Privacy

An uploaded image is stored in Cloudflare R2 only long enough to convert it and hand back the result. Both the upload and the output are deleted 1 hour after the job is created, which is also when the download link stops working.

We do not look at the contents of your files, and we do not use them to train anything. Download links carry a random token, so knowing a job id is not enough to fetch a result.

A record of the job outlives the file itself, so your usage page has something to show:

• The filename, the source and target format, and the byte sizes in and out.
• How long the conversion took, and whether it succeeded.
• The IP address that made the request, used to enforce the free daily allowance and to spot abuse.

These records are not the file. The image itself is gone after an hour.

If you sign in, we store your email address, the display name you choose, and a profile image if you upload one or import it from Google. Sign-in itself is handled by Firebase Authentication — we never see your password.

API keys are stored only as a salted SHA-256 hash. The key itself is shown once, when you create it, and cannot be recovered from our database afterwards.

Payments run through Stripe. Card numbers are entered on Stripe’s own pages and never reach our servers — we store only a Stripe customer id, which plan you are on, and your credit balance and its history.

None. Your session lives in your browser’s local storage, held by Firebase Authentication, and every request carries it as a header. There is no advertising, no analytics profiling, and no third-party tracking on this site.

• Cloudflare — stores and converts your images.
• Vercel — runs the website and API.
• MongoDB Atlas — stores accounts, keys, job records and credits.
• Google Firebase — handles sign-in.
• Stripe — handles payments.

We do not sell your data, and we do not share it beyond the processors above.

The free tier — 100 conversions a day — needs no account. We count those against your IP address rather than an identity, so an anonymous conversion leaves a job record but is not tied to a person.

Email support@smallconvert.com to request a copy of what we hold about you, or to have your account and its records deleted. Deleting an account removes your profile, your API keys and your job history. Payment records are kept where we are required to keep them for accounting.

If this page changes in a way that affects what we collect or who we share it with, the date at the top changes with it.