Privacy Policy
This Privacy Policy explains what information File Convert Online (“we”, “us”) collects when you use the file-convert.online website and related services, how we use it, and the choices you have. By using the service you agree to the practices described below.
1. Information we collect
- Files you upload for conversion. Files are processed only to perform the conversion you request. Uploaded files and their converted outputs are automatically deleted within one hour of upload.
- Account information. If you create an account, we store your email address, a hashed password (or your third-party sign-in identifier when you use Google sign-in), and any plan-related metadata.
- Usage data. A randomly generated, anonymous identifier is stored in your browser’s local storage so we can enforce per-device conversion limits without requiring registration.
- Technical data. Standard server logs (IP address, user agent, request paths, timestamps) and cookies set by the analytics and advertising providers listed below.
2. How we use your information
- To perform the conversions you request and deliver results to you.
- To operate, secure, and improve the service.
- To enforce usage limits and prevent abuse.
- To process payments for paid plans (handled by our payment processor).
- To measure traffic and the performance of features.
- To serve advertising that supports the free service.
3. Cookies and tracking technologies
We and our third-party providers use cookies, browser local storage, and similar technologies for the purposes described below. You can manage cookies through your browser settings and withdraw or change your consent for non-essential categories at any time using the Cookie Preferences link in the footer. Disabling strictly necessary cookies may prevent parts of the service from working.
3.1 Strictly necessary (no consent required)
Set so the service can function: keep you logged in, remember your language, scope your free-tier credits, and remember your consent choice itself.
| Name | Type | Purpose | Duration |
|---|---|---|---|
token | Cookie + localStorage | Authentication access token. Keeps you signed in. | Session / until logout |
refreshToken | Cookie + localStorage | Authentication refresh token. Renews your session without re-login. | Session / until logout |
email | Cookie + localStorage | Your sign-in email for session continuity. | Session / until logout |
userData | Cookie + localStorage | Your account profile (user ID, email) for the logged-in UI. | Session / until logout |
NEXT_LOCALE | Cookie | Your selected interface language. | 1 year |
fc_region | Cookie | EEA / OPTIN / OPTOUT / OTHER classification — decides which consent UI to show. Never stores your exact country. | 30 days |
fc_session_id | localStorage | Anonymous browser session UUID for free-tier credit metering. | Until cleared |
fc_subject_uid | localStorage | Backend usage-service subject identifier (cached to avoid re-bootstrap on every load). | Until cleared |
fc_cookie_consent | localStorage | Your accept / reject decision for non-essential cookies. | Until cleared |
3.2 Functional (no consent required)
Improve the experience without identifying you across sites.
| Name | Type | Purpose | Duration |
|---|---|---|---|
googleOneTapDismissed | localStorage | Remembers when you dismissed the Google One Tap prompt so we don’t show it again immediately. | Until cleared |
intendedPlan | localStorage | Pricing plan you selected before signing in, so checkout resumes the right plan. | Until cleared / used |
uploadedFileData | localStorage | Metadata for the file you just uploaded so the conversion UI can resume after navigation. | Until cleared / converted |
registrationSuccess | localStorage | One-time flash message after sign-up. | Cleared on next page load |
3.3 Analytics (consent required)
Help us understand how the service is used in aggregate. Set only after you accept analytics cookies, and only when the corresponding tracker is configured in our environment.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4 | Distinguishes unique visitors for aggregate analytics. | 2 years |
_gid | Google Analytics | Distinguishes unique sessions. | 24 hours |
_gat | Google Analytics | Throttles request rate. | 1 minute |
_clck | Microsoft Clarity | Persists the Clarity user ID across sessions for behavior analytics and session replay. | 1 year |
_clsk | Microsoft Clarity | Links page views into a single Clarity session. | 24 hours |
MR, SM, MUID | Microsoft | Used by Clarity for browser identification. | Up to 1 year |
3.4 Advertising (consent required)
Used to serve ads, measure ad performance, and (where you allow it) personalize what you see. Set only after you accept advertising cookies, and only when AdSense / Meta Pixel are configured in our environment.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
__gads, __gpi | Google AdSense | Ad selection and frequency capping. | 13 months |
IDE, NID | Google (DoubleClick) | Cross-site ad measurement and personalization. | Up to 13 months |
_fbp | Meta (Facebook Pixel) | Browser-level identifier for ad attribution. | 90 days |
_fbc | Meta | Click identifier when you arrive from a Facebook ad. | 90 days |
euconsent-v2 | Google Funding Choices (IAB TCF v2.2) | Encoded TCF Transparency & Consent String shown to ad partners. Set only in EEA/UK/CH. | 13 months |
3.5 Payment (only during checkout)
Set by Stripe in the embedded checkout flow. Required for fraud prevention on paid plans; not present unless you visit the checkout page.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
__stripe_mid | Stripe | Browser-level identifier for fraud detection. | 1 year |
__stripe_sid | Stripe | Per-checkout session identifier. | 30 minutes |
We do not knowingly sell personal information. If you opt out of advertising via the consent banner, Cookie Preferences, or the Global Privacy Control browser signal, the categories 3.3 and 3.4 above are not set. Strictly necessary and functional cookies (3.1, 3.2) remain because the service cannot function without them.
