File handling
Converted
Then erased
A converter earns trust by holding on to as little as possible for as short a time as possible. This page sets out exactly what happens to a file between the upload and the download, and what never happens to it at all.
The controls behind that
Six measures, each doing one job, none of them relying on the others to hold the line.
Deleted when the job ends
The source file is removed the instant the conversion returns. The output follows within the hour, whether you downloaded it or not. Nothing is archived and nothing is backed up, so there is no later copy for anyone to ask us for.
Encrypted end to end of the wire
Every request runs over TLS 1.3, and HSTS is enforced so a connection cannot be negotiated down to something weaker. Your file never crosses the network in the clear, in either direction.
One job, one sandbox
Each conversion gets its own isolated environment with no route to any other job on the platform. When the work finishes the sandbox is torn down and its temporary data goes with it.
Nothing written for the long term
The pipeline streams files through the encoders rather than parking them on disk for later. There is no user-file volume to browse, no bucket of old uploads, and no admin screen pointed at either.
Results bound to your session
Only the session that started the upload can collect the result. No shareable link is minted, nothing is indexable, and a stray URL in someone else's hands opens nothing.
Engines you can go and read
The conversions lean on long-established open-source projects such as FFmpeg, LibreOffice and Calibre rather than a closed binary we ask you to trust. Their source is public and reviewed by people who have no stake in us.
One file, start to finish
It arrives
The file travels over an encrypted connection straight to a processing node. It is not parked on a CDN, an edge cache or any third-party service on the way.
It is converted
A sandbox spins up, the engine for that format does the work, and nothing else on the platform can see inside while it runs.
You collect it
The result is offered back to the session that sent the original, and to nothing else. No link is generated that could be forwarded or guessed.
Both copies go
The upload is erased as the job closes and the output is purged inside the hour. After that the conversion exists only on your own machine.
What people ask us about this
Can your staff open my file?
There is no interface that would let them. User content lives in a sandbox that is destroyed when the job ends, and no admin tool points at the processing volume. It is not a policy we ask you to take on faith so much as a screen that does not exist.
How long does anything survive?
The upload dies with the job. The result is purged within the hour. Those two windows are the whole retention story — there is no cold storage behind them.
Does my file go anywhere else?
No. Conversions run on our own machines. Files are not posted to external APIs, partner services or analytics platforms, and they are not sold or disclosed to anyone.
Is my content used to train models?
No. A file is read by the encoder that converts it and by nothing else. There is no indexing step, no dataset and no machine-learning pipeline attached to user uploads.
What would a breach expose?
Very little, because there is almost nothing at rest. An attacker would find the handful of jobs running at that moment rather than a store of past uploads, which is the main reason we keep the retention window as short as we do.
What do you hold on account holders?
A plan needs an email address, and the payment itself is handled by our payment provider. That billing record is kept separately and is never joined to the files a conversion touched.
Something here unclear?
Ask and we will answer specifically rather than in marketing language. The formal wording lives in the policy and the terms.