contact

For any privacy-related questions, data requests, or concerns, email privacy@convertful.app or visit our contact page.