When you select a file
The browser grants this page access to the file you selected. UnHEIC reads bounded sections for inspection and, only when you request conversion or preview, passes the file into local decoder and canvas/PDF code. The application has no upload route for conversion files.
Selected files, decoded images, previews and outputs can remain in JavaScript/WASM memory while you move between the four HEIC routes so you do not have to select them again. They are removed when you use Clear, remove an item, reload or close the tab, or when the browser reclaims the page. Object URLs are revoked during explicit cleanup paths.
Analytics
UnHEIC loads Vercel Analytics for page-level usage. Product events use a closed property allowlist: workflow type, chosen output, success/error/cancel state, coarse file-count bucket, coarse decoded-work bucket and coarse device-memory class. They must not include filenames, file bytes, image content, data URLs, object URLs, source metadata, exact dimensions, precise file sizes or raw error messages.
UnHEIC also loads Sentry's third-party error-monitoring code. Sentry may receive technical diagnostics such as a stack trace, browser information and the page URL when the site fails. UnHEIC does not intentionally attach selected file bytes, filenames, image pixels, extracted metadata, data URLs or object URLs to those reports. Errors shown beside a local item use safe product codes and generic messages; the filename remains a separate local UI label.
Downloads and clipboard
Generated outputs are downloaded from a browser-created object URL. A ZIP is assembled locally. Copying a detector report writes that text to your clipboard only after you activate the copy control; the report excludes file content.
Metadata
The installed HEIC decoder does not preserve source metadata. Resulting raster images therefore do not carry the original EXIF, GPS, capture date or embedded ICC profile through that path. Source metadata is not silently inserted into a PDF either.
A PDF does carry document metadata of its own, and the workbench lists every field before you convert. Title and author are written only when you type them; creator and subject are fixed strings written alongside them. The PDF library always stamps its own name and version as the producer. The creation date is a fixed placeholder date unless you choose a day, in which case that day is written at midnight UTC: the time you converted and your time-zone offset are not recorded.
Verify it
You do not need to take this policy on trust. The local conversion Network guide explains how to filter browser requests and test with a unique sentinel filename. The metadata privacy checker can inspect bounded metadata signals before conversion.
Contact and changes
This policy is tied to the implemented product contract and was updated on 12 August 2026. Material changes to file transfer, monitoring or analytics fields require a corresponding visible policy update.