Privacy

A picture you open here is decoded, encoded and measured by the browser tab it is open in. It is not sent anywhere, because there is nowhere to send it: this site is a set of static files with no server behind them and no endpoint that accepts data. Close the tab and every copy the page made is gone with it — unless you ask the converter to keep a batch for a reload, described below.

The file is read from your disk by the file picker, the clipboard or a drag. Its first bytes are examined to work out what it is. It is decoded into pixels, handed to a worker thread, and written into each format you selected. The results are held in memory as blobs and offered to the browser’s own download machinery when you ask for one.

Every file offered for download is checked first, in the same tab: its first bytes must be the format promised, its header must give the size shown, and it must decode again. On the rename pages (JPEG to JPG, JFIF to JPG) a SHA-256 checksum of the original and of the renamed file is computed locally and compared. None of those checks sends anything anywhere.

Some formats are read or written by code that ships with this site rather than by the browser: TIFF, GIF, ICO, PSD and camera-RAW-preview readers, a lossless WebP writer, and the ICO, PDF, GIF and BMP writers. They load from convertpictures.com like the rest of the page, only when a page needs them, and they run in this tab like everything else. An SVG has any reference to another address removed before it is drawn, so opening one never fetches anything. A PDF written here carries no author, file names or dates — only a title if you type one — and each JPEG inside it is checked against the file it came from.

By default nothing is written to storage on your device. No picture, no file name and no measurement is stored, and nothing survives closing the tab.

Keep this batch if the tab reloads. If you tick this box in the converter, copies of the files in the list are stored in this browser’s own database (IndexedDB) on this device, so a reload or a crashed tab can offer them back. They are never sent anywhere. The copy is deleted when you download the results, clear the list, untick the box or press “Forget it”, and it is not offered after 24 hours. It is off unless you turn it on, and the form-photo page never offers it.

Keep camera details. When ticked, a JPEG made from a JPEG gets a short list of fields copied from the original — date taken, camera make and model, exposure time, aperture, ISO, exposure compensation and focal length — and nothing else. The GPS position is never copied.

Save into a folder, and Share. Saving into a folder asks your browser for permission to write to a folder you pick, and writes the converted files there. Share hands the converted files to your device’s share sheet; they go only to the app you choose there.

Page-view counting is not switched on yet, so no page here loads an analytics script and nothing about your visit is counted. When it is switched on it will be Cloudflare Web Analytics, a cookieless service, loaded only when the page is served from convertpictures.com itself, and this paragraph will say so first.

The property is this site’s own and is not shared with, or joined to, any other site.

This site shows no advertising, and no advertising script loads on any page.

Accounts do not exist here, which means no sign-in and no password to be lost in someone else’s breach. No picture, thumbnail, dimension, file name or measurement leaves the tab. Nothing about your use of the bench is recorded anywhere that could later be connected to you.

The contact page sends exactly four values, and only at the moment you press its send button: the name, email address and message you typed, plus this site’s domain. They go to a Google Form read by the people who maintain the bench. Loading that page requests nothing from Google, no file or measurement is attached, and no other page here sends anything to Google.

A change that made any of the above untrue would be a change to how the site is built, not a change to a setting, and the build refuses to produce a version of this site in which the image code can make a network request at all. If that ever changes, this page changes first and says what and why.