Privacy Policy

Before you read on

What follows describes how the service actually behaves. If the behaviour changes, this page changes with it.

Where the details differ item by item, such as how long something is kept, we list each item separately instead of collapsing them into one sentence. Some items are never deleted automatically, and we say so plainly rather than hiding it.

1. We never collect the files you convert

Conversions run entirely inside your browser. Your files are never sent to our server, so there is nothing for us to collect or store.

We do not send the file name, the file size or the contents either.

2. Why we process anything at all

Running the service: the conversion itself finishes inside your browser, so no personal data is involved in it.

Understanding usage and improving: knowing which pages and which conversions are actually used helps us decide what to work on next.

Blocking abnormal traffic: filtering bursts of excessive requests keeps the service from falling over.

Protecting the administrator account: we record what happens in the admin screens so unauthorised access can be investigated later.

3. What we do process

There are no accounts, so we never ask for a name or contact details.

Visit statistics: which pages were viewed and where visitors arrived from (the referral category and the referring site address), kept as daily counters. We do not build a per-person history.

Visitor token: a random value stored in your browser so repeat visits are not double counted, used only in the daily totals. It is not tied to your identity and disappears when you clear your browser storage.

Search terms that brought you here: when you arrive through a search engine, the previous page address your browser sends along sometimes still contains the query. When it does, we lowercase it, cut it to 40 characters, and count which terms bring people in. We do not store who searched, so it is not linked to the visitor token or to an IP address. Most search engines now strip the query before sending it, so this rarely happens, but when it does the text you typed is recorded exactly as typed, and we would rather say that outright.

Conversion statistics: which conversion was used, whether it succeeded, how many milliseconds it took, and the time of the entry. Nothing about the file is recorded, and neither is your IP address.

Ad impressions and clicks: when at least half of an ad slot is on screen, the impression count for that slot goes up by one, once per page view; when you press an ad slot, the click count for that slot goes up by one. Only these two running totals per slot number are kept. We do not record who saw or pressed it, and nothing that could identify a visitor is stored with them.

IP address: used only for the calculation that rate-limits excessive requests, and gone once that calculation is done. It is not used for the visit or conversion statistics above.

Administrator audit log: we record what happens in the admin screens (successful and failed sign-ins, two-factor checks, creating, editing and deactivating administrator accounts, editing ad slots, editing business details). Each entry holds the event name and time, the administrator account identifier, the target account identifier, the names of the fields that changed, the role granted, the ad slot number, and outcome values such as how many items were removed when two-factor authentication was reset. It does not hold an IP address.

The email address used in a failed administrator sign-in: when someone tries a registered administrator account with the wrong password, the email address entered at that moment is written to the audit log as typed. An attempt using an address that is not registered leaves no record at all. Ordinary visitors never use the admin screens, so this entry is not created for them, but it is the one path where an email address is stored, so we list it separately.

4. We collect only after you agree

The visit statistics, the visitor token, the search terms and the conversion statistics are collected only if you accept in the banner at the bottom of the screen. Until you choose, and if you decline, nothing is sent and no visitor token is created.

The IP-based request limit and the administrator audit log are not covered by that choice. The first is the minimum needed to keep the service running; the second only ever concerns administrators.

You can withdraw consent at any time by clearing your browser storage.

5. How long we keep it

Retention differs from item to item. A single blanket sentence would misdescribe it, so here is each item on its own.

IP address: gone automatically after about 65 seconds. That is a one-minute counting window plus five seconds of slack. It is not copied into a separate database. If the store used for that counting fails, however, the failure is written to the server operations log together with the IP address of that request, and that log follows the server own retention.

Visit statistics: deleted automatically about 100 days after they were collected.

Visitor token: the value in your browser stays until you clear your storage. Our daily totals expire on the same 100-day schedule as above.

Search terms that brought you here: there is no automatic expiry. We keep only the top 500 by frequency, and an entry is removed when it falls out of that ranking. In other words, a term that keeps bringing people in stays until we delete it ourselves.

Conversion statistics: there is no automatic expiry, so they accumulate. As noted above, an entry holds only the conversion type, whether it succeeded, how long it took, and the time.

