Privacy Policy

1. Who we are

This Privacy Policy explains how HEICPix ("we", "us", "our") collects, uses, and protects information when you visit heicpix.com (the "Service").

The Service is operated by Shrestha Tripathi, based in India, as part of the WorksOffline family of privacy-first browser tools. Shrestha Tripathi is the data controller for any personal data processed via the Service.

Contact for privacy questions: shrestha.tripathi@gmail.com

2. Data we do NOT collect

Because the Service runs entirely in your browser, we do not collect, receive, store, transmit, or have any access to:

• Your photos, videos, or any other files you convert
• Image content, EXIF metadata, GPS coordinates from your photos
• Filenames of the files you process
• File sizes, formats, or any conversion outputs
• Account credentials (we have no accounts)
• Payment information (we have no paid features)
• Your name, address, phone number, or other identifying info

You can verify this yourself by opening your browser's Developer Tools (DevTools → Network tab) and watching what requests fire when you convert a photo. The answer: none.

3. Data we do collect (and why)

We collect the minimum data needed to understand whether the Service is working and being used:

a) Anonymous analytics (via Google Analytics 4)

• Pageviews — which pages you visited and in what order
• Approximate location (country and city) — derived from IP, then IP is anonymized
• Browser and operating system (so we know which to test)
• Referrer — which site sent you to HEICPix
• Device type (mobile vs desktop) and screen size

We have configured Google Analytics to anonymize IP addresses (the last octet is dropped before logging). We do not enable Google Signals, ad personalization, or any data sharing for advertising purposes.

b) Browser local storage

HEICPix stores two small preference values in your browser's localStorage:

• Your theme preference (light or dark) under key heicpix:theme
• Your output format preference under key heicpix:format

These values never leave your browser. They are not sent to us or any third party. Clearing your browser site data wipes them.

c) Server logs (incidentally)

Cloudflare (our hosting provider) maintains standard HTTP request logs for security and DDoS protection: IP address, request URL, timestamp, user-agent. These are processed by Cloudflare under their own privacy policy and we do not access them for marketing. See Cloudflare's privacy policy.

4. Lawful basis (GDPR)

Where the EU General Data Protection Regulation applies, our lawful basis for the limited processing described above is:

• Legitimate interest for anonymized analytics — understanding aggregate usage to maintain and improve the Service, balanced against minimal individual impact.
• Legitimate interest for Cloudflare's security logs — protecting the Service from attacks.
• No processing requires consent because we do not use ad cookies, behavioural profiling, or personal-data sale.

5. Third-party services

We use the following third-party services. Each is bound by their own privacy policies, which we recommend you review:

• Cloudflare Pages — hosting (static files only). Privacy policy
• Google Analytics 4 — anonymous usage analytics, IP-anonymized. Privacy policy

We do not use advertising networks, retargeting pixels, social-media share trackers, fingerprinting libraries, or session-replay tools.

6. Cookies

HEICPix does not set first-party cookies. Google Analytics 4 may set its own cookies (_ga, _ga_*) to distinguish unique sessions. These are first-party from your browser's perspective and are not used for cross-site tracking.

You can block these cookies in your browser settings or by using an ad blocker like uBlock Origin. The Service works identically with or without analytics enabled.

7. Your rights

Because we collect almost nothing tied to your identity, most data-subject rights are trivially satisfied. That said, under GDPR / UK GDPR / CCPA / DPDP Act 2023 (India), you have the right to:

• Access — request a copy of any personal data we hold about you
• Rectification — correct any inaccurate data
• Erasure — request deletion
• Restriction — limit processing in certain circumstances
• Portability — receive data in a structured format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent
• Lodge a complaint with your local data-protection authority

To exercise any of these rights, email shrestha.tripathi@gmail.com . We will respond within 30 days.

8. Children's privacy

The Service is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact shrestha.tripathi@gmail.com and we will delete it.

9. International data transfers

The Service is operated from India. Cloudflare's edge network and Google Analytics process data globally; both are bound by Standard Contractual Clauses for EU/UK data transfers. See their respective policies for details.

10. Data retention

Google Analytics retains aggregated data for 14 months. Cloudflare access logs are retained per their schedule (typically 30 days). We retain no other data because we collect no other data.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the Service, third-party tools, or applicable law. The "Last updated" date at the top will change accordingly. Material changes will also be noted on the homepage for at least 14 days.

12. Contact

For any question about this policy or your data, contact us at:

Email: shrestha.tripathi@gmail.com

Operator: Shrestha Tripathi
Parent brand: WorksOffline
Jurisdiction: India