Privacy

Decoding and encoding both happen on this computer. No picture you open here is sent anywhere. There is no account, no history, no gallery of recent conversions, and nothing is written to storage on your machine either — the files exist as pixels in the tab’s memory and stop existing when the tab is closed.

You can check this rather than take it on trust. Open the network panel in the browser’s developer tools, convert a photograph, and read the list: the page, the fonts, the scripts, and the HEIC codec when a .HEIC is in the queue. That is the whole list at present — no measurement beacon and no advert script, for the reasons set out in the two sections below. No request carries a picture, because there is nowhere on this domain for one to go.

The file is read into memory, its first bytes are examined to decide what format it really is, and it is decoded into pixels. Those pixels are drawn onto a canvas, the canvas is encoded as a JPEG, the metadata block is rewritten onto it if you asked for that, and the result is handed to the browser as a download. Every step of that happens inside this tab, in JavaScript and WebAssembly running on your processor.

The site is published as static files. There is no server-side code on phototojpg.com, no API route, and no database. This is enforced rather than intended: the build fails if a module that can reach picture data also references a network or storage API, and it fails if a route handler is added.

Photographs carry a metadata block describing the camera, the lens, the exposure and the moment of capture, and photographs taken on a phone frequently carry the coordinates of where they were taken. This converter keeps that block by default, because losing the capture dates on a year of photographs is a harm that cannot be undone afterwards.

That default is a trade, and the second half of it is the location. A great many people do not know their photographs contain coordinates, and a JPG shared publicly carries them onward. The rail has a switch that drops the location and keeps everything else, and a second that drops the metadata entirely. All three choices are made here on your machine; none of that data is read by this site for any purpose other than writing it back out.

Nothing here measures your visit. No measurement property has been set up for this domain, the token in the source is still the placeholder it was scaffolded with, and the page therefore renders no beacon at all. Nobody is told that you opened this converter, which page you arrived on, or which country you are reading from, because no script on the page is asking.

If that ever changes it changes to Cloudflare Web Analytics — no cookie, no profile of a visitor — and this section is rewritten in the same edit that switches it on. What you converted would still be outside its reach either way: the file never leaves the tab, so there is nothing about it for any script to read.

This site is built to show Google AdSense in the reading material below the converter, and the positions for it are already decided. None of them is filled today: no advert script is loaded here yet, nothing sets a Google advertising cookie on this domain, and the space simply is not rendered. The domain is waiting on an AdSense review, and the paragraphs below describe what becomes true once that review approves it — written in advance because the policy is the same either way.

Google is an independent controller of the data it collects and may use cookies or similar technology to select and measure adverts. What it will see is the ordinary web-request information any embedded script sees: the page, the referrer, an IP address, and whatever preferences you have set through Google’s own controls.

What it will not see is your pictures. Every position sits below the working surface and none sits inside it, and no advert script is handed a canvas, a file, or anything the converter is holding in memory. Google’s own settings at adssettings.google.com govern personalisation across every site running its adverts, this one included.

The two typefaces are served from this domain rather than from a font service, so reading a page here does not make a request to a third party for text. The site is hosted on Cloudflare Pages, which necessarily processes the request in order to serve it and keeps its own short-lived operational logs.

There are no other third parties. No tag manager, no session recorder, no chat widget, no social embeds, and no shared identifier with any other site.

This site is a general-purpose utility, is not directed at children, and collects no information that could identify anybody regardless of age.

If this policy changes the date below changes with it. Questions go to privacy at phototojpg.com. Last reviewed 9 September 2026.