Privacy

The short version

• Most conversions run inside your browser. The file never leaves your device, and we never see it.
• A few heavy conversions run on our server. Those are labeled before you convert, the upload goes straight to a private EU storage bucket, and the file is deleted within about an hour.
• There is no cookie banner because there is nothing to consent to: no tracking cookies, no advertising, and cookieless analytics.

Conversions in your browser

The default engine is WebAssembly running on your own device. Your file is never uploaded, so we cannot see, store, scan, sell, or train on it; during a browser conversion the site makes no request that carries file bytes. You can verify this yourself in your browser's network tools, and our automated tests assert it on every release. Browser conversions also create no account and no session.

Conversions on our server

Office documents, PDF to Word, and large video are more than a browser tab can handle, so those pairs run on our server and are labeled as such before you convert. What happens then:

• Your file is uploaded over an encrypted connection directly to a private storage bucket held under EU jurisdiction. Our website servers never touch the file bytes.
• A conversion server we run in Germany processes the file and writes the result back to the same bucket.
• Download links are signed and expire after one hour.
• Your uploaded file is deleted the moment the conversion succeeds, and the converted result is deleted about an hour after it finishes. As a backstop, a storage lifecycle rule removes anything left over within a day. Deleting your account removes your stored files immediately.

We do not open, read, or share server-converted files, and we do not keep your file names in our database: jobs are tracked by random ids.

The developer API and API keys

We run a hosted conversion API for developers, covering the same server-only pairs as above (office documents, PDF to Word, and large video). It is separate from the open-source SDK, which runs entirely in the browser and uploads nothing. When you call the hosted API, you send a file to be processed on our server, so the server-conversion handling described above applies in full: the upload goes to the same private EU storage bucket over an encrypted connection, the input is deleted the moment the conversion succeeds, and the result is deleted about an hour later.

• API keys are created from the developer dashboard and tied to your account. We store only a one-way hash of each key plus a short non-secret prefix, never the key itself, so a key cannot be recovered from our database; we keep a last-used timestamp so you can spot a stale key.
• We meter usage per key and per account so the free monthly allowance and credits work: for each billing window we keep a count of conversions and the total bytes processed through each key. That meter holds counts and sizes, never file contents or file names.

IP addresses

We process your IP address to keep the service working and to prevent abuse, not to profile you:

• For rate-limiting and abuse prevention, your IP is used as a short-lived counter key (for example, to cap how many server conversions or API calls come from one address in an hour). These counters live in our database and are pruned about a day after the counting window closes.
• For any request that reaches our servers, including a server conversion or an API call, the hosting and storage platforms listed below see your IP transiently as the connecting address, the way any web server does. We do not store it alongside your conversion history.

Accounts and what we store

Browser conversions need no account, no signup, and no session. Server conversions need one, in two flavors:

• An anonymous session, created only when you start your first server conversion. It carries no name and no email address.
• An optional email account, used to sign in with a one-time code. There are no passwords, so none are stored.

For each server conversion we keep a history row: the format pair, status, file sizes, and timestamps. Never the file contents. Purchases add an order record (what you bought, when, and the order id) so your credits and passes work.

Cookies

There is no cookie banner on this site because we use no tracking cookies at all:

• Browsing the site and converting in your browser sets zero cookies.
• Starting a server conversion or signing in sets only the strictly necessary session cookies that keep you signed in.
• The analytics script sets none.

Analytics

We count page views and product events (for example "a conversion started") with cookieless, EU-hosted analytics. Events never include your file, your file name, or your email address; file sizes are only ever recorded as coarse buckets. No advertising trackers, no cross-site tracking.

Email

We treat two kinds of email very differently:

• Service email: sign-in codes and messages about things you bought, such as a heads-up before a pass you paid for expires. These are part of the service.
• Marketing email: only if you tick the optional product-updates checkbox, which is separate and unchecked by default. Without it we send nothing promotional, and you can withdraw at any time by emailing support@hushvert.com.

Who processes data for us

We run hushvert on a small set of processors, each named here once with its job:

• Supabase: sign-in and our database, hosted in Frankfurt, Germany.
• Vercel: hosts the website and its API routes, which validate and authorize but never touch file bytes.
• Hetzner: the conversion server for server-side pairs, in Falkenstein, Germany.
• Cloudflare: stores uploaded files (R2, EU jurisdiction) and provides the Turnstile bot check when an anonymous session is created.
• Polar Software Inc.: merchant of record for payments. They are the seller you buy from; card details, tax, refunds, and payment disputes are handled there, never by us, and the payment records they are legally required to keep stay with them even after you delete your hushvert account.
• Resend: sends our service email, from an EU region.
• forwardemail.net: receives inbound mail to our support address.
• PostHog: the cookieless analytics described above, EU-hosted.
• Sentry: error monitoring, so we hear about bugs; reports carry error details, not file contents or email addresses.

Your rights (GDPR)

Wherever you are, we honor GDPR-style rights: access, rectification (correction), erasure (deletion), restriction of processing, data portability, and objection. The fastest path for erasure is self-serve: delete your account on the account page, which removes your sign-in, conversion history, purchase records on our side, and any stored files. For everything else, email support@hushvert.com; if you are in the EU you can also complain to your local data protection authority.

EU representative: hushvert is operated from outside the EU, so under GDPR Article 27 we are arranging an EU-based representative. One is not yet appointed; in the meantime EU residents can reach us directly at support@hushvert.com, and this section will be updated with the representative's name and contact details once it is in place.

Changes

If what we collect or who processes it changes, this page is updated before the change takes effect, with a new effective date. The promise that holds everything else up stays put: convert in your browser and your files never leave your device.