Privacy policy

1. Summary

• Files you process never leave your device. When you upload a file here, it is opened and processed in your browser and never sent to us.
• By default the site stores nothing about you except, in your own browser, your cookie choice and theme.
• Google Analytics 4 loads only when you accept both Analytics and Advertising. Advertising cookies stay off until you accept Advertising. You can switch either off on the cookie settings page, and the page reloads.
• Page views are counted without a cookie (in the EEA, the UK, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man only after you accept Analytics; see section 5). Recorded: the page address, the referring site, device and browser type, and a coarse city-level location. Vercel uses a server-side daily visitor hash that resets every 24 hours. No cookie is set, and nothing is stored in the browser. A filename, file contents, or a search you typed is not included.
• We never send filenames, file contents, image data or anything derived from a file to analytics or advertising partners. If you accept both Analytics and Advertising, the Meta Pixel still receives the full page address, including any query string and #fragment, and it may automatically collect page metadata such as button text. Section 4 says which pages put something you typed into that address.

2. Files you process

When you upload a file here, it is opened and processed in your browser and never sent to us. “Upload” on this site names your action — choosing or dropping a file — not a transfer: the file is read into the tab’s memory, transformed there, and the result is offered for download from memory. No copy is sent to us or to anyone else. When you close or reload the tab, the browser discards it.

When you choose to continue a batch in another tool (for example Compress after HEIC to JPG), the finished files are placed in your browser’s local IndexedDB storage on your device, read once by the next page, and deleted. Entries not collected within 15 minutes are discarded. This storage is on your device only and is never synchronised to us.

On browsers that cannot decode HEIC natively, the page loads an open-source decoder hosted on this site’s own domain. No file is sent to obtain it.

3. Data we collect

Essential storage (always on). One entry in your browser’s local storage, named spotitools_consent, records your consent choice and the date you made it; another records your light or dark theme. These are not cookies, are not transmitted, and are removed when you clear site data.

Server logs. Our hosting provider records standard request logs (IP address, requested URL, browser type, timestamp) to serve pages and defend against abuse. Logs are retained by the provider for a limited period and are not used to profile you.

Page views (no cookie). Counted with Vercel Web Analytics as described in section 5: in the EEA, the UK, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man only after you accept Analytics; elsewhere when the page loads, unless you have rejected Analytics. No cookie is set and nothing is stored in your browser.

Analytics (off until you consent). We use Google Analytics 4, operated by Google LLC, in Consent Mode. Google Analytics loads only when you accept both Analytics and Advertising. Accepting Analytics alone does not load Google Analytics: it means Vercel’s cookieless page-view count only. Until both are accepted, the Google Analytics script is not loaded and no data is sent to Google. When both are accepted, GA4 collects: pages viewed, referring site, approximate location derived from IP, device and browser type, and the events listed in section 4. IP addresses are not stored by GA4. Data is retained for 14 months. You can withdraw consent at any time on the cookie settings page. Withdrawing consent reloads the page, and Google Analytics stops.

Advertising (off until you consent). Ads are shown in fixed positions to keep the tools free. No advertising script loads, and no advertising cookie is set, until you accept the Advertising category. When you accept, except on a health calculator page, the page loads Google ad serving from Google LLC and Google Ireland Limited (privacy policy; how Google uses data in advertising). That request chooses and measures ads, and it also reaches Criteo SA (privacy policy) and RTB House SA (privacy policy) for the same purpose. The cookies those partners set are in section 6. Meta Platforms Ireland Limited and Meta Platforms, Inc. provide the Meta Pixel. It loads only after you accept both Analytics and Advertising: Google Tag Manager, container GTM-N8FSV979, then requests https://connect.facebook.net/en_US/fbevents.js for pixel 925850003521432. It does not load before a choice, after you reject non-essential storage, or when only Analytics or only Advertising is on. Meta describes the Pixel as measuring how ads perform and defining custom audiences for advertising (Meta Pixel). On a page view it sends Meta the page address, including the query string and the #fragment, the referring address, your IP address, browser and device information, the _fbp cookie, and a PageView event. The Meta Pixel and Google Analytics do not load on health calculator pages: BMI, body fat, calorie, pregnancy and due date, ovulation, period, and the other calculators in the health category. Health calculator pages show no ads and load no advertising scripts. Numbers you enter in a calculator stay in your browser. On other pages, Meta’s automatic events may collect button text. It sets an _fbp cookie. When the page address includes an fbclid parameter, it also sets an _fbc cookie that stores that click identifier; Meta says _fbc lasts 90 days. Meta’s cookies policy says _fbp identifies the browser for advertising and site analytics services and lasts 90 days (cookies policy). Meta keeps what it receives for the period set out in its own privacy policy. Turn Analytics or Advertising off on the cookie settings page: on a later visit the Pixel does not load unless both are accepted again. An _fbp cookie already stored stays until it expires or you clear site data. A content blocker that blocks connect.facebook.net also stops it. For the personal data the Pixel collects and sends to Meta, we and Meta are joint controllers (Court of Justice of the European Union, Fashion ID, C-40/17). How that joint controllership is divided is set out in Meta’s Controller Addendum. The Pixel sends that data to the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (listing). For visitors in the United Kingdom, Meta relies on the safeguards in its own terms (for example the UK IDTA or the Addendum to the SCCs).

4. What analytics events contain

When both Analytics and Advertising are accepted, Google Analytics records these events: which tool card was clicked; that files were selected, with the number of files and total size as ranges (for example “2–5 files, 10–50 MB”); that a conversion started and finished, with its duration; that a chain step was taken from one tool to another; that a download was made, single or ZIP; that an error was shown, by category; and which fancy-text style was copied. No event ever includes a filename, file contents, image data, dimensions of a specific file, or any identifier derived from a file.

