At Online Convert File (www.onlineconvertfile.com), your privacy is our top priority. This policy explains what data we collect, how we use it, how we handle your files, and your rights.
1. How We Handle Your Files
Online Convert File uses two different processing methods depending on the type of conversion:
Image Conversions — 100% Browser-Based
All image conversions (JPG, PNG, WebP, AVIF, BMP, GIF, TIFF, ICO) happen entirely in your browser using JavaScript, the HTML5 Canvas API and WebAssembly. Your image files are never uploaded to our servers. We have no access to the images you convert.
When you drop a file on the home page, your browser keeps it for a moment in its own local storage (IndexedDB) and hands it to the matching converter page, which removes it from that storage right away. This hand-over never leaves your device.
Video, Audio & Document Conversions — Server-Side Processing
Video, audio, and document conversions require server-side processing using FFmpeg and LibreOffice. For these conversions:
- Your file is uploaded to our server over an encrypted HTTPS connection.
- The file is stored in an isolated temporary directory on the server, named with a random job ID.
- The file is processed and the converted result is made available for download.
- All files (source, output, and metadata) are automatically deleted within 4 hours of upload for video, audio, and documents, and within 1 hour for the PDF tools (merge, split, compress, PDF to image) — regardless of whether the conversion succeeded, failed, or was abandoned. The longer window covers long video conversions and gives you time to download the result.
- A cleanup script runs via cron every 5 minutes to ensure no files persist beyond the expiry window.
Importing Files from Google Drive or Dropbox
On every converter you can choose a file from Google Drive or Dropbox instead of your device. This is optional, and nothing from Google or Dropbox is loaded until you use one of these buttons.
- Google Drive: you sign in with Google and grant the permission "See, edit, create, and delete only the specific Google Drive files you use with this app" (
drive.file). In practice we only read the files you pick in the Google file picker, and only to convert them. We cannot see any other file in your Drive, and we never create, change or delete files in it. - Dropbox: the Dropbox Chooser gives your browser a temporary link to the file you pick. We get no access to the rest of your Dropbox.
- Video, audio and document conversions: to save you from downloading and re-uploading large files, our server downloads the chosen file directly from Google Drive or Dropbox. For Google Drive, your browser passes the short-lived access token (limited to that one file) to our server, which uses it for this single download only — the token is never written to disk or logs. For Dropbox, our server uses the temporary link the Chooser created. The imported file is stored and deleted exactly like an upload (see above); an import you don't convert is deleted within 2 hours.
- Everything else (images, PDF tools, and Google Docs, Sheets and Slides, which Google first exports to Word, Excel or PowerPoint format): your browser downloads the chosen file directly from Google or Dropbox, and the token or link stays in that browser tab only. The file is then handled exactly like one you chose from your device.
- When you pick a file on the home page, its name, size and the short-lived token or link are kept for a moment in this browser tab (sessionStorage) to open the right converter, and removed as soon as that page reads them.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or Dropbox user data for advertising, we do not sell or transfer it, and no person reads it. You can remove our access at any time in your Google Account permissions or your Dropbox connected apps.
We do not read, inspect, share, or retain the contents of your files. Server-side files exist only for the conversion and the download window, and are then automatically purged.
2. Information We Collect
We collect minimal data to operate, protect, and improve our service:
- Usage analytics — Pages visited, features used, browser type, device type, and approximate location (country level). Collected via Google Analytics. No personal identification.
- Technical logs — Server access logs (IP address, timestamp, page requested) stored for up to 30 days for security and debugging purposes.
- IP addresses for rate limiting — For server-side conversions (video, audio, documents), your IP address is temporarily stored in job metadata to enforce per-user rate limits (one active conversion per IP). This data is automatically deleted along with the job files within the conversion expiry window. Upload and contact-form rate-limit counters (IP address and time) are kept for up to 2 hours.
- Conversion statistics — When you perform a server-side conversion (video, audio, or document), we record the conversion type, input and output format, file size, time, and a pseudonymous visitor ID in a local database on our server. The visitor ID is a keyed one-way hash of your IP address (HMAC-SHA-256 with a secret key kept on our server); the IP address itself is not stored, and the ID cannot be turned back into it without that key. We use this data only to count unique users, detect excessive or automated usage, and improve the service. It is not shared with any third party. Image conversions are logged by format pair only — no IP address, visitor ID, or file data.
- Cookies — Essential cookies for the website to function, plus advertising and analytics cookies from third-party services (see section 5).
