Privacy Policy

1. The part that matters most

We never receive your files. Every tool on this site — image conversion, compression, resizing, cropping, PDF merging, PDF rendering, QR generation, metadata reading — runs inside your own browser using WebAssembly and JavaScript. Your file is read from your disk into the memory of the browser tab, processed there, and written back to your disk as a download.

There is no upload endpoint. There is no processing queue. There is no storage bucket. Filestay is a set of static files served from a CDN; there is no application server that could receive a file even if we wanted one.

You do not have to take our word for it. Open your browser's developer tools, switch to the Network tab, and use any tool on the site. No request carrying your file will appear. The counter in the page header performs the same measurement continuously — it wraps every network API the page can use and counts binary payloads.

2. What we do collect

Analytics

We use Cloudflare Web Analytics, which is cookie-free and does not fingerprint visitors, and Google Analytics 4. These record which pages are visited, roughly where in the world the visitor is, which browser they use, and which tools get opened and completed.

Tool events record the tool name, how long an operation took, and the total size in megabytes of the input and output. File names and file contents are never included in any event.That is a deliberate constraint in the code, not a policy promise: the analytics module only accepts numbers, booleans and tool identifiers.

In the EEA, the UK and Switzerland, Google Analytics runs in Consent Mode v2 and only sets identifiers after you have consented through the banner.

Advertising

This site is funded by advertising through Google AdSense. Google and its partners may use cookies and similar technologies to serve and measure ads, including personalised ads where you have consented.

You can review and change your ad personalisation settings at Google My Ad Center, and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

The advertising code and your files never interact, because your files never leave the browser tab. An advertiser cannot see what you converted, because nobody can.

Error reporting

JavaScript errors are reported to Sentry so that broken tools can be found and fixed. An error report contains the error message, a stack trace, the page URL, the browser version and the release identifier. It does not contain your file, your file name, or anything derived from your file's contents.

Server logs

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes connection metadata — IP address, user agent, requested URL — to serve pages and protect against abuse. See Cloudflare's privacy policy.

3. What stays on your device

Some features remember things locally. All of it lives in your browser's storage on your own device and is never transmitted:

• localStorage — how many files you have processed, how many megabytes you have saved, which tools you have used recently, which ones you have pinned, and your light/dark theme preference.
• sessionStorage — the breadcrumb of tools in your current chain.
• IndexedDB — a temporary holding slot used to pass a file from one tool to the next when you use "Continue with…". The record is deleted the moment the next tool picks it up, and expires after five minutes regardless.
• Cache Storage — the service worker's copy of the site and its WebAssembly codecs, so everything works offline.

Clearing your browser's site data for filestay.app removes all of it. There is no account, so there is nothing to delete on our side.

4. Cookies

Filestay sets no cookies of its own. Cookies present on the site come from Google (advertising and analytics) and, where applicable, the consent management platform that records your choice. The cookie policy lists them.

5. Your rights

Under the GDPR, UK GDPR and CCPA you have rights of access, correction, deletion, portability and objection over personal data held about you.

In practice we hold almost nothing to exercise those rights against: there are no accounts, no profiles and no uploaded content. For the analytics and advertising data processed by Google, use Google My Activity and the ad settings linked above, since Google is the controller for that data. For anything else, write to hello@filestay.app.

6. Children

Filestay is a general-purpose utility and is not directed at children under 13. We do not knowingly collect personal information from children.

7. Changes

If this policy changes materially, the date at the top of the page changes with it. Since we hold no email addresses, we cannot notify you individually — checking this page is the only mechanism available.

8. Contact

hello@filestay.app reaches a person. See the contact page for what we can and cannot help with.