The Meta Pixel (section 3) loads only when both Analytics and Advertising are accepted. It then sends Meta the page address, including the query string and the #fragment, the referring address, your IP address, browser and device information, the _fbp cookie, and a PageView event. That address can include a search you typed on the all-tools page (?q=), a short title on a countdown link (?t=), or a size preset on the image compressor (?target=, for example 200kb). It does not include a file name, file contents or image data: no tool writes those into the address. The Meta Pixel and Google Analytics do not load on health calculator pages (BMI, body fat, calorie, pregnancy and due date, ovulation, period, and the other calculators in the health category). Health calculator pages show no ads and load no advertising scripts. Numbers you enter in a calculator stay in your browser. Health calculator pages also tell your browser not to send their address as the referrer when you leave them, so the next page and its partners do not receive it as the referrer. On other pages, Meta’s automatic events may collect button text. Vercel Web Analytics, in section 5, removes the query string and the #fragment before it sends a page view.

5. Page-view analytics (Vercel Web Analytics)

Who. Vercel Inc. (United States), which hosts this site, provides Vercel Web Analytics. It runs from this site’s own address (/_vercel/insights/); no other domain is contacted for it.

What is collected. For each page view: the time; the page address, with any query string and #fragment removed in your browser before sending; the referring site; an approximate location derived from your IP address (country, and region and city where Vercel can tell); operating system, browser and their versions; and device type (desktop, tablet or mobile). To count unique visitors, Vercel computes a hash from the incoming request, which includes your IP address; the hash is discarded after 24 hours and Web Analytics does not store the IP address. No cookie is set and nothing is stored in your browser. A file name, file contents, image data or anything you typed is never included.

Why. To count visits in aggregate (which tools and pages are used, where visitors arrive from, which devices to support) and to notice broken pages. It is not used for advertising or profiling and is not combined with Google Analytics.

How long. Vercel retains these aggregated records for at least 12 months under the provider’s plan, and may retain them longer under its own terms (Web Analytics reporting window). We do not use them beyond the purposes stated in this section. The visitor hash lasts 24 hours.

Transfer abroad. The data is processed by Vercel in the United States and may be processed by its sub-processors elsewhere. Vercel is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and its Data Processing Addendum includes the EU Standard Contractual Clauses and the UK addendum.

Legal basis. Our legitimate interest in understanding, in aggregate, how the site is used so we can keep it working and improve it. For the European Economic Area and Gibraltar that interest is GDPR Article 6(1)(f) (Gibraltar has its own GDPR). For the United Kingdom it is the UK GDPR. For Switzerland it is the revised Federal Act on Data Protection (revised FADP), which is Switzerland’s own law and is not the GDPR. In Hong Kong it is the Personal Data (Privacy) Ordinance. In the European Economic Area, the United Kingdom, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man we go further: Web Analytics loads only after you accept the Analytics category. Whether you are there is decided in your browser from its time-zone setting, without looking up your IP address; if the time zone is missing or set to UTC or GMT, you are treated as being there.

How to opt out. In the EEA, the UK, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man it stays off unless you accept Analytics, and you can withdraw on the cookie settings page. Everywhere else, choose “Reject non-essential” in the banner or switch Analytics off on the cookie settings page: the script is then not loaded on this device, and further page views in the open page are dropped. A content blocker that blocks /_vercel/insights/ also stops it.

6. Cookies and similar storage

7. Legal basis and jurisdiction

The operator is established in Hong Kong SAR and handles personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486). For visitors in the European Economic Area and Gibraltar, Google Analytics and advertising rely on your consent (GDPR Article 6(1)(a); Gibraltar has its own GDPR), and essential storage and the cookieless page-view count rely on our legitimate interest in operating the site (GDPR Article 6(1)(f)). For visitors in the United Kingdom the same split applies under the UK GDPR. For visitors in Switzerland the same split is consent or other justification under the revised Federal Act on Data Protection (revised FADP); the GDPR article numbers above are not the law in Switzerland. Jersey (the Data Protection (Jersey) Law 2018), Guernsey (the Data Protection (Bailiwick of Guernsey) Law, 2017) and the Isle of Man (the Data Protection Act 2018) are in the same consent gate: analytics and advertising wait for your consent. For visitors in California, accepting Advertising may count as “sharing” or a “sale” under the CCPA. You can opt out by rejecting Advertising in the banner or on the cookie settings page. In the European Economic Area, the United Kingdom, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man the page-view count is, in addition, loaded only after you accept Analytics (section 5).

8. Your rights

You can withdraw consent at any time on the cookie settings page. Depending on where you live you may also have rights to access, correct, delete or export personal data about you, and to object to or restrict its processing. Because we hold no account data and never receive your files, most requests concern analytics data held by Google; contact privacy@spotmind.co and we will help you exercise them. You may also complain to your local data protection authority or, in Hong Kong, the Office of the Privacy Commissioner for Personal Data.

9. Children

The site is not directed at children under 13 and does not knowingly collect personal data from them. Google Analytics and advertising stay off until you accept the banner. The cookieless page-view count (section 5) does not use a cookie; in the EEA, the UK, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man it also waits for you to accept Analytics, and elsewhere it stops if you reject Analytics.

10. Changes

A saved advertising choice is version 2. If this browser still has an advertising grant from an older version, the banner is shown again, that grant is dropped, and the analytics choice already saved is kept. Advertising stays off until you answer. A stored rejection, or analytics without advertising, is not asked again. A stored value that is not a real choice is discarded and the banner is shown. The date at the top of this page changes when this text changes.