Privacy Policy

Effective date: October 30, 2026

This page explains what SecureHEICtoJPEG does and does not collect. We keep it short on purpose.

The short version

SecureHEICtoJPEG is a HEIC to JPEG converter. Conversion runs entirely in your browser. Your photos are never uploaded, sent, or stored by us.

What we collect

We do not collect accounts, email addresses, names, or photo contents. We do not run ads, analytics, or tracking scripts.

To enforce the free daily limit of 10 conversions, we use a small first-party cookie and a short-lived counter (details below). We also keep anonymous daily totals of conversions (no personal data) so we can understand free-tier usage.

If you pay for unlimited conversions, we store your Stripe customer and subscription IDs and receipt email with your sid so unlimited access stays on. We delete that data on request.

Cookies

When you convert a file, our server may set a first-party cookie named sid:

A random ID (not tied to your name or email)
HttpOnly, Secure, SameSite=Lax
Lifetime: 1 year

Under that ID in Cloudflare KV we may store:

The date, a conversion count, and a last-conversion timestamp (free daily limit; auto-expires after about 2 days)
For paid subscribers: Stripe customer ID, subscription ID, and receipt email (kept so unlimited access works; deleted on request)

We do not store file names, file contents, file sizes, or IP addresses in that counter. Clearing your cookies resets the free count and turns off unlimited on that browser until you reopen your thank-you link or contact us.

Third parties

Cloudflare — The site is hosted on Cloudflare (a Worker with static assets). As the host, Cloudflare processes standard request data such as IP addresses for security and delivery, under Cloudflare's privacy policy.
jsDelivr — The open-source heic2any library is loaded from cdn.jsdelivr.net. jsDelivr receives a normal request for that script, the same way any CDN does.
Stripe — A paid plan ($10 a month for unlimited conversions) is available now through Stripe. Payments are processed by Stripe. We do not see or store card numbers. See Stripe's privacy policy.

Retention

Conversion counters in Cloudflare KV expire after about 2 days. Paid-subscriber records stay until you cancel and access ends, or you ask us to delete them. The sid cookie can last up to 1 year unless you clear it. We do not keep photo files at all.

Children

This service is not directed at children under 13. We do not knowingly collect personal information from children under 13.

Your rights and choices

Clear your browser cookies to remove the sid cookie and reset the free daily count.
You can stop using the site at any time.
Because we do not keep accounts or photo files, there is usually nothing further for us to delete on request. If you have a question, contact us below.

Changes

We may update this Privacy Policy from time to time. The effective date at the top will change when we do. Continued use of the site after a change means you accept the updated policy.

Contact

Questions about privacy? Email iaimtopleaseyou@gmail.com.

Site operated by SecureHEICtoJPEG.com.