Last updated: March 23, 2026
This Privacy Policy explains how qkconvert ("we", "us", "our") collects, uses, and protects your personal information when you use our API and related services ("Service"). We are committed to protecting your privacy and handling your data responsibly.
| Data | Purpose | Stored as |
|---|---|---|
| Email address | Account identity, login, notifications | Plaintext |
| Password | Account authentication | Argon2id hash (irreversible) |
| API keys | Programmatic API access | SHA-256 hash (irreversible) |
If you sign in with Google or GitHub, we receive your email address and basic profile information (name, if available). We use this solely to create and authenticate your account. We do not access your Google contacts, Drive files, GitHub repositories, code, or any data beyond basic profile information.
| Data | Purpose | Retention |
|---|---|---|
| IP address | Rate limiting, abuse prevention | 30 days (request logs) |
| API request metadata | Usage metering, billing, analytics | Duration of account |
| Session tokens | Portal authentication | 24 hours (auto-purged) |
Request metadata includes: endpoint called, HTTP method, response status code, response time, and timestamp. It does not include request or response bodies.
We do not store your files. This is a core design principle of the Service.
When the processed result is returned to you, the original and processed file data is released from memory.
If you are located in the European Economic Area (EEA) or United Kingdom, we process your data under the following legal bases:
| Processing activity | Legal basis |
|---|---|
| Account creation and authentication | Contract performance |
| Usage metering and billing | Contract performance |
| Rate limiting and security | Legitimate interest (service protection) |
| Transactional emails | Contract performance |
| Anonymized analytics | Legitimate interest (service improvement) |
We do not sell, rent, or trade your personal information. We share data only with:
| Third party | Data shared | Purpose |
|---|---|---|
| Stripe | Email, usage totals | Payment processing and billing |
| OAuth tokens (during login only) | Account authentication | |
| GitHub | OAuth tokens (during login only) | Account authentication |
Payment information (credit card numbers, billing address) is sent directly to Stripe and is subject to Stripe's Privacy Policy. We never receive, store, or have access to your full credit card number.
We may disclose information if required by law, court order, or government request.
We implement industry-standard security measures to protect your data:
Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.
| Data type | Retention period |
|---|---|
| Account data (email, password hash) | Until account deletion |
| API keys | Until revoked or account deletion |
| Usage records | Duration of account (needed for billing) |
| Request logs (IP, path, status) | 30 days (auto-purged) |
| Session tokens | 24 hours (auto-purged) |
| Rate limit records | 25 hours (auto-purged) |
| Email verification tokens | 24 hours |
| Password reset tokens | 1 hour |
| Uploaded files | Not retained (in-memory only) |
When you delete your account, we remove your personal data within 30 days. Anonymized, aggregate usage data may be retained for analytics.
We use a single, essential cookie:
We do not use advertising cookies, analytics cookies, or any third-party tracking scripts. We do not use Google Analytics or similar services.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, email privacy@qkconvert.dev.
qkconvert is operated from Australia. Your data may be transferred to and processed in countries other than your own, including:
These transfers are necessary to provide the Service. Stripe maintains Standard Contractual Clauses (SCCs) and other safeguards for international transfers. For transfers to Australia, we rely on the Australian Privacy Act which provides comparable data protection standards.
The Service is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service at least 30 days before the changes take effect. The "Last updated" date at the top indicates the most recent revision.
For privacy-related questions, requests, or complaints:
We aim to respond to privacy requests within 30 days.