Privacy

No lawyer wrote this. The converter is a small free tool run by one person on one server, and this page is a straight account of what it stores, how long it keeps it, and who else can see it.

What the site handles

• The file you upload. It is stored under a random name with no extension, in a directory that is not part of the website and cannot be reached by guessing a URL. It is passed to the conversion tool and then deleted. Nobody reads it, nothing scans its contents for anything beyond working out what format it actually is, and it is never shown to another visitor.
• The name of that file. Kept only so the converted copy can come back called something recognisable instead of a random string.
• Your IP address. This is the one thing that is genuinely about you, and it is here for one reason: the limits that stop one person using up the whole server. Those limits are counted mainly against the session cookie below — one browser, one allowance — because an IP address is often shared by a whole café, office or mobile network, and one heavy user should not spend everybody else's quota. Your address is still counted against a second, much wider allowance as a backstop, and stored on the upload and conversion records. If you are on IPv6 only the network half of the address is kept, never the part that identifies your particular device.
• A YouTube link, if you paste one. Stored with that conversion so the job can be retried and so the daily limit means anything. Worth knowing: the server fetches the video, not your browser — so YouTube sees this server's address, not yours.
• A random session id in a cookie. Not an identity: a 24-hour random string, so the site can tell that the file you are downloading is the one you uploaded and not somebody else's, and so the fair-use limits can count one browser at a time. Details on the cookie page.
• A username and password, but only if you were given one. A small number of private accounts exist for people the site owner has handed credentials to. There is no way to sign up for one, and if you have not been given one none of this applies to you. For those accounts the site stores the username, the password as a one-way hash that cannot be turned back into the password, when it was created, when it was last used, and a second cookie while you are signed in. An account can be set to delete itself on a date, and when it does the record and every sign-in on it go with it.
• Aggregate counters. Two numbers — how many conversions have succeeded and how many have failed, since the site started. They are plain integers with nothing attached to them.

What it does not handle

No name, no email address, no payment details — the site never asks for any of them and has nowhere to put them. It never asks for a password either, unless you were given an account, and then it stores only a hash of one. No analytics or advertising of any kind, no pixels, no fingerprinting, no cross-site tracking, no profile of what you convert. Nothing is sold, rented, shared for advertising, or handed to a data broker; there is nothing to sell and nobody to sell it to.

Fingerprinting deserves saying twice, because it would have been the easy way to make the fair-use limits fairer. The site does not take a signature from your screen size, fonts, graphics card or browser build. Everything it counts against you is something you can see and clear yourself — a cookie and an address — and that is on purpose: a limit is not worth a tracking method that follows you after you have deleted everything.

How long anything lasts

• Your original upload — deleted as soon as the converted file exists, which is usually within seconds. If you upload something and never start a conversion, it is deleted within 30 minutes on its own.
• The converted file — deleted 15 minutes after the conversion finishes. One exception, because the alternative is worse: a download already in progress is never cut off partway, and a dropped transfer can be resumed for a few minutes afterwards. There is a hard two-hour ceiling on that, so a held file can never become a kept file.
• The upload record — the filename, the size and the IP — goes with the same sweep, within 30 minutes.
• The conversion record — the IP, the formats, and the YouTube link if there was one — is deleted a day after the file is. It outlives the file only so that a page you left open can still tell you the download has expired rather than breaking.
• The rate-limit counters — a session id or an IP, and a number — are deleted after 26 hours, which is just past the longest limit they have to enforce.

A cleanup task runs every minute and also once whenever the server restarts, so a restart cannot quietly extend anyone's retention. It covers all three ways a file could be left behind: expired conversions, uploads that never became one, and anything on disk that no database row claims.

Who else touches any of it

• Cloudflare sits in front of the site and carries the traffic, so it sees IP addresses and requests the way any host would. It also runs the check that keeps automated abuse out, which is why it may set its own cookies — see the cookie page.
• YouTube, and only if you use the YouTube tab. The request is made by this server, so what reaches Google is this server's address and the link you pasted.

That is the entire list. There is no analytics provider, no error-reporting service, and no font or script loaded from anyone else's domain.

Asking for your data, or its deletion

Being straight about this: for almost everyone there is nothing to hand over and nothing to delete, because it has already gone. Unless you were given an account there is nothing to look you up by, and a day after you use the site nothing in the database points at you at all. Inside that window, an email with the rough time and the IP you used is enough to find the records and remove them — [email protected], and you will get a real answer from a real person.

Security, honestly

What is actually done: HTTPS everywhere; uploads stored outside the web root and served by a handler that checks your session or the conversion's own secret before sending a byte; files identified by their contents rather than by trusting the extension; the image and document tools locked down and run under memory, thread and time limits so a malicious file cannot spend the whole machine; and a content security policy that forbids the page from loading or contacting anything off this site.

What I will not pretend: this is a self-hosted free tool maintained by one person, not a service with a compliance department. It is built carefully, but do not convert something here that would ruin your week if it leaked. If you are handling genuinely sensitive documents, use a tool on your own machine.

If this page changes

It gets rewritten here and the date below changes. There is no mailing list to announce it on, because there is no mailing list.

Last updated 27 August 2026. See also the cookie policy.