Privacy

How the no-upload guarantee is enforced

There are no API routes, no server actions and no server-side file handling anywhere in this application. Images are read with the browser's own file APIs, decoded and re-encoded inside Web Workers on your machine, and written to object URLs your browser creates locally.

Every page is served with a Content-Security-Policy containing connect-src 'self' and form-action 'none'. Even if some dependency tried to send your photograph somewhere, the browser would refuse to open the connection and log the refusal to the console. The automated browser tests assert that a full conversion produces no cross-origin request of any kind.

The codecs — the AVIF encoder and decoder, the TIFF decoder, and the LibRaw build that decodes camera raw — are served from this site, not from a content delivery network. Nothing about your session is visible to a third party because no third party is involved.

What analytics records

Vercel Analytics records page views: the URL, the referrer, and coarse device and country information. That is all it is configured to do.

No custom events are sent. No file name, file size, image dimensions, format, camera model, location tag or any other property of any image you open is ever recorded, transmitted or logged. There is no analytics call anywhere in the conversion code.

What is stored on your device

Nothing persistent. Files you add live in memory for the lifetime of the tab. Converted results are held as blobs so the browser can manage their memory, and every object URL is released when you remove a file or clear the queue.

Closing the tab discards everything. There is no local database, no cache of your images and no session to resume — which also means a converted file you have not downloaded is gone when you close the page.

Metadata is your decision, and it is surfaced first

Photographs routinely carry the camera model, the exact time and often the GPS coordinates of where they were taken. Most converters silently discard all of it; a few silently keep it. Either can be the wrong outcome.

Here it is a control, the queue tells you when a file contains a location tag before you convert anything, and the result records exactly what was carried across or removed. Where a format has nowhere to store metadata — AVIF, BMP and ICO output — that is stated rather than left to be discovered.

Camera raw is the one case where GPS is treated differently from everything else. The file details show when location data is present, but coordinates are never written into the converted file, whichever way the metadata control is set. Camera, lens, exposure and capture time are carried when those fields are present and the output format supports metadata.

It works offline

Once the page has loaded, converting does not need a network connection at all. Turning off your network mid-batch changes nothing, which is a demonstration of the guarantee rather than merely a convenience. The only thing that needs the network is fetching a codec the first time you ask for AVIF output or add a camera raw file — after that they are cached and the tool works offline.