Privacy Policy

Every image and PDF tool on ImageToAnything runs entirely inside your web browser using standard Web APIs — the HTML5 Canvas API, the WebCodecs API, and WebAssembly modules that ship with the page. When you drop a file onto a tool, the file is read from your device into your browser's memory, processed locally by JavaScript and WebAssembly, and then offered back to you as a download.

We do not upload your files to our servers. We do not stream them to a third-party API. We do not log filenames, file contents, EXIF metadata, or any derivative of your image. When you close the tab, every byte of your file is discarded from your browser's memory and cannot be recovered by us under any circumstance — we never had a copy in the first place.

You can verify this yourself in any browser. Open the Developer Tools (F12 or right-click → Inspect), switch to the Network tab, drop a file onto a tool, and watch what happens. You will see no upload request for your file — only the static assets needed to load the page itself.

ImageToAnything has no signup, no login, no paywall and no email gate. We do not collect your name, email address, phone number, postal address, billing details, IP-derived location, profession, employer or any other personally identifying information in order to deliver our service. The tools work the same whether you arrive once or every day.

The only data the website itself receives is the standard set of fields every web server receives on any request: your IP address (used only to deliver the response and aggregated for traffic analytics), the page URL, the referring URL if one was sent, and the User-Agent string identifying your browser and operating system. We do not link these to your identity.

The site is served from a global content delivery network over HTTPS only. HTTP requests are automatically redirected to HTTPS, and HSTS is enabled so that compatible browsers refuse to fall back to plain HTTP. Static assets, including the JavaScript and WebAssembly that run our tools, are served with integrity headers and cache controls that protect against tampering and stale code.

Because no user file ever reaches our servers, our infrastructure has no image storage, no upload buckets, and no per-user database. There is nothing for an attacker to exfiltrate that relates to your files, because nothing about your files exists outside your own device.

ImageToAnything uses a small number of strictly-necessary first-party items to make the site work:

• A theme preference (light or dark mode) stored in your browser's localStorage.
• Tool preferences such as your most-recent compression quality or output format, stored locally so you do not have to re-pick them on every visit.
• A cookie-consent flag recording whether you accepted or declined optional cookies, so we do not ask you again on every page load.

Optional analytics cookies are set only after you accept analytics in our own banner. Advertising consent is collected separately by Google’s certified consent message (shown to visitors in the EEA, UK and Switzerland), which may store its own consent cookie (such as FCCDCF) recording your choice. If you decline, no analytics or personalised-advertising cookies are set. You can clear all stored values at any time using your browser's site-data controls.

We use Google Analytics 4 to understand which tools and conversion formats are most useful. Google Analytics is only loaded after you accept analytics in our cookie banner. Before you choose, or if you reject analytics, the Google Analytics script is not loaded and no analytics measurement requests are sent to Google.

If you accept, Google Analytics sets its cookies (such as _ga) and records page views and tool events such as which tool was used, together with the page URL, approximate location, browser and screen size. IP addresses are anonymised. Your image files and their contents are never sent.

You can change your choice at any time using the "Cookie settings" link in the footer of every page. If you withdraw analytics consent, we stop further analytics tracking and delete the Google Analytics cookies we can access. Every tool works identically with analytics declined.

ImageToAnything does not currently show ads, but the Google AdSense script is loaded on every page so that Google’s certified consent management platform can ask visitors in the EEA, UK and Switzerland for advertising consent. Loading it lets Google receive standard request data (such as your IP address, browser and the page URL). If ads are shown in future, advertising cookies will only be used in line with the choice you make in Google’s message, and we will not run video pre-rolls, interstitials that block the page, or pop-ups. Image processing happens in your browser and is separate from analytics and any messages you send us.

When you consent to ads, our advertising partners may use cookies and similar technologies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your interests. You can:

• Opt out of personalised advertising in Google Ads Settings.
• Visit aboutads.info/choices to opt out of personalised advertising from many third-party vendors at once.
• Decline or withdraw advertising consent via Google’s consent message, which you can reopen with the “Ad privacy choices” link in the footer — Google may still serve non-personalised ads in that case, which do not rely on your browsing history.

Advertisers and ad networks never receive your image files, your conversions, your EXIF data, or any signal derived from how you use the tools. They only see the standard ad-request data the browser sends (page URL, viewport, consent state).

• We do not sell your data. There is nothing to sell — we do not have it.
• We do not train AI or machine-learning models on your images.
• We do not share your files with any third party for any reason.
• We do not embed third-party social-media trackers (Facebook Pixel, X Pixel, etc.).
• We do not fingerprint your device beyond what an ad provider may attempt with your consent.
• We do not require you to disable an ad blocker.

Because images are processed locally and we collect no personal data on our servers, most data-protection regulations apply to us in a very limited way. We still respect the rights they grant:

• Right of access: we can confirm that we hold no personal data tied to you as an individual.
• Right of erasure: already met by default — clear your browser's storage to remove every local preference we have ever set.
• Right of objection: reject analytics in our banner and decline Google’s advertising message; you can change either at any time from the footer.
• Right to opt out of sale or sharing (CCPA): we do not sell or share personal information, so there is nothing to opt out of, but a Do Not Track or Global Privacy Control signal sent by your browser is respected.

The legal basis for strictly necessary processing (delivering pages and keeping the service secure) is our legitimate interest in keeping the service functional. For analytics and advertising cookies, the legal basis is your consent, freely given via our analytics banner (analytics) or Google’s consent message (advertising), which you can withdraw at any time.

ImageToAnything is not directed at children under 13. We do not knowingly collect personal information from children. Because the tools work entirely in the browser and require no signup, no personal information about anyone — child or adult — is collected during normal use.

Parents and guardians who believe a child has somehow shared personal information through a contact-form submission should email us via the contact page and we will delete the submission immediately.

We retain no data about your files because we never receive any. Aggregated analytics records (page views by country and device class) are retained for a maximum of 26 months and then deleted. Contact-form submissions, when you choose to send one, are kept only long enough to answer your question and are then deleted.

Questions about this policy, the data we process, or your rights under applicable law: please reach out through our contact page. We respond within 30 days, usually much sooner.

If you live in the EU or UK and believe we have mishandled your data, you also have the right to complain to your national data-protection authority — for example the ICO in the UK, the CNIL in France, or the Data Protection Commission in Ireland.