Draft. This text is waiting for a lawyer to read it and is not legal advice.
What this converter records, and for how long
Who is responsible
[legal entity name and address — to be completed] runs this website and the converter on it, and decides what happens to the data described below. A company registration number belongs here too and will be filled in once the entity is registered.
What we collect
- Account identity and email address — only if you sign in. Sign-in is a
Google popup handled by Firebase Authentication. We receive the account identifier and the email address on the Google account you pick, never your password. Signing in is needed only to download files; converting an image and studying the preview does not require it.
- Language preference. Which of the site's languages you chose.
- Usage events. A short, fixed list: an upload started, a conversion
finished or failed, a preview shown, a download clicked, a sign-in prompted or completed, a language switched. Each one carries the page it happened on, the interface language and the chosen conversion settings — never the picture itself.
- A measurement record for each conversion, written on the server.
One line of numbers: how long it took and how long each stage took, the pixel count of the image, the colours and formats you asked for, how many shapes came out, and the outcome (finished, too complex, timed out). Inside that line there is no IP address, no file name, not the image itself and nothing that identifies your account — not even a hashed form of the address. The line does carry a job number, and until the job record is deleted that number can be joined to things that do identify you: your account if you are signed in, the anonymous identifier in your browser if you are not, and the file name you gave. So the record is pseudonymous rather than anonymous; once the job record is gone the link is broken and only numbers remain. Measurement records are deleted automatically after 30 days.
- The IP address of the request. It is the key of an hourly counter that
enforces the rate limit: 10 conversions per hour when you are not signed in, 60 per hour and 300 per day once you are. It is not joined to your account and is not used to profile you or to target advertising.
Your images and the files we produce
The image you upload is written to a temporary working directory on the server. That directory is deleted as soon as the request ends — on success, on error and on timeout alike.
The vector files and the 800-pixel preview are placed in Google Cloud Storage so your browser can fetch them. Objects there are removed by an automatic 1-day lifecycle rule. Download links are signed URLs that expire after 1 hour, so a link normally stops working well before the object itself is swept.
Alongside them sits a small job record — the name you gave the file, the formats produced and their sizes — so the download endpoint can tell which file belongs to which conversion. It is stamped with an expiry just past the lifetime of the link it describes.
Your images are not published, not shown to anyone else and not used as training data: the converter is a geometric tracer, not a learned model.
Legal basis
- GDPR Article 6(1)(b), performance of a contract. Converting your image,
keeping the result long enough for you to fetch it, and the sign-in that gates the download are the service you asked for.
- GDPR Article 6(1)(f), legitimate interests. The rate-limit counters and
the IP address behind them exist to prevent abuse and to keep a free service affordable to run. Product measurement rests on the same ground; it is numbers, joined to you only through the short-lived job record.
Processors
- Google Cloud. Cloud Run runs the converter, Cloud Storage holds the
output files for their lifecycle day, Firestore holds the quota counters and job records, and Firebase Authentication holds your account. The service and its bucket are deployed in the europe-west1 region.
- Cloudflare. Delivers the website's pages and shields them from abusive
traffic. It sits in front of the site, not in front of the conversion service, which your browser calls directly.
- Plausible Analytics. Cookieless analytics, configured but not switched
on: the analytics domain in our configuration is empty today, so this page serves no analytics script at all. Once it is filled in, Plausible counts page views and the events listed above without cookies and without an identifier that follows you between sites.
International transfers
Conversion and file storage happen inside the European Union. Firebase Authentication, and analytics if it is switched on, may involve processing outside the EEA; those transfers rely on the standard contractual clauses in each provider's data processing terms.
Cookies and browser storage
There are no advertising cookies and no third-party tracking cookies here, so there is no consent banner to click away. What the site does keep is strictly functional and lives in your own browser: the language you picked, the light or dark theme, and — if you signed in — the session Firebase Authentication maintains for you. Clearing this site's storage in your browser removes all three.
How long each thing lives
- Working directory on the server: the length of one request.
- Vector files and preview in cloud storage: until the automatic 1-day rule
sweeps them.
- Download links: 1 hour.
- Job record: an expiry set just past the link it describes.
- Conversion measurement records: 30 days (how long they stay linkable
to you is bounded by the life of the job record).
- Rate-limit counters: the hour or the day they count.
- Your account: until you delete it or ask us to.
Your rights
Under the GDPR you may ask for a copy of your data, ask for it to be corrected or erased, ask us to restrict or stop a particular use, object to processing we base on legitimate interests, and receive your data in a portable form. Because nearly everything here is short-lived, an erasure request in practice comes down to your account and any usage events still attached to it. You may also complain to your national data protection authority.
Changes and contact
If this policy changes in a way that affects you, the date at the foot of this page changes with it. For any request above, or any question about what is written here, write to [email protected]. Security reports go to [email protected].
Questions
Do you keep the images I upload?
No longer than the work they are part of. The working directory on the server is deleted the moment the request ends — on success, on error and on timeout alike — and the vector files and preview in cloud storage are removed by an automatic 1-day lifecycle rule. The download link itself expires after 1 hour.
Do I have to sign in to use the converter?
Only to download. You can upload an image, convert it and study the 800-pixel preview without signing in; the download endpoint always checks a valid Google session, which is also what attaches the higher quota to you rather than to an address.
Is there a cookie banner?
No, because there is nothing to consent to. This site sets no advertising and no cross-site tracking cookies; the language, the theme and the sign-in session are functional, and they live in your browser's own storage rather than on our servers.
Is analytics running on this page?
Not today. Plausible is the cookieless analytics we have configured, but the analytics domain in our configuration is empty, so the page serves no analytics script at all. When that value is filled in, Plausible counts page views and the product events listed above, without cookies and without a cross-site identifier.
Are my pictures used to train anything?
They are not. The converter is a geometric tracer — colour segmentation, an explicit anti-aliasing model and curve fitting — rather than a learned model, so there is no training set for your picture to end up in.
How do I get my account and my data deleted?
Write to [email protected] from the address you signed in with. We remove the Firebase Authentication record and any usage events still attached to it; the converted files will already have gone with the 1-day rule.