Privacy

Conversion runs in a Web Worker in this browser. The site has no upload endpoint, no account, and no database.

Check it in DevTools

1. Open this site. In Chrome or Edge, press F12. In Safari, enable the Develop menu and choose Show Web Inspector.
2. Select the Network panel. Check “Preserve log” if you see it. You can filter by Fetch/XHR.
3. Drop a photo and press Convert. Wait until the download starts.
4. Sort by method. Conversion does not POST, PUT, or PATCH the file. The file requests are GET requests for this site’s own HTML, scripts, and, for HEIC, the libheif files under /wasm/libheif/.
5. Click any request and look at the request headers and payload. A file conversion does not put image bytes in a request body. Worker messages stay inside the browser and do not appear as network traffic.
6. Open the header of the document, or the Console, and look at Content-Security-Policy. connect-src 'self' tells the browser to block connections to other origins. A blocked upload shows up as a CSP error, not as a successful request. script-src also includes 'wasm-unsafe-eval' so the browser can compile the local HEIC decoder. That token does not allow JavaScript eval and does not allow a connection to another site.
7. A page view, and one event after you convert, may POST a few hundred bytes to /_vercel/insights/ on this same site. Open that request. The body is a page path or the tool id, a file-count bucket, and success or fail. It is not the file. The header counter ignores those requests and should stay at 0 bytes uploaded.

What stays on the device

• The image bytes, the queue, and the ZIP exist only in this tab’s memory until you download them or close the tab.
• Theme and conversion options (quality, resize, metadata mode, background color) are saved in localStorage under keys that start with ibc-. File names and pixels are not stored there.
• There is no installable app and no share target. Closing the tab drops the in-memory files.

Analytics

The page loads Vercel Web Analytics from /_vercel/insights/script.js on this same origin. connect-src 'self' still blocks every other site, including va.vercel-scripts.com. After a conversion the page calls window.va("event"), the same shape as track("tool_used"). The only fields are the tool id, a file-count bucket (1, 2–5, 6–20, or 21+), and success or fail. Names, byte sizes, and file contents are not included. Vercel records those events only after Web Analytics is turned on for this project. If that script is missing, the event stays in the page and is not sent. Speed Insights is off, because its collector is a different origin.

Ads later

There are no ads today. If one is added later, it will be cookieless and contextual: the slot will not set a tracking cookie, will not call an ad network that profiles you, and will not read the file. The placeholder on a tool page is empty and does not load anything.

Metadata

The default is to strip GPS. A “Location data found” badge means the file you added contains coordinates. Keep copies tags we can read into the JPG or PNG. Strip all leaves them out. Re-encoding does not preserve an ICC profile bit for bit, and WebP output does not carry the original metadata container.

HEIC and patents

HEIC decoding uses libheif and libde265, loaded as a separate file you can replace. The page decodes; it does not encode HEVC. This is not legal advice about the HEVC patent pool.