Privacy Policy
Last updated: August 12, 2026
The short version: heicjpg.online is a free HEIC to JPG converter and nothing else. There are no accounts, no ads and no tracking scripts. Your photos are stored under unguessable links for up to 30 days and then deleted automatically. Nobody looks at them, they are never shared or sold, and they are not used to train any AI models. We do not store your raw IP address and this site sets no cookies.
1. Who we are
heicjpg.online ("we", "us", "this service") is a free online tool that converts HEIC, HEIF and HIF photos to JPG. If you have any questions about this policy or your data, write to us at contact@heicjpg.online. The service is operated by BDK Media Daniel Bihun, Poland. You can read more about us on our About page.
2. What we process, and why
2.1 The photos you upload
When you upload a photo, it is transferred to our server over an encrypted HTTPS connection and converted to JPG. The converted file is stored so that you can download it later or on another device. Specifically:
- Converted files are stored for a maximum of 30 days and then deleted automatically. No action is needed from you.
- Download links use long random tokens that cannot be guessed or enumerated. Only someone who has your exact link can access your file.
- Your photos are processed automatically by software. No human looks at them, and they are never shared, sold, published or used to train machine learning models.
- The converted JPG keeps the EXIF metadata of your original photo (capture date, camera settings and GPS location if your camera saved it). If you do not want that metadata in the file you share, remove it before or after conversion.
2.2 IP addresses
We never store your IP address in readable form. To protect the service from abuse (for example, automated mass uploads), we store an irreversible cryptographic hash of the IP address together with a daily conversion counter. The hash cannot be turned back into your IP address, and the counters are deleted within 48 hours.
2.3 Server logs
Like virtually every website, our hosting infrastructure keeps standard technical access logs (requested URL, timestamp, browser type, IP address) for security and troubleshooting. These logs are managed by our hosting provider, are not used for marketing or profiling, and are rotated automatically.
2.4 Analytics
We want to know how many people use the converter, nothing more. For that we use:
- Ahrefs Web Analytics, a privacy friendly, cookie free analytics tool. It gives us aggregated statistics (page views, referring sites, country, device type). It sets no cookies, does not collect personal data and does not follow you across other websites.
- Google Search Console, which shows us how the site appears in Google Search (queries, impressions, clicks). This data comes from Google's own search results and involves no data collection on this website.
3. What we do not do
- We do not require an account, an email address or a phone number.
- We do not show ads, and we do not use advertising scripts or scripts that track you across websites.
- We do not sell, rent or share your personal information with data brokers or advertisers.
- We do not use your photos for anything other than converting them for you.
- We do not profile you and we do not build any marketing databases.
4. How long we keep data
| Data | Retention |
|---|---|
| Uploaded and converted photos | Up to 30 days, then deleted automatically |
| IP hash and rate limit counters | Up to 48 hours |
| Hosting access logs | Rotated automatically by our hosting provider |
| Analytics statistics | Aggregated only; no personal data |
5. Legal basis (EEA and UK visitors)
Where the GDPR or UK GDPR applies, we process the data described above on the basis of our legitimate interest (Art. 6(1)(f) GDPR): operating the conversion service you requested, protecting it from abuse, and understanding aggregate usage. We deliberately minimize the data we touch so that, in practice, we hold as little personal data as possible.
6. California and other US state privacy laws
We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use sensitive personal information. Because there are no accounts, the only personal data that could relate to you is the content of files you upload (deleted within 30 days) and the short lived technical data described above.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export personal data, to object to processing, and to lodge a complaint with your local data protection authority. In practice, the most useful right here is deletion: if you want a converted file removed before the 30 day window ends, email us the download link at contact@heicjpg.online and we will delete it promptly. Files are deleted automatically after 30 days in any case.
8. Third parties
We use a small number of service providers to run this site: our web hosting provider (which stores the files and serves the website) and Ahrefs (cookie free analytics, described above). We do not embed social media widgets, third party fonts, ad networks or any other external scripts.
9. Children
This service is not directed at children under 13 and we do not knowingly collect personal information from them. The service requires no registration, so the only data a child could submit is a photo, which is deleted automatically within 30 days.
10. Security
All traffic to and from this site is encrypted with HTTPS. Converted files are stored under random, unguessable names, are not listed anywhere and cannot be browsed. No method of transmission or storage is 100% secure, but we keep the attack surface small: no accounts, no passwords, no payment data, no personal databases.
11. Changes to this policy
If we change how the service works (for example, if we ever add new analytics), we will update this page and the "Last updated" date at the top. Significant changes will be noted on the homepage.
12. Contact
Questions, deletion requests, anything else: contact@heicjpg.online.