Privacy & Cookie Policy

1. The short version

Your images and files are never uploaded. The converter and the viewer both run inside your own browser, using WebAssembly. The files you open here stay on your device. They are not sent to us, and there is nowhere on this site that could receive them.

There is no sign-up, no account, no contact form and no newsletter. We hold no database about you.

One thing on this site can identify you: Google's advertising system, which is what pays for the site. Section 6 explains exactly what it does, and section 8 explains the consent message you are shown in the EEA, the UK and Switzerland, and how to say no from it. There is also anonymous audience measurement, which sets no cookie and no identifier — section 5.

2. Who is responsible for your data

This website (JXL Convert, jpegxlconvert.com) is run by one private individual, in a personal capacity. There is no company behind it, and none is involved in it.

Data controller: that same private individual. The way to reach them, for anything in this policy and to exercise the rights in section 12, is contact@jpegxlconvert.com. It is the same address in all five language versions.

There is no Data Protection Officer, because none of the situations listed in Article 37 GDPR applies here.

3. How the converter works, and why we never receive your files

This is the part that makes everything else in this policy true, so here is the mechanism in plain words.

• When you pick a file, your browser reads it straight off your own disk using the File API. Nothing is sent anywhere at that point.
• The decoding and re-encoding is done by libjxl and libheif, compiled to WebAssembly. Those codecs are served from this same domain (/assets/vendor/) and then run in your computer's memory.
• The converted image is handed back to you as a local download, from a blob your browser creates. It never travels.

There is no upload endpoint anywhere on this site. The direct consequence is that your files cannot appear in the hosting logs, because they never leave your machine to begin with.

You do not have to take our word for it. Two things you can check yourself:

• Open the Network tab of your browser's developer tools and convert a file. You will see the codec being loaded from this domain, and no request carrying your image.
• Convert one image, then disconnect from the internet and convert another. It still works: the codecs are already in your browser's cache and no further request is made. On a first visit the codec itself does have to be downloaded from this domain first, which is why the order matters — that download is the only thing on this page that needs the network.

The two files that drive the converter and the viewer (assets/js/app.js and assets/js/viewer.js) contain not one network call: no fetch, no XMLHttpRequest, no WebSocket, no sendBeacon.

4. What we do not process

• The images and files you convert or view. Their content never reaches us.
• Their metadata and EXIF data. The tool reads the EXIF orientation locally so it does not rotate your photo the wrong way, and that is where it ends: nothing is sent anywhere.
• Account data. There is no sign-up, no login and no password.
• Your name, address or phone number.
• Payment data. The tool is free.
• There is no contact form and no newsletter.
• This site sets no cookies of its own. The only thing that can be stored under this domain is the record of your own answer to the consent message, and that is written by Google's consent platform, not by our code — section 8.

5. What is processed, why, and on what legal basis

This is the complete list of what is processed.

About that third row. It is the whole of the measurement on this site: no heat maps, no session recording, no A/B testing, no Google Analytics, no counter of our own. It works without cookies and without any identifier on your device, and the controller only ever sees aggregate charts — page views, top pages, countries — never anything that points at one visitor.

The server's access log, in the first row, is not used to count visitors either. It is there to deliver the pages, keep the site running and stop abuse.

6. Advertising: Google AdSense

This site is free and is paid for by advertising. It uses Google AdSense, publisher ID ca-pub-9791902883190551. The AdSense script is loaded on every content page of the site, including this one; the only page without it is the 404 error page.

What Google requires us to tell you, in Google's own words:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites.
• Google's use of advertising cookies enables Google and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.

How to turn off personalised ads. If you are in the EEA, the UK or Switzerland, the shortest route is the consent message described in section 8: refuse there, and no personalised advertising is served to you. You can revisit that answer whenever you like, from the Privacy settings link in the footer of every page. Wherever you are in the world, you can also switch ad personalisation off for your Google account or browser at My Ad Center; Google still points to the older Google Ads Settings page as well, which works too.

Be aware: turning personalisation off does not remove the ads. You will still see ads, they will just be non-personalised — chosen from the page content and rough location rather than from a profile. Non-personalised ads still need a cookie or similar identifier, to cap how often you see the same ad and to detect fraud.

Where to read what Google actually does with the data:

• How Google uses information from sites or apps that use our services. This is the page Google itself offers as the explanation of its own data use on sites like this one. That document forms part of this policy.
• Google Privacy Policy
• How Google uses cookies in advertising
• List of Google's advertising cookies

Industry-wide opt-outs, which cover many advertisers at once: Your Online Choices for the EU, and AboutAds / DAA for the United States.

