Summary
- Uploaded files are used only to perform the conversion you requested.
- Source files are deleted as soon as the conversion finishes.
- Converted files are deleted automatically when their retention window ends, 168 hours after the conversion.
- We store a salted hash of your IP address, never the address itself.
- No advertising networks, no third-party analytics, no data sales, and no sharing of your data for anyone else’s marketing.
- There are no accounts. We never ask for your name, your email address or a password in order to convert a file, so there is no profile to hold and nothing to delete.
Who we are
HexaConverter is operated by an independent developer and provides the file conversion service at www.hexaconverter.com. For any privacy question, to exercise a data right, or to reach the person responsible for this policy, email info@hexaconverter.com or use the contact form. We aim to answer within 30 days.
What this policy covers
This policy applies to the HexaConverter website at www.hexaconverter.com and to the HexaConverter Android application distributed through Google Play. The Android app is a secure wrapper around the same website: it contains no advertising libraries, no analytics or crash-reporting SDKs, and no third-party trackers, so what it collects is exactly what is described below. Google Play itself collects installation and billing data under Google’s own privacy policy, which we neither control nor receive.
Device permissions the Android app uses
The app requests access to files only at the moment you pick one to convert, through the Android system file picker. It does not browse, index or read your storage in the background, and it does not request access to your contacts, camera, microphone, location or call logs.
What we process
Files you upload
The contents of the file, its name and its size are processed solely to produce the output you asked for. Files are never opened by a person, indexed, sold, shared with third parties, used for advertising, or used to train any model. Image metadata such as EXIF — including GPS coordinates — is stripped by default during conversion; you can opt out per conversion.
A file you upload may itself contain personal information, in the document text, in a photograph or in its metadata. We do not inspect that content, and it is deleted on the schedule below, but you should upload only files you are entitled to share.
Account data — none
HexaConverter has no accounts. There is no sign-up, no sign-in and no subscription, so we hold no email address, no display name, no password and no payment details. The service is free to everyone who opens it.
Technical data
For each conversion we record the source and target format, file sizes, duration, status and a salted SHA-256 hash of the requesting IP address. The hash lets us enforce rate limits and investigate abuse without retaining an identifier that points back to you. We do not collect advertising identifiers, device identifiers or precise location.
Messages you send us
If you use the contact form we store the name, email address and message you provide, so that we can reply and so we can recognise repeat abuse.
Cookies
We set one strictly necessary cookie: an opaque random identifier that lets your browser download the file it just converted. It names no person and is linked to nothing else. There are no advertising or analytics cookies. The cookie policy lists every one of them by name, purpose and lifetime.
Why we are allowed to process it
Where the GDPR or UK GDPR applies, we rely on: performance of a contract to carry out the conversion you asked for; legitimate interests for abuse prevention, security logging and service reliability; and legal obligation where retention is required by law. We do not rely on consent-based tracking, because we do not track.
Retention and deletion
| Data | Kept for |
|---|---|
| Uploaded source file | Until the conversion completes, then deleted immediately |
| Converted output file | 168 hours, or until you delete it |
| Incomplete or abandoned upload | Discarded when the upload session expires |
| Conversion record — formats, sizes, status and a hashed IP, never file contents | 30 days |
| Account data | Not applicable — there are no accounts |
| Messages sent through the contact form | Until the matter is resolved |
Deleting your data
There is no account to delete, and nothing that identifies you is stored in the first place. Your files are removed on the schedule above without you having to ask.
If you would rather not wait, the archive and PDF tools include a “delete my files” control that removes everything stored for your browser immediately. Clearing your cookies has the same practical effect: the identifier is gone, and what remains is a row of formats and timings that points to nobody.
Who else can see your data
We do not sell your data and we do not share it for advertising. Your data is handled by a small number of service providers acting on our instructions under a data processing agreement:
| Provider role | What it handles |
|---|---|
| Application hosting | Runs the service and performs the conversions |
| Object storage | Stores uploaded and converted files until deletion |
| Managed database | Stores conversion metadata, never file contents |
| Email delivery | Delivers replies to messages you send us |
We may also disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim — for example a valid court order. We will not do so voluntarily.
International transfers
Our providers may process data outside your country, including outside the EEA and the UK. Where that happens we rely on the transfer safeguards offered by those providers, such as the European Commission’s standard contractual clauses.
Your rights
You can access, correct, export or erase your data at any time, and object to or restrict processing. In practice there is very little to exercise these against, because we hold nothing that identifies you; for anything else, email info@hexaconverter.com. We will not charge you or degrade the service for exercising a right. If you are in the EEA or UK you also have the right to lodge a complaint with your supervisory authority. If you are a California resident, we do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of.
Security
Transfers use HTTPS with HSTS enforced, in the app and on the web. Uploads are identified by their magic bytes, never executed, and never served back with an executable content type. Files at rest are encrypted by the object store. Download links are signed with an HMAC bound to a single conversion and expire within minutes, so a link cannot be guessed or replayed indefinitely. Conversions run in isolated temporary directories that are removed after each job. There are no passwords to protect, because there are no accounts. See the FAQ for more detail.
No service can promise perfect security. If we discover a breach affecting your personal data we will notify you and the relevant regulator as required by law.
Children
The service is not directed at children under 16, it is not designed for or targeted at children, and we do not knowingly collect their data. If you believe a child has provided us with personal information, email info@hexaconverter.com and we will delete it.
Changes
If this policy changes materially we will update the date above. We have no mailing list to announce it on — there are no accounts — so this page is the notice. We keep it at a stable address so that it can be linked from Google Play and elsewhere.