Privacy policy

Last updated: October 7, 2026

The short version: the files you convert never leave your device. We have no accounts and no analytics. The site is paid for by ads from Google, but they only load if you agree, and you can change your mind at any time with “Cookie settings”.

1. Who is responsible

This website is operated by Dağhan M., a private individual based in Romania. For data protection law (such as the EU and UK GDPR) we are the "controller" for the data described below. Privacy and legal requests only: privacy@convert-box.com. We don't offer support by email.

2. The files you convert

convert-box converts files inside your web browser, on your own device. When you add a file:

• it is read into your browser's memory and processed there;
• it is not uploaded to us, to advertisers or to anyone else;
• the converted result is created in your browser and saved straight to your device;
• everything is gone from memory when you close or reload the tab.

Because we never receive your files, we can't see, store, recover, share or delete them. Please keep your originals.

3. What our web server receives

When you open a page, your browser asks our hosting provider (Cloudflare (Cloudflare, Inc.)) for the files that make up this site. Like any web server, it automatically receives your IP address, the date and time, the page requested, your browser type and operating system, and the referring page. This is used only to deliver the site and keep it secure. Cloudflare handles this data under its privacy policy and keeps it only as long as needed for delivery and security. Legal basis: our legitimate interest in running a working, secure website (Art. 6(1)(f) GDPR).

Fonts and conversion code are stored on our own server, so loading the site doesn't contact Google Fonts or other file hosts.

4. Advertising (Google AdSense)

To keep convert-box free, we show ads through Google AdSense, provided by Google Ireland Limited (for the EEA, UK and Switzerland) or Google LLC (elsewhere). No Google code is loaded until you choose “Accept all” or turn on “Show ads” in our cookie banner. If you choose “Reject all”, no ads load and Google receives nothing from this site.

If you allow ads:

• Google and its partners may place and read cookies or similar identifiers on your device, and receive your IP address, browser details and the page you're on, to show ads, limit how often you see them, measure results and prevent fraud.
• If you also allow personalised ads, third-party vendors, including Google, use cookies to show ads based on your previous visits to this and other websites. Google's use of advertising cookies lets it and its partners serve ads based on those visits.
• If you allow ads but not personalisation, Google shows non-personalised ads based on general context, such as the page topic and your rough location.

Your converted files are never part of this, because they never leave your device.

Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies). Data may be transferred to the United States. Google relies on the EU–US Data Privacy Framework and standard contractual clauses. Learn more: how Google uses information from sites that use its services and Google's privacy policy. You can turn off personalised advertising from Google at Google Ad Settings, and from many other vendors at aboutads.info or youronlinechoices.eu.

5. Cookies and local storage

convert-box itself sets no cookies. It saves two small settings in your browser's local storage, which never leave your device:

• cb-consent: your cookie choice, so we don't ask on every page. We ask again after about 6 months.
• cb-theme: light or dark mode, only if you press that button.

Advertising cookies from Google and its partners (for example __gads, __gpi, IDE) are only set if you allow ads. Their names and lifetimes are set by Google and can change, and are typically up to 13 months.

Changing your mind: use Cookie settings, which also appears at the bottom of every page, to withdraw or change your consent at any time. Withdrawing doesn't affect anything that happened before. You can also delete cookies in your browser settings.

6. Reading text from images (OCR)

The “image to text” tool needs a large recognition engine, which we load from jsDelivr (cdn.jsdelivr.net), a public open-source file host, but only after you agree in a pop-up. jsDelivr then receives your IP address and browser details, like any website. Your image is not sent to jsDelivr. Legal basis: your consent (Art. 6(1)(a) GDPR). See jsDelivr's privacy policy.

7. US state privacy rights (including California)

Under laws like the California Consumer Privacy Act (as amended by the CPRA), showing personalised ads may count as "sharing" personal information for cross-context behavioural advertising. We don't sell personal information for money, and we don't knowingly share data of anyone under 16.

• Opt out: use Do Not Sell or Share My Personal Information, which also appears at the bottom of every page, and switch off personalised ads.
• Global Privacy Control: if your browser sends a GPC signal, we automatically treat it as an opt-out and never show personalised ads.
• You also have the right to know, delete and correct personal information, and not to be treated differently for using these rights. Send requests to the privacy address in section 1.

8. Children

convert-box is a general tool and is not aimed at children under 16. We don't knowingly collect personal information from children.

9. Your rights

Depending on where you live, you may have the right to access, correct or delete personal data about you, to object to or restrict its use, to withdraw consent, and to complain to a data protection authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP). If you live elsewhere in the EU or the UK, you can also contact your own local authority. We hold almost nothing ourselves (only short-lived server logs). For advertising data, Google is an independent controller, and you can manage it at Google's privacy controls. Send any request to the privacy address in section 1.

10. Changes

If we change how the site handles data, we will update this page and the date at the top before the change goes live.