Google AdSense is the only advertising network on this site. If another one is ever added, it will be named here, with a link to its own privacy policy. Google requires that too.

7. Cookies and storage on your device

The converter itself uses no cookies, no localStorage, no sessionStorage and no IndexedDB. Nothing about your session is written to your device by us. That is checkable in this site's own JavaScript.

Where consent is legally required, it is now asked for: the message described in section 8 is shown to visitors from the EEA, the UK and Switzerland, and their answer decides whether Google may personalise the advertising. Outside those countries no message appears, because the rules that require it do not apply there, and Google's advertising cookies are then governed by the law of your own country.

You can delete or block cookies at any time from your browser settings. Every major browser has a privacy or site-data section for it, and most offer a "block third-party cookies" switch, which turns the advertising cookies off and leaves the converter untouched.

We do not paste a generic list of cookie names copied from a template here. The only cookies that can appear are Google's, and Google's own page above is the authoritative list.

8. Your consent (EEA, UK and Switzerland)

If you arrive from the European Economic Area, the United Kingdom or Switzerland, this site shows you a consent message before Google may personalise the advertising. It is run by Google's own consent management platform (CMP), which is certified by Google and integrated with the IAB's Transparency and Consent Framework (TCF). Google has required a certified, TCF-integrated CMP for serving ads in the EEA and the UK since 16 January 2024, and in Switzerland since 31 July 2024: without one, traffic from those countries is not eligible for personalised ads at all.

The three options the message gives you, in its own words:

• Consent — Google and the vendors listed in the message may store and read advertising identifiers on your device and use them to personalise the ads you are shown.
• Do not consent — refusing, in one click, on the same screen. It is a button sitting beside the other one, not something buried in a submenu, so saying no costs exactly the effort of saying yes. No dark patterns.
• Manage options — the detailed second layer, where you decide purpose by purpose and vendor by vendor, see who each vendor is, and read how your choices are stored on your device.

Refusing does not take the ads away — it takes the profiling away. You still see advertising, chosen from the content of the page and a rough location instead of from a profile built about you. Non-personalised ads still need an identifier of some kind, to cap how often you see the same ad and to detect click fraud; that part does not run on your consent, and Google relies on legitimate interest for it (section 5).

Refusing does not break the converter either. The tool behaves identically with advertising refused. It has to: the conversion runs entirely in your browser and has nothing to do with the ads. Ad blockers remain expressly allowed by our Terms of Use.

What the message stores, and where. Your answer is written to your own device as a TCF consent string — either in a cookie or in your browser's local storage, whichever the consent platform uses; the TCF specification leaves that choice to it. The string is scoped to this domain: it applies here and is not shared with other websites, TCF's old global scope having been withdrawn in September 2021. What it holds is the decision plus the context needed to read it back: the TCF version, when it was created and last updated, the identity and version of the consent platform, the screen and language you were shown, your consent for each purpose, the legitimate-interest signals, your consent for each individual vendor, the restrictions set by this site, and the list of vendors that were presented to you. There is no name in it, no email address, and nothing you typed into the converter.

That record exists so your decision can be honoured and evidenced — Google's EU User Consent Policy requires naming every party that may receive your data, obtaining consent both for storage on your device and for ad personalisation, keeping a record of that consent, and giving clear instructions for taking it back — and so that you are not asked again on every page: once you have answered, the message stays away unless it is updated or consent has to be collected afresh. How long the record lasts is declared by the message itself, in the "Manage options" layer, which is where the TCF rules place that disclosure. We do not repeat a figure here that we cannot verify ourselves.

How to change your mind. The footer of every page carries a "Privacy settings" link. It clears the answer stored on your device and reopens the message with the same three options, so withdrawing is as easy as giving — which is exactly what Article 7(3) GDPR requires. Withdrawing does not make what happened before it unlawful; it stops the processing from that moment on. AdSense also adds a revocation link of its own to sites that show this message, so you may find two routes to the same screen.

Two honest details about that link. It appears once Google's consent code has confirmed that these rules apply to you; if you are browsing from outside the EEA, the UK and Switzerland there is no message to reopen, and the link stays hidden. And if it is missing where you expect it, the usual cause is an ad blocker or a privacy extension blocking Google's consent code — in which case the message it would reopen has not run either. Your browser is the fallback: clearing this site's data deletes the stored answer, and the message returns on your next visit.

Ways to say no that do not depend on the message at all, wherever you are: My Ad Center, blocking third-party cookies in your browser settings, and ad blockers.