4. Third-party services
We rely on the following providers, each of which has its own privacy policy:
- Google AdSense — serves ads on the site. See section 5 below.
- Google Analytics — measures aggregated site traffic and usage patterns. Google Privacy Policy.
- Google Tag Manager — loads and manages the tags above.
- Microsoft Clarity — captures session recordings and heatmaps to help us improve the user experience. Microsoft Privacy Statement.
- Facebook Pixel (when enabled) — measures the performance of social ad campaigns. Meta Privacy Policy.
- Google Sign-In — used when you choose to sign in with Google.
5. Advertising and Google AdSense
We use Google AdSense to display advertisements. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.
You may opt out of personalized advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor’s use of cookies for personalized advertising by visiting www.aboutads.info. For users in the EEA, UK, and Switzerland, we present a consent banner that lets you accept or reject the use of cookies for personalized advertising before any non-essential cookies are set.
6. Legal bases for processing (EEA/UK)
Where the GDPR applies, we rely on the following legal bases: performance of a contract (to provide the conversion service and paid plans), our legitimate interests (to keep the service secure and improve it), your consent (for non-essential cookies and personalized advertising), and compliance with legal obligations.
7. Data retention
Uploaded files and conversion outputs are deleted within one hour. Account information is retained while your account is active and for a reasonable period afterwards to comply with legal obligations. Aggregated analytics data is retained for the period configured in each provider’s dashboard.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to withdraw consent. To exercise these rights contact us at [email protected]. You can also change your cookie choices at any time using the Cookie Preferences link in the footer.
9. California Privacy Rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights:
- Right to know what personal information we collect, use, share, or sell.
- Right to delete personal information collected from you.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising.
- Right to limit the use of sensitive personal information.
- Right to non-discrimination for exercising any of these rights.
To opt out of the sale or sharing of your personal information for advertising, click Cookie Preferences in the footer and choose Do not sell or share. We also honor the Global Privacy Control (GPC) signal automatically: if your browser sends GPC, we treat it as a valid opt-out request without requiring further action. To exercise other rights, email [email protected]. We will verify your request before responding. You may also authorize an agent to act on your behalf.
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Indiana, Kentucky, and Nebraska have similar rights under their respective state privacy laws. Exercise them through the same mechanisms above.
10. Other regional rights
Brazil (LGPD). You may request access, correction, anonymization, blocking, deletion, portability, and information about data sharing. Contact [email protected].
Canada (PIPEDA + Quebec Law 25). You may request access to and correction of your personal information, and withdraw consent at any time.
South Korea (PIPA), South Africa (POPIA), Argentina (Ley 25.326), Turkey (KVKK), Japan (APPI), Australia (Privacy Act), Singapore (PDPA). Equivalent rights to access, correct, delete, or opt out apply. Contact us using the address above to exercise them.
11. Children
The service is not directed to children under 13 (or the equivalent minimum age in the relevant jurisdiction). We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the latest version. Material changes will be communicated through the site.
13. Contact
Questions about this policy can be sent to [email protected].