Privacy Policy
Effective date: October 21, 2026 • Applicable across all ByteConvert web applications, APIs, and conversion utilities.
Zero Data Selling
We never sell, rent, or monetize your files or personal information to third parties, advertisers, or AI training datasets.
Automated Deletion
Guest conversions are automatically purged after 1 hour. Saved files are permanently destroyed the moment you delete them.
100% User Ownership
You retain full intellectual property ownership and control over all source documents, media, and converted outputs.
1. Information We Collect and Process
ByteConvert is designed with strict data minimization at its core. We collect only what is strictly necessary to reliably process file conversions, authenticate authorized account access, and deliver services you request:
- Account Information: When you register an account, we collect your verified email address and a cryptographically salted password hash. We never store plain-text passwords.
- Uploaded Files and Conversion Data: The files you submit for processing, the chosen target format, custom conversion settings (such as quality or dimensions), and the converted output results.
- Device and Security Telemetry: To protect your account against unauthorized takeovers and credential stuffing, we log essential security context including your IP address, browser user-agent, operating system, and approximate country/city location.
- Transactional Metadata: Timestamps of conversion jobs, processed file sizes, and your daily quota usage.
2. How Files Are Processed & Automated Retention Rules
When you submit a conversion request, files are routed directly to dedicated processing environments. We operate strict retention rules:
Unauthenticated Guest Conversions — 1-Hour Physical Purge
Download links and processed files generated by guest users remain accessible for exactly 1 hour. Following expiration, an automated background cleanup process permanently deletes the files from disk and marks the token expired. Expired links immediately return an irreversible HTTP 410 Gone.
Registered Account Storage
Logged-in users may choose whether converted files are saved to their personal File Manager storage within their quota. Saved files persist until you click delete. Deletion is instantaneous and permanent.
No Machine Learning or AI Model Training
Your content is never parsed, indexed, analyzed, or utilized to train machine learning algorithms or generative AI models.
3. Account Security, New Device Alerts & Checkpoints
ByteConvert enforces multi-layered defense mechanisms to safeguard your identity and data:
- Mandatory Email Confirmation: Every new registration requires completing email confirmation before access to the conversion dashboard is granted.
- Unrecognized Device Protection: When an account login originates from a new or unrecognized browser, system, or location, ByteConvert requires a single-use 6-character verification code delivered to your registered inbox.
- Instant Security Alerts: Upon any new login, an automated notification is dispatched containing the login date, time in UTC, approximate location, operating system, and IP address.
- Session Management & Sudo Protection: You can review all active devices and revoke access anytime in your Settings. To prevent unauthorized session tampering, revoking sessions requires confirming a single-use security code, unlocking 20 minutes of elevated management access.
- Multi-Factor Authentication (2FA) & Passkeys: Support for hardware security keys, biometric passkeys, and time-based authenticator apps (TOTP).
4. Cookies and Local Storage
We use strictly necessary cookies to keep you securely signed in and maintain security tokens across page navigation. We do not use third-party tracking pixels, invasive cross-site analytics cookies, or behavioral advertising trackers.
5. Your Rights Under GDPR & CCPA
Depending on your jurisdiction, you possess statutory rights concerning your personal information:
- Right to Access: Request a complete copy of data associated with your account.
- Right to Rectification: Update or correct your account credentials and preferences.
- Right to Erasure ("Right to Be Forgotten"): Request the permanent deletion of your account, active sessions, and stored files.
- Right to Portability: Export your saved files and conversion history in structured formats.
6. Third-Party Service Providers
We partner exclusively with reputable infrastructure and service providers bound by strict confidentiality and data protection obligations:
- Transactional Email: Handled securely via Maileroo for system alerts, verification links, and password resets.
- Abuse & Bot Prevention: Cloudflare Turnstile provides privacy-preserving human verification without storing user biometric tracking.
- Payment Processing: Stripe handles billing transactions. We never receive or store your raw payment card numbers.
7. Contacting Our Privacy Team
If you have questions, feedback, or wish to exercise any statutory data protection rights, please contact our team directly: