Last updated: 7 September 2026
This policy explains what happens to information when you visit XY Convert. It is written to be read rather than skimmed past, because a privacy policy nobody understands is not really a privacy policy.
The short version
- Your files never reach us. Every tool works inside your browser. There is no upload, so there is no copy of your document, photograph or recording on any server of ours.
- We do collect some ordinary web data. Which pages get visited, and the technical information every website receives.
- Advertising is where most data collection happens. Google and other advertising partners set cookies to choose and measure the ads you see.
- Drafts in the career tools are saved to your own device, not to us.
- You can turn off personalised advertising in a couple of clicks, and the tools carry on working exactly as before.
Who is responsible for this site
XY Convert operates this website and is the data controller for the information described here. You can reach us through the contact page with any question about privacy, including a request to exercise the rights set out below.
What happens to the files you process
This is the part most people came to read, so it is first.
The tools on this site do not upload anything. When you choose a file, your browser grants that page permission to read it. The work is done in your device’s memory using code running in the tab, and the result is written on your machine and offered to you as a download.
That means there is no server copy, no processing queue, no retention period and nothing for us to delete on request, because nothing was ever received. We cannot see what you converted, we do not know what was in it, and we could not produce it if anybody asked us to.
If you would rather verify that than take our word for it, open your browser developer tools, switch to the network panel, and use any tool on the site. You will see the open source library it needs come down and you will see nothing go up. A simpler test is to load a tool page, switch your connection off, and use it. Most of them keep working, which would be impossible if a server were doing the job.
What we do collect
Server logs
Like every website, our hosting receives a request each time a page is loaded. Those logs typically contain an IP address, the page requested, the time, the browser and operating system, and the page you arrived from. They are used to keep the site running and to investigate faults or abuse, and they are kept for a short period before being discarded.
Analytics
We look at aggregated figures such as which pages are visited, which tools are used and which devices people use, so we know what to improve and what to build next. This is about pages, not about files, because the files never reach us in the first place. We do not attempt to identify individual visitors from it.
The contact form
If you write to us, we receive the name, email address and message you send, along with anything else you choose to include. That is used to reply to you and nothing else. We do not add you to a mailing list and we do not pass it to anybody. Messages are kept while they are relevant and then deleted.
One request. Please do not attach the file you were working on. Describing it is nearly always enough, and asking you to email a document to a site built specifically so that documents stay with you would be a strange thing to do.
Comments
If you leave a comment on an article, we store the comment along with the name, email address and website you provide, plus your IP address and browser information, which helps with spam detection. Your email address is not published. An anonymised string created from it may be sent to the Gravatar service to check whether you have a public avatar, which is a standard part of how WordPress comments work.
Storage on your own device
Some tools save your work locally so that a refresh, an accidental tab close or a flat battery does not cost you an hour of typing. The resume builder, the experience letter tool and the letterhead builder all do this.
That draft is written into your browser’s own local storage. This is a different mechanism from a cookie in one important respect: a cookie is sent back to a server with every request, while local storage stays on your device and is never transmitted. So your employment history, your company details and everything else you type into those tools sits on your machine and nowhere else.
Each of those tools has a button that clears its own saved draft, and clearing your browser data removes it too. Once it is gone it is gone, because there was never a second copy anywhere.
Cookies and advertising
This site is free to use and is paid for by advertising, so this section deserves the most detail.
What Google requires us to tell you
- Third party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites on the internet.
- You may opt out of personalised advertising by visiting Google Ads Settings.
- You may opt out of the use of cookies for personalised advertising by many other vendors at aboutads.info, or at Your Online Choices in Europe.
Who receives data through advertising
We use Google AdSense. Google, and third party vendors and ad networks serving ads through it, may set and read cookies in your browser and may collect information such as your IP address, the pages you view and how you interact with an advert.
Those cookies belong to the advertising networks rather than to us. We do not control their contents, cannot read them and do not receive the personal data they collect. What we receive is aggregated reporting about earnings and performance.
Google explains its own handling of this data in how Google uses information from sites that use its services. A current list of the other vendors that may serve ads through Google, together with their own privacy policies, is available from Google’s advertising partner listings, and the consent notice described below names them.
Other cookies
WordPress sets a small number of cookies for ordinary site functions, such as remembering the name and email you typed into a comment form so you do not have to retype them, and keeping you signed in if you have an account here. The tools themselves need no cookies at all and set none. Our cookie policy lists what is stored and how long it lasts.
If you are in the EEA, the UK or Switzerland
Where the law requires consent, a consent notice appears on your first visit and non essential cookies are not set until you have made a choice. Refusing is as easy as accepting.
The notice names each party that may collect or receive personal data as a result of advertising on this site, and links to their own policies. You can change or withdraw your choice at any time by reopening that notice from the link in the site footer, or by clearing this site’s data in your browser settings, which removes any stored choice and brings the notice back.
Withdrawing consent does not remove advertising and does not affect the tools. Ads simply become less relevant to you.
Why we are allowed to process this
For visitors covered by the UK GDPR or the EU GDPR, our lawful bases are these.
- Legitimate interests for server logs and aggregated analytics, so that the site stays available, secure and worth improving. This is limited to what is necessary and is not used to build a profile of you.
- Consent for advertising cookies and any personalisation. You give it through the consent notice and can withdraw it at any time.
- Legitimate interests for replying to a message you chose to send us, and for publishing a comment you chose to leave.
Your rights
Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to object to or restrict how it is used, to withdraw consent, and to receive it in a portable form. If you are in California or another state with similar rules, you have comparable rights, including the right not to be discriminated against for exercising them.
Write to us through the contact page and we will respond within the period the law allows. In practice there is usually very little to send: unless you have left a comment or written to us, we are unlikely to hold anything that identifies you at all, and we never hold your files.
For data held by advertising partners, the fastest route is the opt out links above, since that data sits with them rather than with us. If you are in the UK or the EEA and are unhappy with how we have handled something, you also have the right to complain to your local data protection authority.
How long things are kept
- Your files: never received, so nothing to keep.
- Drafts in the career tools: on your device until you clear them.
- Server logs: a short period, then discarded.
- Contact messages: while relevant to the conversation, then deleted.
- Comments and their metadata: kept indefinitely so that follow up replies make sense, and removed on request.
- Advertising cookies: set by the networks under their own retention rules, and clearable by you at any time.
Where data goes
Our hosting provider and our advertising partners operate internationally, so information may be processed outside your own country, including in the United States. Where that happens, those providers rely on the safeguards required by law, such as standard contractual clauses. Since your files are never transmitted anywhere, none of this applies to them.
Security
The site is served over an encrypted connection. Access to the administration side is restricted and protected, and software is kept up to date.
The most significant security measure here is architectural rather than technical: a service that never receives your files cannot leak them. Most of the risk in an ordinary file converter comes from documents sitting on a server waiting to be deleted, and that risk simply does not exist here.
Children
This site is general purpose and is not directed at children. We do not knowingly collect personal information from anybody under 13, or under the age set by local law where that is higher. If you believe a child has sent us personal information, tell us and it will be removed.
Links to other sites
Some pages link out to documentation, open source projects and reference material. Those sites have their own privacy policies and we are not responsible for what they do. Following an external link takes you outside the scope of this policy.
Changes to this policy
This page is updated when the site changes or when an advertising partner changes what it does. The date at the top shows when it was last revised, and it is worth glancing at that date rather than assuming nothing has moved. Continuing to use the site after a change means you accept the current version.
Getting in touch
Questions about this policy, requests about your data, or reports of something being stored that is not described here are all welcome through the contact page. That last one is genuinely useful, because advertising partners occasionally change behaviour without announcing it.
This policy should be read alongside our cookie policy, our terms of use and our disclaimer.
This page was last updated on 7 September 2026. If anything here is unclear, or you think something is out of date, let us know and it will be looked at.