Privacy

Conversion runs in a Web Worker in this browser. The site has no upload endpoint, no account, and no database.

Check it in DevTools

1. Open this site. In Chrome or Edge, press F12. In Safari, enable the Develop menu and choose Show Web Inspector.
2. Select the Network panel. Check “Preserve log” if you see it. You can filter by Fetch/XHR.
3. Drop a photo and press Convert. Wait until the download starts.
4. Sort by method. There should be no POST, PUT, or PATCH. The only requests are GET requests for this site’s own HTML, scripts, and, for HEIC, the libheif files under /wasm/libheif/.
5. Click any request and look at the request headers and payload. A file conversion does not put image bytes in a request body. Worker messages stay inside the browser and do not appear as network traffic.
6. Open the header of the document, or the Console, and look at Content-Security-Policy. connect-src 'self' tells the browser to block connections to other origins. A blocked upload shows up as a CSP error, not as a successful request. script-src also includes 'wasm-unsafe-eval' so the browser can compile the local HEIC decoder. That token does not allow JavaScript eval and does not allow a connection to another site.
7. Optional: switch the machine offline from the Network panel, reload from the service worker cache after one online visit to the built site, and convert a PNG or JPG again.

What stays on the device

• The image bytes, the queue, and the ZIP exist only in this tab’s memory until you download them or close the tab.
• Theme and conversion options (quality, resize, metadata mode, background color) are saved in localStorage under keys that start with ibc-. File names and pixels are not stored there.
• If you install the app and use the share target, the shared file is held in IndexedDB on this device until the page reads it. It is not sent to a server. The service worker answers that POST itself.

Analytics

The converter calls window.va("event") with the same shape as Vercel Web Analytics track("tool_used"): the tool id, a file-count bucket (1, 2–5, 6–20, or 21+), and success or fail. Names, byte sizes, and contents are not part of that object. In this preview the collector is the same-origin script /va.js, which keeps the event in the page and does not transmit it. Turning on Vercel’s hosted collector later means changing that script and adding https://vitals.vercel-insights.com to connect-src, and this page would say so. That has not been done.

Metadata

The default is to strip GPS. A “Location data found” badge means the file you added contains coordinates. Keep copies tags we can read into the JPG or PNG. Strip all leaves them out. Re-encoding does not preserve an ICC profile bit for bit, and WebP output does not carry the original metadata container.

HEIC and patents

HEIC decoding uses libheif and libde265, loaded as a separate file you can replace. The page decodes; it does not encode HEVC. This is not legal advice about the HEVC patent pool.