Privacy Notice

Last updated: 25 October 2026 · Private-preview draft

1. Operator and scope

This notice describes the current preview Filevori site. The controller’s legal identity, business contact address and email are pending publication. The contact form provides an interim privacy-request route. Controller details and the hosting providers’ international-transfer arrangements must be completed and checked before public commercial launch.

2. Files you convert

The current media, image, document and ZIP tools read and process selected files locally in your browser. They do not send the selected files or exported results to our application server. Working files and results remain in the page’s memory and are cleared when it reloads or closes; files you download remain wherever you save them. Your browser, device, extensions, backups and other software may manage their own copies. Direct YouTube fetching is not active.

3. Contact messages and replies

If you contact us, we store your optional name, chosen topic, subject, message, conversation identifiers, timestamps and our replies in the site’s hosted database. No email address is required. Please do not include sensitive personal information, confidential files or passwords. The purpose is to respond to support, copyright and privacy enquiries and manage complaints. The basis is our legitimate interest in responding and maintaining a lawful, secure service, and compliance with legal obligations where a particular request requires it.

The site owner can read and reply through a sign-in-protected inbox. Visitors can access only the conversation associated with their private reply link. The link contains a randomly generated secret; only a hash is stored in the database. Treat it like a password. It is not a public ticket number. We do not send email notifications or store the link in browser local storage. You can delete the conversation using the link; the owner can also delete it.

Conversations expire 90 days after creation and stop being accessible then. Expired records are removed in bounded batches when new contact activity occurs, so physical deletion may occur later during inactivity. Deleted records may remain in the hosting provider’s backups or security records according to that provider’s arrangements, which still need review before public launch. If you lose the private link, recovery is not guaranteed.

4. Security and hosting requests

The application uses a secret-salted hash derived from the connection IP address and hourly window to limit contact spam. It stores the hash, a count and expiry time, not the raw IP in that rate-limit table. These rate-limit records expire after at most two hours and are removed during subsequent contact activity. Security and abuse prevention are our legitimate interests. Contact writes require same-origin requests; form messages are displayed as text, not executed as HTML.

The hosting and network providers necessarily receive network information such as IP address, requested URLs, browser headers and request times. They may process technical and security logs. We have not yet verified their full retention periods, processing locations, subprocessors and any required international-transfer safeguards; those are launch prerequisites. File processing being local does not mean visiting a website sends no network data.

5. Owner sign-in, cookies and other services

The website and conversion tools can be used without an account. The owner inbox requires an owner password. We store a one-way password hash, not the password itself. A secure, HttpOnly, SameSite owner-session cookie is necessary for inbox access. Sessions expire after 30 minutes of inactivity or 12 hours from login. Login attempts are rate-limited using connection hashes. The application does not use ChatGPT sign-in, a separate analytics product, marketing subscriptions or payment processing. Google AdSense is described below and may use advertising technologies. Fonts and conversion libraries are served from this site. Spaceship provides the hosting; its technical logs and backup arrangements are separate from browser-local file processing. External links have their own privacy notices.

Google AdSense advertising

Google AdSense code is installed on the public media, image and document tool pages. Advertising is being configured; Google approval and the advertising-consent setup have not been verified as complete. The ad script is not installed on contact conversations, the owner inbox or the password setup page.

Loading Google’s advertising code makes network requests to Google. Google and its advertising partners may process IP addresses, browser and device information, the page URL, advertising identifiers, cookies and similar technologies to provide, measure and protect advertising and, where permitted, personalise ads. Third parties may place or read cookies or use web beacons and IP addresses as part of ad serving. Files selected for conversion are processed by our tools in the browser; we do not intentionally send contact messages or owner passwords in ad requests.

Where legally required, advertising cookies and personalised-ad processing require your consent. The relevant consent message must be configured and published before consent-dependent advertising is enabled. Do not assume that installing this code completes consent compliance. When a consent message is available, use its choices and privacy controls to manage or withdraw consent. The site’s hosting and security processing are separate from optional advertising processing.

Read how Google uses information from sites that use its services, Google’s advertising privacy information, and Google’s ad settings. Google’s ad settings do not replace any consent choices required on this website. Google and its partners have their own retention and international-processing arrangements; the operator’s final privacy review remains outstanding.

6. Sharing and your choices

Data is processed by our hosting and infrastructure providers to deliver and secure the site. Contact messages are not published to other visitors, sold or used by this application to train AI models. We may disclose information where legally required or necessary to respond to a valid legal claim. We do not make automated decisions with legal or similarly significant effects about you.

Depending on the applicable law and circumstances, you can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Use the Privacy topic in the contact form and retain the reply link. We may need proportionate information to establish that you are entitled to the records; do not send identification documents unless a secure, necessary method has been agreed. You may complain to the UK Information Commissioner’s Office or your local regulator. These rights are not conditional on agreeing to these terms.

7. Updates

We will update this notice if our actual processing changes. Any future server file uploads, payment services, email delivery, or changes to advertising and consent arrangements must be explained before they are introduced.