Privacy

1. Who is responsible

The controller for personal data processed to deliver and secure this website is Alexandru Jungean, a natural person established in Cluj-Napoca, Romania. Contact: alex.jungean@gmail.com, +40 757 673 677, https://alexjungean.com.

The public service is File Conversion at https://convert.alexjungean.com. Identification details are also on the Legal notice.

The operator is not a controller or processor of the contents of files you convert. Those bytes are not transmitted to the operator. See section 3.

2. Scope

This policy applies to the public File Conversion website, including `/`, the six published `/convert/[pair]` routes, and the legal pages. It covers:

• Local handling of files you select, drop, or paste into the converter.
• Technical data created when your browser requests the static website from the hosting platform.
• How to exercise privacy rights and how to complain.

It does not apply to alexjungean.com except where that site is linked as the operator’s portfolio. That site has its own forms, scripts, and processors.

3. Your files are not collected

On `/` and `/convert/[pair]`, conversion runs in the browser with bundled, same-origin workers and codecs. After the page and those assets load, conversion does not need the network.

The following stay in browser memory for the current page session and are not uploaded, emailed, stored on a server, written to operator databases, or sent to analytics:

• Source file bytes and filenames.
• Derived / output bytes, previews, and object (blob) URLs.
• File-linked dimensions and any payload fingerprint created only to validate the file locally.
• JPEG background colour, quality, and dimension settings you choose for that session.
• Client-created ZIP archives of successful outputs.

Tool routes do not load analytics, telemetry, remote logging, third-party scripts, remote codecs, upload clients, or hidden pixels. There are no accounts, no file-storage buckets, and no conversion API.

Object URLs created for preview or download are revoked after replacement, removal, completed-download cleanup, reset, and unmount. Workers and retained buffers are released on reset, cancellation, and unmount. Closing the tab ends the page session. The operator cannot retrieve a file you converted.

If you download an output, that file exists where you save it. The operator does not receive a copy. Anyone you send that file to can see it. This product does not protect you from a compromised device, a malicious browser extension, or recipient screenshots.

4. What local conversion does to a file

Local processing changes the file you download. That is product behaviour, not a transfer to the operator:

• EXIF orientation, including mirrored orientations, is applied to decoded pixels. Output dimensions describe the visually oriented image.
• EXIF, XMP, IPTC, GPS, comments, thumbnails, and other source metadata are not copied to the output.
• PNG and WebP outputs preserve transparency and edge alpha.
• JPEG output is opaque. Transparent pixels are composited onto the background you selected before processing (default `#FFFFFF`).
• Quality and maximum dimensions, when you set them, affect the encoded output. Aspect ratio stays locked unless you unlock it.
• Animated PNG (APNG), animated WebP, SVG, AVIF, identity conversions, and unregistered pairs are rejected locally.

Keep your original if you need the source metadata or an unconverted copy. The Service is not a backup service.

5. Personal data processed to deliver the website

When your browser requests any public page or static asset, the hosting platform that serves the artifact necessarily processes connection data. The operator does not run an application server, database, or log pipeline for File Conversion. Typical hosting/CDN connection data includes:

• IP address and approximate network location derived from it.
• Date and time of the request, requested URL, HTTP status, and bytes transferred.
• User-agent (browser and operating-system description).
• Referrer URL, if the browser sends one (this site uses `Referrer-Policy: strict-origin-when-cross-origin`).
• TLS/HTTPS technical parameters required to serve the site.

The hosting provider for the production site is Netlify, Inc. Their privacy information is at https://www.netlify.com/privacy/. The operator does not provision analytics, identity, forms, or object-storage products on this site.

This connection data is processed to transmit the website you requested, to keep TLS working, to detect abuse of the hosting infrastructure, and to operate DNS and certificates for `convert.alexjungean.com`. It is not used to build advertising profiles, and it is not combined with your image files — those files never arrive.

6. Purposes and legal bases (GDPR Article 6)

For website delivery and security of the static artifact, the legal basis is Article 6(1)(f) GDPR — legitimate interests in making a free public tool available over HTTPS, defending the host from abuse, and answering contact you initiate. Those interests are balanced against your interest in using a website without unnecessary tracking. File Conversion does not use advertising, analytics, or cross-site identifiers that would require consent.

If you email or call the operator, the legal basis is Article 6(1)(b) where needed to take steps at your request, and otherwise Article 6(1)(f) to respond to a correspondence you started, or Article 6(1)(c) where the operator must keep a record to meet a legal obligation (for example a documented rights request).

Local conversion of files you choose is an operation you perform on your device. It is not a processing activity of the operator under Article 4 GDPR, because the operator does not obtain those files.

7. Recipients and processors

Categories of recipients for website connection data:

• Netlify, Inc., as hosting/CDN provider for the static `out/` artifact and the assigned hostname.
• The DNS and TLS operators already used for `*.alexjungean.com`, solely to resolve and encrypt the site.
• Courts, authorities, or legal advisors if the operator is legally required to disclose connection data that the host still holds.

