Privacy Policy

1. Introduction

snapconvrt (“we”, “our”, or “us”) operates https://snapconvrt.com (the “Site”). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of data when you use our Site and the choices you have associated with that data.

We use your data to provide and improve the Site. By using the Site, you agree to the collection and use of information in accordance with this policy. The Site is designed to be privacy-first: you do not need an account, we never ask for your name or email to convert images, your uploaded originals are deleted automatically, and converted files are never stored on our servers.

For the purposes of the GDPR, the UK GDPR, and similar laws, snapconvrt is the data controller for personal data processed through the Site. You can reach us about any privacy matter atcontact@snapconvrt.com.

2. Information collection and use

We collect a limited amount of information for the purposes of providing and improving the Site.

2.1 Types of data collected

Images you upload. The image files you choose to convert. These are uploaded directly to our storage provider and used solely to perform the conversion you requested. You remain responsible for the content you upload; please do not upload images containing sensitive personal data you do not want processed.

All sessions are anonymous. We never ask for, assign, or store a name, email address, password, account, or any profile that identifies you. The session and device identifiers we use are random, signed tokens that let us run your session and enforce limits without knowing who you are. The limited technical data we do process (such as your IP address for abuse prevention) is used transiently and is not linked to your identity.

Anonymous identifiers. We store an anonymous session identifier and an anonymous device identifier in cookies (see ourCookie Policy). These let us track your conversion credits and enforce the one-free-conversion-per-day limitwithout identifying you. We do not collect your name, email address, phone number, or postal address.

Payment information. If you buy a credit bundle, payment is processed by our payment provider, Polar, which acts as the merchant of record. You provide your payment details directly to Polar;we never receive or store your full card number. We receive only a confirmation that a payment succeeded, tied to your anonymous session, so we can add credits.

Usage data. We may collect information about how the Site is accessed and used, such as your IP address and network identifiers, browser type and version, file type and size, timestamps, approximate region, and other diagnostic data. This is used transiently to operate the Site and for security, abuse prevention, and rate limiting.

Analytics data. To understand which converters are used and where the conversion flow breaks down, we use PostHog (EU region) in a cookieless, anonymous mode. It sets no cookies and stores nothing on your device, and it builds no user profile. We record aggregate, non-identifying events such as page views, the conversion you chose (e.g. HEIC → JPEG), file counts, errors, and an approximate country. Your IP address is used only momentarily to derive that approximate country and is then discarded — it is not stored by our analytics. We do not capture filenames or image contents. Because nothing is stored on your device and no profile is built, this does not require a cookie-consent banner; you can also enable “Do Not Track” in your browser and we will not collect analytics.

Bot-protection signals. To tell humans apart from automated bots when you start a conversion, we use Cloudflare Turnstile. To do this, Cloudflare collects signals from your browser, including your IP address, user-agent, a TLS fingerprint, and other browser characteristics. These signals are used only to detect and block automated abuse, and Cloudflare states it cannot directly identify you from them. For details, see Cloudflare’sTurnstile Privacy Addendum.

3. Use of data

snapconvrt uses the collected data for the following purposes:

• To provide and maintain our Site and perform the conversions you request
• To operate the accounts-free credit system and the daily free quota
• To process payments and prevent fraud
• To detect, prevent, and address technical issues and abuse
• To provide customer support
• To monitor and improve the usage of our Site
• To comply with our legal obligations

4. Data retention

We retain data only for as long as is necessary for the purposes set out in this Privacy Policy.

• Uploaded original images: deleted automatically when your session ends — typically within about 30 minutes — and in all cases within 24 hours by an automated lifecycle rule. You can also delete them yourself instantly at any time by clicking the “Delete now” button, or by ending your session.
• Converted images: never written to our servers. The converted file is generated on demand at download time and held only in a temporary edge cache that expires with your session. Converted files are generated with image metadata — including EXIF and GPS location data — removed.
• Anonymous identifiers and rate-limit counters: short-lived, generally expiring within 24 hours (per-day counters) up to ~30 days for the anonymous device identifier.
• Payment records: retained by Polar as required for tax, accounting, and anti-fraud purposes.