Administrator audit log: there is no automatic expiry, so it is kept indefinitely. The point of the log is to let us check afterwards whether anyone tried to break in. The failed sign-in email addresses described above are kept in it too.

Administrator session and anti-forgery cookies: they disappear when the administrator signs out or when the set lifetime expires.

6. How data is destroyed

For the items with an expiry (IP address, visit statistics, visitor token totals), the store deletes them itself once the time is up. No one touches them by hand, and we keep no separate copy.

Three items have no expiry: the search terms, the conversion statistics and the administrator audit log. These are destroyed only when we decide they are no longer needed and delete them ourselves. There is no fixed schedule for that, and we are not going to pretend otherwise.

If we introduce automatic expiry for them, we will amend the retention and destruction sections of this document and update the effective date.

7. Processors and transfers abroad

We use no third-party analytics. Statistics stay on servers we run ourselves.

Traffic reaches us through Cloudflare, so a request may pass through servers outside your country. The files you convert never leave your browser, so they never travel that path.

8. Cookies

We set no tracking cookies for ordinary visitors. Your consent choice and the visitor token live in browser storage, not in cookies.

Administrator sign-in does use cookies, solely to keep the session and to block forged requests.

If we add advertising later, a third-party ad provider may use its own cookies or identifiers. In that case we will amend this policy and tell you before it happens.

9. How we keep it safe

The strongest measure is not collecting. The files you convert never reach the server, so there is no file on our side that could leak from it.

Traffic between you and the server travels over an encrypted connection (HTTPS).

Administrator passwords are never stored in the clear; only a scrypt hash is kept, and two-factor recovery codes are stored the same way.

Administrator accounts use one-time-code (TOTP) two-factor authentication, sign-in attempts are rate-limited, and the account locks after repeated failures.

Sensitive settings such as the two-factor secret are stored under envelope encryption (AES-256-GCM) with a separate key.

Administrator session cookies are set so scripts cannot read them, and they are paired with an anti-forgery token and an allowed-origin list.

Each line of the audit log carries forward the hash of the line before it, so editing a line or removing one from the middle shows up when the log is verified. That detects tampering; it is not the same as the database refusing edits and deletions outright. We have not applied that restriction yet, so we do not claim the log cannot be altered.

10. Your rights, and what we can actually do

You may ask to see, correct or delete what we hold, or to stop us processing it. Because our records contain almost nothing that identifies a person, some of those requests we can carry out and some we cannot. Here is which is which.

The visitor token disappears the moment you clear your browser storage. You do not need to tell us.

You can withdraw consent at any time, and nothing is sent after that.

Your IP address will already have expired by the time a request reaches us.

Visit and conversion statistics accumulate as daily totals and counts with no marker of whose they are, so there is no way to pick out one person’s share and remove it. We cannot carry out a deletion request there, and we would rather say so than promise otherwise; what we offer instead is never building those records in an identifiable form to begin with.

The search terms likewise carry no record of who searched, so you cannot point us at "my" query. If you tell us that a particular string relates to you, however, we can remove that entry from the list.

A failed sign-in email address in the administrator audit log can be identified if it is your address. You may ask us to delete it; we weigh that against our need to keep records of attempted unauthorised access, and we will also tell you that because the lines are hash-linked, deleting one breaks integrity verification for everything after it.

11. Data protection officer

Privacy officer: info@sudev.co.kr

12. Where to seek redress

If you need help with a privacy matter, the Korean bodies below offer counselling and dispute mediation. They operate independently of us.

Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)

Privacy Infringement Report Centre: 118 (privacy.kisa.or.kr)

Supreme Prosecutors’ Office, Cyber Investigation Division: 1301

National Police Agency, Cyber Bureau: 182

13. Changes and effective date

This policy takes effect on September 27, 2026. The last-updated date at the top of the document is the effective date.

When the way we handle data changes, we amend this document at the same time as the code and update the date. Changes that could work against you, such as collecting more or keeping it longer, are posted on this page seven days before they take effect.

14. Contact

For questions about how we handle data, use the address below and we will reply once we have looked into it.

Email: info@sudev.co.kr