Your memories stay yours.
Local by default
In this development build, selected images are processed in your browser or on your iOS device. Photos stay local unless you explicitly choose Save cloud copy. Cloudflare R2 stores that private export for up to 24 hours; download links last 5 minutes. Original image bytes are not stored in project history. No analytics or advertising trackers are installed.
Daily network allowance
Signed-in app and website conversions share 10 successful conversions per account per UTC day. Active, verified production App Store subscriptions are recognized on the website. Guest browser exports use 10 free successful exports per network per UTC day. Cloudflare receives your IP address for the guest allowance. The application stores a daily HMAC-derived network identifier rather than a raw IP. IPv6 addresses share a /64 allowance. Allowance counters expire shortly after the day ends. Guest conversion records store operation, input/output formats and sizes, timing, status and request IDs for 30 days. New accounts start in the Free tier with the same 10-per-day account allowance. File contents and original filenames are excluded from server conversion metadata. People sharing Wi-Fi share the allowance; changing networks can change it. Clearing browser storage does not reset it. Editing works offline, but exporting requires an online allowance check.
What stays on your device
Theme and export preferences use local storage. Export records use IndexedDB and include file name, dimensions, sizes, format and processing date. You can export or clear history in Settings. Downloaded files remain under your control.
Metadata and sharing
Browser exports remove source embedded EXIF, GPS, capture date and ICC metadata. Review this before export. Downloading a new file creates filesystem dates that are separate from embedded dates and Apple Photos dates.
Company API and request records
Company API uploads are processed on Cloudflare and stored privately in R2. API access expires after 24 hours. Stored company API uploads and outputs are automatically deleted after expiry by scheduled cleanup, with an R2 one-day expiration rule as a safeguard; deletion is asynchronous. Downloaded copies are unaffected. Company membership, hashed API keys, job status and billing usage are stored in D1. Every API call records request ID, company and key identifiers when authenticated, endpoint template, status, timing, byte counts and billable usage. Request records include a daily HMAC-derived network identifier and are retained for 30 days. Passwords, raw API keys, signed URLs, request bodies and file contents are excluded from these logs. Billing usage and Stripe event identifiers are retained for 13 months. Stripe handles checkout and recurring payments; FileMutate Pro stores customer and subscription identifiers and status, not card numbers.
iOS accounts and conversion records
The iOS app requires an account and includes 10 free conversions per UTC day. Local files, previews and recent activity remain on the device. FileMutate Pro iOS privacy and terms are hosted at hushymaily.com/convertastic/privacy/ and hushymaily.com/convertastic/terms/. Email sign-in and Apple identity, when configured, are stored with your account. Each conversion records its user and registered device, input/output formats and sizes, timing, result and app/OS versions in Cloudflare D1. We use an app-specific random installation identifier stored in Keychain; the server stores its keyed hash rather than the raw identifier. No advertising identifier is collected. Conversion and device records are retained until account deletion. Request metadata follows the 30-day policy above. File contents are processed on your device, including media conversion. Apple handles iOS subscription payments. Apple refresh tokens are encrypted and revoked when deleting an Apple-linked account. You can export account data or delete the account in Profile; cancel Apple subscriptions separately in Apple subscription settings.
Accounts and future services
Accounts store name, email, a salted and server-peppered password hash, selected Pro or Premium Pro plan, and terms/privacy acceptance in Cloudflare D1. Marketing consent is optional. Email verification uses Resend. App subscriptions, conversion metadata and marketing preferences are shared with your signed-in website account. File contents and local file history remain on their original device unless explicitly uploaded. Password recovery, direct website consumer subscription checkout, support submission and cloud AI are not configured. Company API subscriptions use Stripe when configured. Account data is retained until you delete the account. You can export or delete your account from the profile page. Cloudflare backups may retain deleted records until their provider retention period ends. A deployed service must identify its legal operator, contact details, retention periods, processors and applicable user rights before collecting personal data. This document is a development disclosure, pending legal review.