How we handle your files

ConvertFile has two kinds of tools. Each tool page says which kind it is.

Tools that run in your browser

These tools never send your file to us: Merge PDF, Split PDF, Remove pages, Extract pages, Reorder pages, Rotate PDF, Resize PDF pages, Crop PDF, JPG and PNG to PDF, PDF to JPG or PNG, PDF to Word, PDF to text, PDF to HTML, PDF to Markdown, Add page numbers, Add watermark, Fill PDF forms, Flatten PDF, Sign PDF, Protect PDF, Edit PDF metadata, Redact PDF, Sign with a certificate, Unlock PDF, Compare PDFs, OCR PDF, Image converter, Resize and compress images, Video editor, Screen recorder, Video recorder, Merge videos, Add audio to video, Trim video, Add image to video, Add text to video, Remove logo from video, Crop video, Rotate video, Flip video, Resize video, Loop video, Change video volume, Change video speed, Stabilise video, Trim audio, Change volume, Change speed, Change pitch, Equaliser, Reverse audio, Voice recorder, Audio joiner, Extract audio, Audio converter, Video converter, Font converter, Archive converter, eBook converter, Archive extractor.

• Your browser reads the file and does the work using code downloaded from our site. The file contents are not uploaded, logged or sent to analytics.
• Our pages load Google AdSense ads and Google Analytics and Microsoft Clarity. These see that you visited a page, the same as on most websites. They never receive your files, file names or anything inside them, because your files are never sent anywhere and the tool area is masked from Clarity's recordings.
• We record only that a tool was started, completed or failed, with the tool name and your plan type. No file names, sizes or contents.
• Browser extensions you have installed can sometimes read page content. That is outside our control.

Tools that run on our server

These tools upload your file for processing: Compress PDF, Repair PDF, Word, Excel and PowerPoint to PDF.

• Files travel over HTTPS and are stored in private storage that is not publicly accessible. Each file is saved under a random internal name.
• Only the browser session or account that uploaded a file can check its status or download the result. Download links expire after 60 seconds.
• Processing runs in a separate worker process that has no access to our database or payment systems and is given only that job's files.
• Your original upload is deleted as soon as processing finishes.
• The processed result is deleted about 60 minutes after it is ready. If processing fails, files are deleted immediately. Jobs that never finish are cancelled and deleted after 120 minutes.
• Deletion is done by a cleanup task that runs every five minutes, so a file can outlast its deadline by a few minutes. Our storage is also set to expire anything left in the processing area after one day, as a backstop.
• You can delete a result straight away with the “Delete from server now” button, or from your dashboard.
• Temporary copies made by the worker while processing are removed when each job ends, and leftovers from a crash are swept away on restart and hourly.

What we keep

For billing, abuse prevention and support we keep a job record: the tool, time, status, input and output sizes, page count, processing time and any error code. We do not keep the contents of your documents. Original file names are stored only alongside the files and are deleted with them.

Backups and limits

Database backups contain job records but not files. We don't back up the processing storage. Our storage provider may keep deleted data internally for a short period under its own policies before it is permanently erased. Staff with infrastructure access could technically reach a file during its short retention window; our admin tools do not show document contents.

Passwords

Protect PDF and Unlock PDF run in your browser. Passwords you type into them are never sent to us.

Questions

Write to us through the contact page.