Your data on your account
What signing in means, in specifics. Last updated 12 September 2026.
The converter is unaffected
Converting a file in your browser sends nothing to us — no image, no filename, no dimensions. That is true whether or not you have an account, and it is enforced by the site's own content security policy rather than by our good intentions.
This page is only about what an account adds. The converter itself is covered by the site privacy policy.
Everything an account holds
12 kinds of record
Your account
Username, email address, a one-way hash of your password (never the password), and when the account was created.
To let you sign in and keep you signed in. · Kept: Until you delete the account. Then erased within 7 days.
Linked sign-in
If you use Google: Google's permanent identifier for you, and the email address Google reports.
To let you sign in and keep you signed in. · Kept: Until you unlink it or delete the account.
Signed-in devices
A session identifier, when it started and was last used, a truncated network prefix (/24 or /48 — never your full IP address), and a one-way hash of your browser’s user-agent string.
To let you sign in and keep you signed in. · Kept: Until the session ends, then 30 days.
Email links
A one-way hash of each confirmation or password-reset link, and when it expires. Never the link itself.
To let you sign in and keep you signed in. · Kept: 7 days after it is used or expires.
Sign-in attempts
A one-way hash of the address or username tried, a truncated network prefix, and whether it worked. The address itself is never stored here.
To protect accounts from attack. · Kept: 2 days.
Security history
Significant account events — signing in, changing a password, revoking a device — with a truncated network prefix.
To protect accounts from attack. · Kept: Kept after account deletion, but unlinked from you: the record survives, the connection to you does not.
Your activity
Formats, sizes, timings and whether each conversion worked. Never a file, and never a filename for anything converted in your browser.
To show you your own activity. · Kept: As long as your plan allows, then deleted automatically. You can clear it at any time.
Your settings
Theme, default output format and quality, and whether to record your activity.
To remember your settings. · Kept: Until you change them or delete the account.
Your answers
What you chose in the optional setup questions.
To decide what to build next. · Kept: Until you delete the account.
Account adjustments
Any limit changed specifically for your account, usually by support.
To decide what your account may do. · Kept: Until it expires or the account is deleted.
Usage record
How much of your allowance each piece of work used.
To decide what your account may do. · Kept: Kept as a billing record.
Allowance totals
Running totals of the above for the current period.
To decide what your account may do. · Kept: Rebuilt from the usage record; kept while the account exists.
Promises the code keeps, not just this page
Each of these is asserted by a test. If one stopped being true, the build would fail before it reached you.
Converting a file in your browser sends nothing to us.
Enforced by: connect-src 'self' in public/_headers, and tests/e2e/security.spec.ts
We never store your full IP address.
Enforced by: ipPrefix() truncates to /24 or /48 before anything is written
We never store your password.
Enforced by: PBKDF2-HMAC-SHA256, 600,000 iterations; only the derived hash is stored
An API key is shown once and cannot be recovered.
Enforced by: Only a SHA-256 digest is stored; no endpoint returns the secret
Deleting your account erases it, not just a flag.
Enforced by: The purge sweep deletes the row; every reference cascades
Activity for browser conversions never includes a filename.
Enforced by: HistoryRepository writes display_name as null for local conversions
What you can do
Get a copy of everythingA machine-readable export of every record above. Immediate, no request needed.
Export
Delete your accountSign-in stops at once and your username and email are released immediately. Everything else is erased permanently 7 days later.
Settings
Stop recording your activityOne switch. Existing records stay until you clear them.
Settings
Who else sees it
CloudflareHosts the site and the database. Your data lives in their infrastructure.
Our email providerReceives your address to deliver confirmation and password-reset messages. Nothing else.
Nobody elseNo data broker, no advertiser, no analytics product receives anything from your account.