Privacy Policy

heic-to.io is built around one hard rule: no code path in the website converter sends image bytes, thumbnails, filenames, or EXIF data to any server. This policy explains exactly what that means and lists everything else we do collect.

The converter (heic-to.io/*)

Photo conversion — decoding HEIC/HEIF, resizing, re-encoding, ZIP packing, PDF assembly — happens entirely inside your browser. Your photos, thumbnails, and filenames are never transmitted anywhere. A strict connect-src 'self' blob: Content-Security-Policy (blob: is data local to your browser) additionally stops the page from contacting any third-party server, and every request it makes to our own site is visible in your browser’s DevTools; see our privacy proof page for how to check it yourself.

Anonymous aggregate statistics

After each conversion batch, your browser sends one small beacon (under 512 bytes) per source and target format combination in the batch, usually just one, containing only: the source and target format (e.g. "heic" → "jpg"), the number of files that succeeded or failed, and your total input size rounded to the nearest megabyte. This beacon never includes a filename, image content, IP address, or any identifier linking it to you or a later visit. We honor navigator.globalPrivacyControl and Do Not Track — if either is set, no beacon is sent at all. These beacons are aggregated into daily counters used to show the public "photos converted" counter and to understand which formats people use; individual beacons are not retained as separate records.

Server logs and IP addresses

Our web server logs standard request metadata (path, status code, timing) for operating the service, but it never logs full request bodies for stats or feedback endpoints. For abuse prevention (rate limiting), we compute a keyed HMAC hash of your IP address and use that short-lived hash — never the IP itself — in a temporary counter. We do not store raw IP addresses in our database.

Feedback form

If you use the feedback form, we store the message, category, and — only if you provide it — an email address for replying to you. If you tick "attach technical info", we also store your browser, OS, and the format you were converting to, to help us reproduce issues; we never ask for or accept your photo. Closed or spam-marked feedback is deleted after 180 days.

Analytics

No page-view analytics run on this site at the moment. Support for Plausible, a cookieless analytics tool proxied through our own domain, is built in but switched off. If we turn on page-view analytics, we will update this policy first.

Developer API

A separate developer API is documented on our site but is not available: it is switched off, no API keys are being issued, and no image reaches our servers through it. The website converter never uses it. If it launches, it is designed to process uploaded images in server memory only, for the duration of the request, without writing image bytes to disk or logging them, and we will update this policy first.

Contact

Questions about this policy? Use the feedback form and select "Other".