Privacy Policy

Last updated: October 7, 2026

1. Your data at a glance

This table lists everything we process. Each row is explained in detail further down.

2. Who is responsible for your data

The data controller is BDK Media Daniel Bihun, a sole proprietorship based in Poland, which runs heicjpg.online. For any question about this policy or your data, write to contact@heicjpg.online or use the form on our Contact page. We have not appointed a data protection officer, because our activity does not require one: we do not process data on a large scale or any special categories of data.

3. The photos you upload

When you choose a HEIC, HEIF or HIF photo, the file is sent to our server over an encrypted HTTPS connection and converted there by our own software. We do not send it to outside conversion services. In detail:

• The converted file is saved under a random 32 character name, which also works as its download link. Without the exact link the file cannot be found: the folder cannot be browsed and the names cannot be guessed or enumerated.
• Converted files are stored for a maximum of 30 days and then deleted automatically, with no action needed from you. If disk space runs low, the oldest files may be deleted earlier.
• Your photos are processed automatically by software. No human looks at them, and they are never shared, sold, published or used to train machine learning models.
• The converted JPG keeps the EXIF metadata of your original photo (capture date, phone model, camera settings and GPS location, if your phone recorded it). This is deliberate, because many people use the converter to archive photos without losing the date. If you plan to post or send the file, check first whether it contains your location: on an iPhone you can switch it off when sharing, under "Options".

The content of a photo can itself be personal data (a face, a number plate, a place). We process it only to carry out the conversion you asked for and do not analyse it in any other way.

4. IP address and technical data

4.1 Usage limits

The converter is free, but it has to stay available for everyone. That is why we count how many conversions come from the same address per day and in 10 minute windows. We do not store the IP address: we store a keyed cryptographic hash (SHA 256) from which the address cannot be recovered. Daily counters are deleted within 48 hours, short term ones after 30 minutes.

4.2 Technical conversion log

For each conversion we note the time, the random code of the file and a 12 character pseudonymous fingerprint, computed with a secret key from your IP address and browser type. It lets us recognise files converted in the same session as one group. The fingerprint does not contain your IP address and does not tell us who you are. Entries for files that have already been deleted are removed periodically.

4.3 Server logs

Like almost every website, our hosting infrastructure records standard technical access logs (page requested, date and time, browser type, IP address). These logs are managed by the hosting provider, are used for security and troubleshooting, are never used for marketing or profiling, and are overwritten automatically on rotation.

5. Contact form and email

If you write to us through the contact form, we receive the name you enter, your email address, the text of your message and the page you wrote from. The message arrives in our contact@heicjpg.online inbox and we keep a copy on the server, outside the public folders, so it does not get lost. The same applies if you email us directly.

We use this data only to reply to you and to follow up on your request. We do not add you to any newsletter and do not use your address for anything else. To block spam, the form accepts at most 5 messages per hour from the same address, which here too is recognised only through a hash that is deleted within 2 hours. You can ask us at any time to delete the conversation.

6. Star ratings

After a conversion we ask whether you want to rate the service from 1 to 5 stars. This is optional. Your vote goes into an anonymous average: we store only the total number of votes and their sum, not who voted. To prevent repeated votes we keep a hash of the IP address for one day only, and it is deleted the next day. In your browser we save a flag (hjRated) so we do not ask you again.

7. Advertising and consent

The converter is free and has no paid version. To cover server costs, the site may show ads provided by Google AdSense. For users in the European Economic Area the provider is Google Ireland Limited.

On your first visit a banner appears with two buttons of equal weight, "Accept all" and "Reject all". Until you choose, ads stay paused and Google receives the signal that consent is denied (Google Consent Mode v2).

• If you accept, Google and its partners may use cookies and similar identifiers to show ads based on your interests and on previous visits to this and other websites, and to measure how the ads perform.
• If you reject, we ask Google for non personalised ads only and do not allow advertising cookies. Google may still process limited data, for example to fight fraud and count impressions in aggregate, under its own rules.

You can change your mind at any time with the "Cookie settings" button at the bottom of every page. Our site receives no personal data from Google: we only see aggregate figures on impressions and earnings. To learn how Google uses data collected on partner sites, see How Google uses information from sites that use its services. You can also manage ad personalisation in Google My Ad Center and, for other ad vendors, at aboutads.info or Your Online Choices. The list of cookies is in our Cookie Policy.

