Your images are processed entirely on your own device. They are never uploaded to our servers, never transmitted to any third party, and never stored anywhere by us. We could not retrieve one if we wanted to, because we never receive it.
How that works, and how to check it yourself
When you choose a file, your browser reads it locally and draws it into a
<canvas> element. The resizing and compression happen in your browser's own memory.
The result is handed back to you as a download. At no point does the file travel over the network.
This is not only a promise — it is enforced by your browser. Every page here is served with a Content Security Policy that lists, by name, every place this page is allowed to send anything. That list is this domain, and Google's advertising domains, and nowhere else. There is no allowed destination that would accept an image, and Google's tag neither reads your file nor could send it if it tried. Even if our code were altered or compromised, your browser would refuse to send your file anywhere. You can read the policy yourself in the response headers for any page on this site.
Until August 2026 that list was one entry long — this domain — and this page said so. Adding conversion tracking widened it to five. We would rather show you the new sentence than keep the old one and hope nobody checked. The sentence that actually matters, that your file itself has nowhere to go, is unchanged.
You do not have to take our word for it, and this is the check worth doing. Open your browser's
developer tools, switch to the Network tab, and resize an image. You will see the page's own files
load from this domain; a script from googletagmanager.com, which is Google's advertising
tag; and — once the result is ready — a single empty POST to /e/resize here
plus a conversion request to Google. What you will not see, at any point, is your image. It is
not in any of those requests, and there is nowhere for it to go.
What we do collect
Three things. Here is all of them.
- Standard server request data. Like every website, serving you a page involves your IP address, browser user-agent, the page requested and a timestamp reaching our host, Cloudflare. Cloudflare states that it discards the client IP address at the nearest data centre and does not store it in its core databases or logs. We never see IP addresses ourselves.
One completion ping per visit. The first time a tool finishes a job for you, the page sends an empty request to
/e/followed by the name of that tool — for example/e/heic-to-jpg. It has no body. What is kept is the tool name, the country Cloudflare already attached to the request, and the fact that it happened. Nothing else, and never more than once per page load however many files you process.And, since August 2026, Google's advertising tag. This site runs an ad campaign, and the only way to tell which ads bring people who actually finish a job is to let Google measure it. So every page here now loads Google's conversion tag from
googletagmanager.com, and the moment a tool finishes a job it reports a conversion. We would rather write that sentence plainly than let you discover the script yourself.What that means in practice, as precisely as we can put it. The tag sets cookies on this domain — names beginning
_gcl_— and writes an entry to your browser's local storage. Google's own documentation describes what these hold as “a unique identifier for a user or the ad click that brought a user to your site”. The tag loads on every page, not only when you finish something, so Google learns that a browser visited a page here even if you do nothing else. It receives what any web request carries: the address of the page, the referring page, your IP address, your browser and your screen size. If you are signed in to Google, Google is capable of connecting that to your account; we cannot prevent that and have no visibility into whether it happens.What the tag does not get is the thing this site is actually about. It never sees your file, its name, its size, its contents, or anything derived from it — not because Google promises so, but because your file is never anywhere the tag could reach it, and the policy above has no destination that would accept it. That has not changed and will not.
This is a real cost and we are not going to dress it up. Before August 2026 this page said there were no cookies, no third-party scripts and no advertising tags on this site. All three were true; none of them is true now, and they have been removed rather than softened. If that changes your mind about using this site, that is a reasonable conclusion to reach. The tools all work with the tag blocked — an ad blocker, or Firefox's and Safari's default protections, will stop it, and nothing here will break or nag you about it. The code is at /e.js; it is short and most of it is this explanation.
One answer, only if you cancel and only if you choose to give it. After a subscription is cancelled — by Stripe, not by us — the subscription page asks a single optional question about why. Tap one of the five answers and the page sends that answer and nothing else: which of the five it was, whether the plan was monthly or yearly, the country Cloudflare already attached to the request, and the date. Pick “something else” and you may type a sentence; if you do, that sentence is stored too, truncated to 240 characters.