5. Transfer of data

Your information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. Our providers operate globally, so your data may be processed in the United States and other countries. Where data is transferred out of the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. snapconvrt will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

6. Disclosure of data

Legal requirements: snapconvrt may disclose your data in the good-faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of snapconvrt
• Prevent or investigate possible wrongdoing in connection with the Site
• Protect the personal safety of users of the Site or the public
• Protect against legal liability

7. Security of data

The security of your data is important to us. We use industry-standard measures including TLS encryption in transit, HttpOnly and Secure signed cookies, bot protection, file-type validation, and automatic deletion of uploads. However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

8. Your rights

GDPR rights (European Union / UK users)

Under the General Data Protection Regulation (GDPR/UK GDPR), if you are a resident of the European Economic Area or the UK, you have certain data protection rights:

• Right to access: request copies of your personal data.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing: request restriction of processing of your data.
• Right to object: object to processing of your data, including processing based on legitimate interests.
• Right to data portability: request transfer of your data to another organization.
• Right to withdraw consent: withdraw consent at any time where we relied on consent.
• Right to lodge a complaint: lodge a complaint with your local supervisory authority.

We rely on the following legal bases under the GDPR / UK GDPR:

• Performance of a contract (Art. 6(1)(b)): to perform the conversions you request and operate the credit system.
• Legitimate interests (Art. 6(1)(f)): to secure the Site, prevent abuse and fraud, enforce rate limits, and run cookieless, anonymous analytics to understand and improve the service. You may object to processing based on legitimate interests at any time (see “Right to object” above), and you can opt out of analytics by enabling “Do Not Track” in your browser.
• Legal obligation (Art. 6(1)(c)): to comply with applicable law, including tax and accounting obligations (handled by Polar for payments).
• Consent (Art. 6(1)(a)): where we specifically ask for it; you may withdraw consent at any time.

Because the Site is used without an account and your images are deleted automatically, we usually hold little or no information that identifies you after your session ends.

Automated decision-making. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our bot-protection (Cloudflare Turnstile) assesses whether a request is likely automated and may block a suspected bot from starting a conversion; if you believe you were blocked in error, contact us at the email below.

EU/EEA and UK representative

snapconvrt is established outside the EEA and the UK. We process only a limited amount of personal data, do not process special categories of data on a large scale, and delete uploaded images automatically; on that basis we have not appointed a separate representative under Article 27 of the GDPR / UK GDPR. EU, EEA, and UK users may exercise their rights and raise any data-protection question directly with us atcontact@snapconvrt.com, and may also lodge a complaint with their local supervisory authority. If a representative becomes legally required, we will appoint one and publish their contact details here.

CCPA / CPRA rights (California residents)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information and of targeted advertising.
• Limit the use of sensitive personal information.
• Non-discrimination for exercising your rights.

Categories of personal information. In the preceding 12 months we collected the following statutory categories, for the business purposes described in “Use of data” and retained only for the periods in “Data retention”:

• Identifiers — IP address and anonymous cookie identifiers. Source: your device. Disclosed to Cloudflare (hosting / security).
• Internet or network activity — diagnostic, usage, and bot-protection signals. Source: your browser/device. Disclosed to Cloudflare (hosting / security) and, as anonymous aggregate analytics, to PostHog.
• Commercial information — credit purchases and balances (never your full card number). Source: you and Polar. Disclosed to Polar (payments).
• Visual information — the images you upload, processed solely to convert them and then deleted. Source: you. Disclosed to Cloudflare (image processing).

We do not collect sensitive personal information to infer characteristics about you, and converted files have EXIF/GPS metadata removed. We do not sell or share your personal informationand we do not engage in cross-context behavioral advertising, so there is nothing to opt out of. To exercise these rights, email us atcontact@snapconvrt.com with “Privacy Request” in the subject line; you may use an authorized agent to submit a request on your behalf. Comparable rights apply under other U.S. state laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana). Where those laws provide it, you may appeal a refused request by replying to our decision, and we will respond within the time the law allows.

Children’s privacy (COPPA)

Our Site complies with the Children’s Online Privacy Protection Act (COPPA) and is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected such information without parental consent, we will delete it as quickly as possible. Parents can contact us atcontact@snapconvrt.com to review, delete, or stop the collection of their child’s information.

9. Third-party services (sub-processors)

We do not sell your data. We share it only with service providers that help us run the Site:

• Cloudflare, Inc. — hosting, content delivery, temporary object storage, image processing, and bot protection (Turnstile). (privacy policy, Turnstile addendum)
• Polar — payment processing as merchant of record. (privacy policy)
• PostHog — cookieless, anonymous product analytics, hosted in the EU. Analytics requests are routed through our own domain (a first-party proxy); PostHog sets no cookies, stores nothing on your device, and uses your IP only momentarily to derive an approximate country before discarding it (it is not stored). (privacy policy)

10. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.

11. Contact us

If you have any questions about this Privacy Policy, please contact us:

snapconvrt
Email: contact@snapconvrt.com