8. Visitor statistics

We want to know how many people use the converter and which guides help them, not who you are. For that we use:

• Ahrefs Web Analytics, a cookieless statistics tool. It shows us aggregate numbers (page views, referring sites, country, device type). It sets no cookies, builds no profile and does not follow you across other websites.
• Google Search Console, which shows us how the site appears in Google Search (queries, impressions, clicks). This data comes from Google's search results and involves no data collection on our site.

9. What we store in your browser

The site sets no cookies of its own. It uses the browser's local storage (localStorage) for just two items, which stay on your device and are not sent to us:

Google advertising cookies are set only if you accept and only when an ad actually loads. You can delete everything in your browser settings, under site data.

10. Service providers and transfers

We rely on a small number of providers to run the site:

• Hostinger, our hosting provider, which stores the files, keeps the server logs and delivers email. It acts as a processor on our behalf.
• Google (AdSense and Search Console). Some data may be transferred to the United States: Google participates in the EU US Data Privacy Framework and uses the standard contractual clauses approved by the European Commission.
• Ahrefs (cookieless statistics, described above), which gives us aggregate data only.

We do not sell or hand over data to data brokers. We do not embed social media widgets or external fonts: the YouTube and Facebook links in the footer are plain links and load nothing until you open them.

11. Legal bases

For visitors in the European Economic Area and the United Kingdom we process data under the General Data Protection Regulation (GDPR, or UK GDPR) and, for anything stored on your device, under the ePrivacy rules on cookies:

• Performing your request (Art. 6(1)(b) GDPR): converting your photos, providing the downloads, replying to messages.
• Legitimate interest (Art. 6(1)(f) GDPR): protection against abuse, security logs, aggregate statistics, the optional rating. We chose the least intrusive measures available (hashes instead of IP addresses, cookieless statistics). You can object by writing to us.
• Consent (Art. 6(1)(a) GDPR): advertising cookies and personalised ads. You can withdraw it at any time in "Cookie settings", with no effect on your use of the converter.

We do not make automated decisions that have legal effects on you.

12. Your rights and how to use them

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interest and to withdraw any consent you gave. To use these rights, write to contact@heicjpg.online: we reply within one month, as the GDPR requires, and usually much sooner.

In practice the most useful right here is early deletion: if you want a converted file gone before the 30 days are up, send us its download link and we will delete it. Since you have no account, the link is the only way to show us the file is yours.

If you believe we are breaking data protection law, you can complain to the supervisory authority where you live, for example the Information Commissioner's Office in the UK or the Data Protection Commission in Ireland, or to the Polish authority, the President of the Personal Data Protection Office (UODO), which is responsible for our place of business.

13. Visitors outside the EU

The consent banner is shown to every visitor, wherever they are. For residents of California and other US states with privacy laws: we do not sell personal information for money. If you accept personalised advertising, Google may use online identifiers to show you ads based on your interests, which some state laws treat as "sharing". To avoid it, simply choose "Reject all" or change your choice in "Cookie settings". We do not process sensitive personal information.

14. Children

The converter needs no registration and is not aimed at children. It is not directed to children under 13, and in the EU your country may set the age at which you can give consent online yourself between 13 and 16; below that age the choice in the banner belongs to a parent. We do not knowingly collect data from children; the only thing a child could send us is a photo, which is deleted automatically within 30 days. If a parent tells us about a file, we delete it straight away.

15. Security

All traffic to and from the site is encrypted with HTTPS. Converted files have random names, do not appear in any listing and their folder cannot be browsed. Technical data (counters, the conversion log, messages) is stored outside the site's public folders. The server's security headers restrict which scripts the browser may load. No system is 100% secure, but we keep the attack surface small: no accounts, no passwords, no payment data.

16. Changes to this policy

When the way the site works changes, we update this page and the date at the top. With the update of October 7, 2026 we added the sections on advertising and consent, the contact form, star ratings, the technical conversion log and browser storage, and named the supervisory authorities you can turn to.

Questions, deletion requests or anything else: contact@heicjpg.online or our Contact page. You can read about the team behind the site on our About page.