There is no recipient of source or derived image bytes, because those bytes are not transmitted. There are no advertising networks, tag managers, session replay products, or error-tracking SaaS on tool routes.

8. International transfers

Netlify is a United States company and may process hosting data in the United States and other countries where it or its subprocessors operate. Where a transfer of personal data leaves the EEA, the UK, or Switzerland, the operator relies on the hosting provider’s published transfer tools (typically the European Commission’s Standard Contractual Clauses and any supplementary measures they describe). Details are in Netlify’s privacy documentation.

Image files you convert are not transferred internationally by this Service, because they are not transferred at all.

9. Retention

• Files and conversion settings: only in the current browser tab. They are dropped when you remove an item, reset, navigate away, or close the tab. The operator has no retention period because the operator never receives them.
• Hosting connection logs: retained by Netlify according to its platform defaults and abuse-prevention needs. The operator does not export those logs into a separate File Conversion database.
• Correspondence you send: kept only as long as needed to answer you and, if you exercise a privacy right, to demonstrate that the request was handled.

10. Cookies and similar technologies

File Conversion application code does not set first-party cookies and does not use `localStorage`, `sessionStorage`, or IndexedDB to store files or tracking identifiers. A full statement is on the Cookie policy. No consent banner is shown because the application does not use non-essential cookies.

11. Security measures (and what they are not)

Measures that exist and are tested for this product include: HTTPS for the published site; a Content Security Policy that keeps scripts, workers, fonts, and connections same-origin (with `blob:` only where preview/workers require it); `X-Frame-Options: DENY`; `X-Content-Type-Options: nosniff`; a permissions policy that disables camera, microphone, geolocation, and payment prompts; rejection of malformed, animated, SVG, AVIF, and unregistered inputs; measured resource ceilings; and cleanup of object URLs and workers.

These measures reduce accidental disclosure through requests, logs, third-party scripts, and object-URL leaks. They are not a claim of encryption of your files (files do not leave the browser), not a certification, and not protection against a compromised device or extension. See also the Security policy and Disclaimer.

12. Automated decisions

The Service does not make automated decisions that produce legal or similarly significant effects about you. Local validation (MIME, signature, decode, ceilings) only decides whether this browser will convert a file you already chose. That is not profiling.

13. Children

The Service is a general-purpose still-image tool. It is not directed at children under 16. The operator does not knowingly collect personal data from children. Because files are not uploaded, the operator also does not receive images of children that you convert. If you believe a child has sent personal data by email, write to alex.jungean@gmail.com and it will be deleted from correspondence where legally permitted.

14. Your rights

If GDPR or UK GDPR applies to you, you may request access, rectification, erasure, restriction, objection to processing based on legitimate interests, and data portability, and you may withdraw consent where processing was based on consent (this Service does not use consent for cookies or analytics).

Practical limit: the operator cannot access, correct, or delete image files that were only ever in your browser. Rights that depend on the operator holding a copy cannot be exercised against file contents the operator never received. Rights still apply to correspondence and, to the extent the host still holds them and can identify them, to connection logs.

To exercise a right, email alex.jungean@gmail.com from an address the operator can use to reply. Describe the request. The operator may need information to confirm identity for logged connection data. A response will be sent within one month, or you will be told if a lawful extension applies.

15. California and other US state privacy laws

If you are a consumer in California or another US state with a comprehensive privacy law, note the following. The operator does not sell personal information and does not share personal information for cross-context behavioural advertising. The Service does not use advertising cookies or a customer list.

Categories that may be processed by the host when you request the site: identifiers (IP address) and internet activity (request logs). Sources: your browser. Business purpose: serving the static site and securing the host. There is no sale. Sensitive personal information is not used to infer characteristics. File contents are not collected.

A Global Privacy Control signal is honoured in the only way that matches this architecture: the Service does not sell or share personal information, and it does not attach advertising identifiers. You may still request to know or delete correspondence by emailing alex.jungean@gmail.com.

16. Complaints

You may lodge a complaint with a supervisory authority in the EEA, the UK, or Switzerland, in particular where you live or work. The operator’s lead contact authority in Romania is ANSPDCP: https://www.dataprotection.ro, anpdcp@dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania.

Please consider writing to alex.jungean@gmail.com first so the issue can be fixed quickly. That does not limit your right to complain to an authority.

17. Changes

If the product changes in a way that affects this policy — for example if analytics, accounts, or uploads were ever added — this page will be updated and the “Last updated” date will change. Those features are currently prohibited by the product contract. Material changes will be reflected on this page before they apply to new visits.

18. Contact

Privacy contact: alex.jungean@gmail.com. Related documents: Terms, Cookies, Legal notice, Security.