9. Who your data is shared with

Named recipients, not vague talk of "partners":

• Google Ireland Ltd. / Google LLC — advertising (AdSense). For most of the advertising data Google acts as an independent controller under its own terms: it decides for itself what it does with that data. That is why requests about advertising data have to go to Google directly — the controller of this site cannot answer them and cannot instruct Google to.
• Contabo GmbH (Munich, Germany) — the server this site runs on, which holds the access log described in section 5. Contabo acts as a processor, on the controller's behalf and on its instructions.
• Cloudflare, Inc. — audience measurement (Cloudflare Web Analytics), the domain's DNS, and forwarding the mail sent to the contact address. In those roles Cloudflare acts as a processor, on the controller's behalf and on its instructions.

Nobody else. Nothing is sold. Nothing is handed to data brokers. There are no other transfers of any kind.

And the important one again: the files you convert are shared with no one, because they never leave your device in the first place.

10. International transfers

The server this site runs on is in Germany, inside the European Union, so the access log never leaves the EU. Google and Cloudflare, on the other hand, are global companies, so the data they handle may be processed in the United States and in other countries.

Those transfers rely on the EU–US Data Privacy Framework and/or on the Standard Contractual Clauses approved by the European Commission. Each provider sets out its own arrangements on its own page: Google and Cloudflare. Those pages are the live source. We do not restate the status of any particular adequacy decision here, because it can change.

11. How long data is kept

The controller keeps no database about you. The only thing this site's own server stores is its access log, with the IP address already shortened, and it deletes it on its own after 14 days. The other periods below are set by the providers; the criterion in every case is what each of them needs to deliver, protect or bill the service, and the controller has no way to lengthen or shorten them.

• Server access log — 14 days, with the IP address shortened before it is written. Each day's file is deleted automatically when it reaches that age.
• Audience measurement — kept by Cloudflare for the period it applies to Web Analytics. Only aggregate charts reach the controller, and nothing in them identifies a visitor.
• Advertising data — the cookies themselves expire on the schedule Google publishes: 13 months in the EEA and the UK for the longest-lived AdSense ones, per Google's cookie list. What Google keeps afterwards follows its privacy policy; AdSense gives publishers no control over it.
• Contact email — if you write to exercise a right, your message and the reply are kept for one year from the date of the reply, which is what it takes to be able to show the request was answered, and are then deleted.

12. Your rights

Under the GDPR you have the right to:

• access your data;
• have it corrected;
• have it erased;
• have its processing restricted;
• receive it in a portable format;
• object to processing, including processing based on legitimate interest;
• withdraw your consent at any time, without that affecting what was lawful before you withdrew it;
• not be subject to automated decisions with legal effects. There are none here: the controller does no profiling and makes no automated decisions about you.

How to exercise them: write to contact@jpegxlconvert.com. You will get an answer within one month.

An honest limitation (Article 11 GDPR): because we store no identifier of any kind about you, in most cases we are simply unable to connect your request to any data of yours. We have nothing to look you up with, and we will not ask you for extra identity documents just to create a link that does not exist. In that case we will point you to whoever actually holds the data:

• Google — privacy policy and rights request forms, and direct control of the advertising in My Ad Center.
• Cloudflare — privacy portal and GDPR requests.

Complaints: you can complain to the Spanish Data Protection Agency, www.aepd.es, which is the controller's supervisory authority because the controller is established in Spain. You can also complain to the authority of your own country of residence. In the United Kingdom that is the Information Commissioner's Office, ico.org.uk; for the rest of the EEA, the European Data Protection Board keeps the list of national authorities.

13. Children

This site is not aimed at children under 16 (under 14 in Spain, Article 7 LOPDGDD), and no data is knowingly collected from children. The advertising is configured as not directed to children.

If you are a parent or guardian and believe a child has provided personal data here, write to contact@jpegxlconvert.com.

14. Links to other sites

Ads lead to third-party websites, and the footer of this site links to docuniversal.com. The moment you leave jpegxlconvert.com, this policy stops applying and the policy of the site you land on takes over. We have no control over what those sites do.

15. Changes to this policy

The "last updated" date at the top of the page identifies the version in force. All five language versions carry the same date, each written in that language's own format.

Any substantial change affecting consent will reopen the consent message, so that you can decide again.

The five versions are updated together and say the same thing, except for the references specific to each country: the supervisory authority you can complain to, the local age of consent, and the national rule that mirrors the EU cookie rule. If they ever disagree on anything else, the Spanish version prevails, because the controller is established in Spain.

See also our Terms of Use.