Privacy Policy

Last updated: September 10, 2026

This policy explains exactly what happens to your images and data when you use EasyImageConvert. Our principle is simple: we store only what is necessary to perform the conversion, and nothing is kept permanently.

1. Summary (TL;DR)

  • Images you upload or import from a URL are stored temporarily on the server only to perform the conversion you requested.
  • All uploaded files, converted files, and temporary job metadata are automatically and permanently deleted approximately 1 hour after upload/conversion.
  • There is no database storing user accounts, image records, or conversion history.
  • Each user may convert up to 20 image files per day; counters are reset automatically at midnight UTC.
  • We do not look at, share, or sell your files. We do not use your images for analytics, training, or any secondary purpose.

2. Image Processing & Temporary Storage

When you upload an image or import one from a URL:

  • The file is written to a non-web-accessible folder inside storage/uploads/ using a cryptographically random filename (your original filename is not used for storage).
  • Conversion is performed locally on the server using Imagick (primary) or GD (fallback).
  • Converted output files are written to storage/converted/ with another random filename.
  • After ~1 hour, the hourly cron cleanup script permanently deletes all expired uploads, converted results, ZIP archives, and job metadata.
  • Files are never moved to long-term storage, off-site backups, or third-party services.

3. No Database

EasyImageConvert does not use any MySQL, PostgreSQL, SQLite, or other database for image storage or user records. All temporary state (job metadata, daily counters, rate limits) is stored as short-lived JSON files inside the protected storage/ directory, subject to the same automatic deletion schedule.

4. Daily Conversion Limits

To keep shared hosting resources fair for all users, each visitor is subject to a 20 image files per day limit. The limit is counted per successfully converted image file, and the counter resets automatically at midnight UTC. Counters are stored under storage/limits/ using a privacy-conscious HMAC identifier (raw IP addresses are not written directly to disk).

5. URL Import

If you choose the "Import from URL" feature, the server downloads the remote image to a temporary file, validates that it is actually an image, and then processes it exactly like a direct upload. The URL you provide is retained only for the duration of the job and is removed by the cleanup system after ~1 hour.

6. Information We Collect (Minimal)

We process only the following technical information required for operation and abuse prevention:

  • IP Address & User-Agent: Used to compute a privacy-conscious HMAC identifier for rate limiting and the 20/day quota. These values are not written permanently to logs in raw form.
  • Session cookie: A PHP session cookie is used for CSRF token protection and job ownership. It expires when the browser closes.
  • Server access logs: Standard Apache/Hostinger access logs may be retained by the hosting provider for a short period per their own policy (typically 7–30 days). We do not ship these logs elsewhere.

There are no advertising cookies, analytics trackers, or third-party tracking scripts on the converter pages.

7. Data Retention Schedule

  • Uploaded / converted image files, ZIPs, job metadata: ~1 hour (cleanup runs hourly via cron).
  • Per-minute / per-hour rate limit counters: up to 2 hours.
  • Daily 20-file conversion quota counters: up to 2 days (to preserve the daily counter correctly across date rollover).
  • PHP error logs (if any): up to 14 days.

8. Security

All traffic should be served over HTTPS in production. All storage directories are protected with Apache .htaccess rules that deny public browsing, disable PHP execution, and return HTTP 403 to any direct request. Download links use one-time random tokens tied to your session; they cannot be guessed or shared to access another user's files.

9. Children’s Privacy

Our service is not directed to children under 16, and we do not knowingly collect personal information from children. Because we do not operate user accounts and files are auto-deleted within 1 hour, there is no persistent repository of child data.

10. Your Rights & Data Erasure

Because files are automatically deleted within approximately 1 hour and no user account database exists, most "right to access" or "right to erasure" requests are satisfied automatically by the retention window. If you have a specific legal concern, contact us via the Contact page and we will confirm there is nothing remaining and provide any available information. Please note that by the time a manual request is processed, the hourly cleanup has almost always already permanently removed the files.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date above will change. Continued use of the service after changes are posted constitutes your acceptance of the revised policy.

12. Contact

Questions about this Privacy Policy, data handling, or deletion requests can be sent via our Contact page.