We do not collect: names, email addresses, payment information, or any personally identifiable information unless you voluntarily contact us through our Contact page.
Why we use IP addresses: Our service is free and open to everyone without registration. To keep it that way, we need to prevent misuse that could degrade the experience for all users — such as automated scripts consuming server resources, or individuals bypassing fair-use limits. IP-based rate limiting is the least invasive method that allows us to maintain a fair and reliable service for everyone.
3. How We Use Information
- To operate and maintain the website and conversion services
- To enforce rate limits and prevent abuse of server-side conversion tools
- To analyze usage patterns and improve user experience
- To detect and prevent security issues
- To display relevant advertisements via Google AdSense
- To comply with legal obligations
4. Cookies
We use the following types of cookies:
- Essential cookies — Required for the website to function properly (session management, security).
- Analytics cookies — Used by Google Analytics to collect anonymous usage statistics, helping us understand how visitors use our site and how we can improve it.
- Advertising cookies — Used by Google AdSense to display relevant advertisements. These cookies may track your browsing activity across different websites to show you personalized ads. You can opt out of personalized advertising by visiting Google's Ads Settings.
You can manage or disable cookies in your browser settings. Disabling essential cookies may affect the website's functionality. Disabling advertising cookies will result in non-personalized ads being shown.
5. Third-Party Services
We use the following third-party services:
- Google AdSense — For displaying advertisements on our website. Google may use cookies and web beacons to serve ads based on your browsing history. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the internet. You may opt out of personalized advertising by visiting Google Ads Settings. For more information, see the Google Advertising Privacy Policy.
- Google Analytics — For anonymous website usage analytics. Google Analytics uses cookies to collect information about how visitors use our site. Data is collected anonymously and used to improve our service. See Google's Privacy Policy.
- Cloudflare — Our website is delivered through Cloudflare's network (CDN and security), which processes visitor IP addresses to deliver pages and block attacks, and provides cookie-free page-view statistics (Cloudflare Web Analytics). Some JavaScript libraries used in browser-based tools are loaded from Cloudflare's cdnjs.
- Google Drive Picker and Dropbox Chooser — Only when you choose to import a file from Google Drive or Dropbox (see section 1). See Google's Privacy Policy and the Dropbox Privacy Policy.
- Ahrefs Web Analytics — Cookie-free page-view statistics. Ahrefs does not store raw IP addresses. See the Ahrefs Privacy Policy.
These third-party services have their own privacy policies. We encourage you to review them.
Google Drive is a trademark of Google LLC. Dropbox is a trademark of Dropbox, Inc. Facebook and Instagram are trademarks of Meta Platforms, Inc. Online Convert File is not affiliated with, sponsored or endorsed by these companies.
6. Data Retention
- Image files — Never uploaded; no data to retain.
- Video, audio and document files — Automatically deleted within 4 hours of upload.
- PDF tool files (merge, split, compress, PDF to image) — Automatically deleted within 1 hour of upload.
- Conversion statistics (format, file size, time, pseudonymous visitor ID — no IP address) — Kept in a local database on our server for up to 12 months, then automatically deleted. Never shared with third parties.
- Rate-limit counters (IP address and time) — Automatically deleted after 2 hours.
- Server access logs — Automatically purged after 30 days.
- Contact form submissions — Delivered to our mailbox and kept only as long as needed to respond; the backup copy on our server (including your IP address) is automatically deleted after 90 days.
- Analytics data — Managed by Google Analytics according to their data retention policies.
7. Data Security
We take reasonable measures to protect your data:
- All data in transit is encrypted using HTTPS/TLS.
- Server-side conversion files are stored in isolated temporary directories with restricted access.
- Each conversion job uses a unique random identifier, making it virtually impossible to guess or access another user's files.
- Rate limiting is enforced per IP address to prevent abuse.
- Automatic cleanup processes ensure files are not retained beyond the conversion window.
8. Your Rights
Depending on your location, you may have rights including:
- The right to access information we hold about you
- The right to request deletion of your data
- The right to object to processing of your data
- The right to data portability
- The right to opt out of personalized advertising
Since we collect minimal data and server-side files are automatically deleted within hours, most of these rights are automatically satisfied. For any specific requests, contact us at the address below.
9. Children's Privacy
Our service is not directed to children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the service after changes constitutes acceptance of the new policy.
11. Contact
If you have any questions about this Privacy Policy, please contact us at: