Privacy Policy

1. Information We Collect

Account Information (via Clerk)

• Email address, name, and profile picture from your chosen authentication provider (Google, GitHub, Email/OTP)
• User ID and session tokens for authentication
• We do not receive or store your passwords

Usage & Technical Data

• IP address (hashed for analytics, stored for abuse prevention)
• Browser type, OS, device type, country (via Vercel Analytics)
• Tools used, conversion categories, timestamps
• Error logs and performance metrics

Files & Content

• Files are never permanently stored. Uploaded files are processed in memory and deleted immediately after conversion or when the session ends.
• For client-side tools (audio, video, archives, checksums, metadata), processing happens entirely in your browser — files never leave your device.
• For server-side conversions (images, PDFs, YouTube/Spotify/TikTok/Instagram downloads), files are streamed through our servers and deleted after the download completes.
• We do not access, scan, or analyze file contents beyond what's required for the requested conversion.

Local Storage (Browser)

• Theme preference (dark mode)
• Feedback cooldown timestamp (30s)
• Last seen update notification ID (to avoid repeat prompts)
• Dismissed announcement banner state

2. How We Use Your Information

• Provide Services: Authenticate you, process conversions, generate download links, maintain history (if logged in).
• Prevent Abuse: Rate limiting, IP banning for malicious activity, spam detection on feedback forms.
• Improve Product: Anonymous analytics on tool popularity, error rates, performance.
• Communicate: Respond to feedback, notify about updates (opt-in via notification toast).
• Legal Compliance: Respond to valid legal requests, enforce Terms of Service.

3. Third-Party Services

We integrate with the following processors. Their privacy policies apply to data they receive:

• Clerk: Authentication & user management. Privacy Policy
• Vercel Analytics: Anonymous page views, device/country aggregates. Privacy Policy
• CloudConvert: Server-side file conversions (images, PDFs, archives). Files sent to their API. Privacy Policy
• RapidAPI (YouTube MP4/MP3): Download link resolution for YouTube. Privacy Policy
• YouTube/Spotify/TikTok/Instagram APIs: Public metadata only (titles, thumbnails, public URLs). No private user data accessed.
• MySQL Database (managed): Stores user roles, settings, tool configs, conversion history (if logged in), feedback, IP bans.

4. Data Retention

• Conversion History: Kept while your account exists. Deleted on account deletion.
• Feedback: Retained for 1 year for product improvement.
• Logs (errors, access): 30 days, then auto-purged.
• Banned IPs: Until manually removed by admin.
• Local Storage: Until you clear browser data.

5. Your Rights

• Access/Export: Logged-in users can view conversion history in History.
• Deletion: Delete your account via Clerk dashboard or contact us to remove all associated data.
• Opt-out: Disable Vercel Analytics via browser Do Not Track or Vercel opt-out.
• Local Data: Clear browser storage to remove theme/notification preferences.

6. File Security Details

Konvexa is designed with privacy-first architecture:

• Client-Side Processing: Audio conversion, video→GIF, archive extraction, checksums, metadata viewing — all run via WebAssembly (FFmpeg, libarchive, JSZip) in your browser. Zero server upload.
• Server-Side Streaming: Image/PDF conversions and media downloads stream through our backend to CloudConvert or direct CDN. Files are held in memory only for the duration of the request.
• No Persistent Storage: We do not have a file storage bucket. Temporary files are cleaned up automatically by the OS/runtime after each request.
• No Content Inspection: We do not scan files for copyright, content type beyond MIME detection, or any other purpose.

7. Children's Privacy

Our services are not directed to children under 13 (or 16 in EU/UK). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us for immediate deletion.

8. International Transfers

Our servers are hosted in the United States (Vercel/US-East). Third-party processors (Clerk, CloudConvert, RapidAPI) may process data in the US or EU. By using Konvexa, you consent to this transfer. We rely on standard contractual clauses and processor adequacy decisions where applicable.

9. Changes to This Policy

We may update this policy. Material changes will be announced via the in-app notification toast and the Updates page. Continued use constitutes acceptance.