Privacy

Photos stay on your device. No picture you open here is sent anywhere. There is no account and no gallery of recent conversions, and no picture is written to storage on your machine — the files exist as pixels in the tab’s memory and stop existing when the tab is closed. The one thing kept is a short list of which files were already saved, described below, so a long folder can be resumed.

You can check this rather than take it on trust. Open the network panel in the browser’s developer tools, convert a photograph, and read the list: the page, the fonts and scripts from this domain, a decoder from this domain when a HEIC, a TIFF or (in a browser that cannot read it) an AVIF is in the queue, the PDF renderer from this domain when a PDF is opened, the precise JPEG encoder from this domain when you choose it, and — only on phototojpg.comitself — one request to Cloudflare Web Analytics, described below. No request carries a picture, a file name or a setting, because there is nowhere on this domain for one to go.

The file is read into memory, its first bytes are examined to decide what format it really is, and it is decoded into pixels. Those pixels are drawn onto a canvas, the canvas is encoded as a JPEG, the metadata block is rewritten onto it if you asked for that, and the result is handed to the browser as a download. Every step of that happens inside this tab, in JavaScript and WebAssembly running on your processor.

The site is published as static files. There is no server-side code on phototojpg.com, no API route, and no database. This is enforced rather than intended: the build fails if a module that can reach picture data also references a network or storage API, and it fails if a route handler is added.

Photographs carry a metadata block describing the camera, the lens, the exposure and the moment of capture, and photographs taken on a phone frequently carry the coordinates of where they were taken. This converter keeps that block by default, because losing the capture dates on a year of photographs is a harm that cannot be undone afterwards.

That default is a trade, and the second half of it is the location. A great many people do not know their photographs contain coordinates, and a JPG shared publicly carries them onward. The rail has a switch that drops the location and keeps everything else, and a second that drops the metadata entirely. All three choices are made here on your machine; none of that data is read by this site for any purpose other than writing it back out.

When converted files are saved — downloaded, zipped or written into a folder — the site keeps one small record per file in this browser’s own storage (IndexedDB): the file’s name, size and modification time, a short code for the settings used, the output name and its size, and when it was saved. Never the picture, never its pixels, never its metadata. It exists for one thing: when the same files are dropped again with the same settings, the queue offers to skip the ones already done.

These records never leave this browser — there is no server for them to go to — and they are not shared with the analytics. Clearing your browser’s site data removes them, and so does this button:

The decoders, the PDF renderer and the precise encoder are ordinary files from this domain and may sit in the browser’s normal cache like any other script.

This site counts visits with Cloudflare Web Analytics, using its own property. When a page is served from phototojpg.com, a small script from static.cloudflareinsights.com loads after the page and reports that page view: the address of the page, the page that linked to it, the browser and device type, the country the request came from, and how long the page took to load. It sets no cookie, uses no local storage, and builds no profile of you across visits or across sites.

It never sees what you convert. The script is not given any file, file name, picture, metadata value or converter setting, and the converter does not send it events. On any other address that serves these files — a preview copy, a local copy — the script is not loaded at all.

There is no advertising on this site. No advert script is loaded and no advertising cookie is set.

The two typefaces are served from this domain rather than from a font service, so reading a page here does not make a request to a third party for text. The site is hosted on Cloudflare, which necessarily processes each request in order to serve it and keeps its own short-lived operational logs.

Apart from the analytics described above, there are no other third parties. No tag manager, no session recorder, no chat widget, no social embeds, and no shared identifier with any other site.

One exception sits on the contact page, and it waits for you. When you press its send button, the name, email address and message you typed there, together with the name of this site, are posted to a Google Form that the people running it read. Nothing is requested from Google when that page opens, no picture or conversion setting goes with the message, and no other page on this site sends anything to Google.

This site is a general-purpose utility and is not directed at children. Apart from what somebody chooses to type into the contact form, it collects no information that could identify anybody, regardless of age.

If this policy changes the date below changes with it. Questions go to privacy at phototojpg.com. Last reviewed 24 October 2026.