There is no identifier on it and no cookie attached, so it cannot be joined to your visit, to your other answers, or to your payment. It is a tally, and it exists to tell one thing from another: somebody who needed the tools once and is finished, versus somebody a tool let down. Those two look identical in Stripe's data and they call for opposite responses. Skipping does nothing at all, and the cancellation is already complete before the question is asked.
We keep that ping because a site that does all its work inside your browser is invisible to its own server logs: without it we cannot tell whether people who arrive here actually get what they came for. It is deliberately the weakest measurement that answers that question. There is no identifier in that ping and no cookie attached to it: it is the same request for every visitor and cannot distinguish you from anyone else. Google's tag, described above, is a separate thing and does carry one.
Everything else we know is aggregate request counts — how many requests arrived, roughly which countries they came from, which pages were popular — counted on the server, after the fact. One third-party service runs on this site — Google's advertising tag, described above — and beyond what that reports, nothing here observes what you do inside a page: not your files, not your settings, and nothing we record about how long you stay.
The open-source libraries we do use
This page used to say “no third-party code runs on this site”. That was too broad, so it has been corrected. Some of the tools rely on open-source libraries written by other people — a PDF engine, a text-recognition engine, a barcode reader, a video container reader. That is third-party code, and saying otherwise was wrong.
What remains true, and is the part that matters, is that every one of them is served from this domain and none of them contacts anyone. We download each library once, check it, and host the exact bytes ourselves. Nothing is fetched from a CDN or from the library author’s servers while you use the site, so no other company learns that you visited, what you opened, or when.
That is enforced rather than promised. Every page is served with a
Content-Security-Policy of connect-src 'self' and script-src 'self',
which means the browser itself refuses any attempt to load code from, or send data to,
anywhere but this domain — including by us. You can read the policy in the response
headers for any page here.
The libraries, with their licences: pdf.js and pdf-lib (Apache 2.0 and MIT) for reading and writing PDFs, tesseract.js (Apache 2.0) for reading text from a scan, ZXing (Apache 2.0) for reading barcodes, libheif (LGPL) for opening iPhone HEIC photos, qrcode (MIT) for making QR codes, and Mediabunny (MPL 2.0) for reading and writing video containers. Their licence texts ship alongside them.
Two things your browser holds, briefly
If you buy a passport photo, a print sheet, or a combined bank-statement ledger, we have to send you to
Stripe to take the payment, and leaving this page would normally lose the work you just did — a
browser will not let a website re-fill a file box. So just before you go, your own browser puts
the finished result into two of its own private stores, both readable only by this site and invisible to
every other: sessionStorage, which your browser erases the moment you close the tab, and a
copy in localStorage stamped with the time. When you come back we hand it over and delete
both immediately. For the ledger this is the numbers only — the statement PDFs themselves
are never stored, and are never read again after the table is built.
Why two, and what the second one costs you. Until 8 September 2026 there was only the first.
sessionStorage belongs to one browser tab, and on an iPhone a payment can come back into a
different tab from the one it left — so a real customer paid, was returned to a tab that had never
seen the photo, and was told it was gone. The second copy survives that. The price is that it outlives
the tab rather than dying with it: it is refused after thirty minutes, it is deleted the moment
the file is handed back, and it is deleted on any later visit to that page that is not a payment. We
would rather write that down than leave you to find it. On 9 September 2026 the bank-statement tool was
given the same two copies; until then it had only the first, and had the same hole.
Neither copy is uploaded. We never receive the photo, and neither does Stripe — Stripe only ever sees that someone paid, never what for. If it is gone by the time you return, it is gone from us too, because we never had it: your browser is then told the file is already paid for, so you can build it again at no charge for the next 48 hours. That is the trade-off of doing the work on your machine, and we would rather explain it than quietly upload your photo to avoid it.
The second is the chain. When a tool finishes, the strip under the result offers to hand the
file straight to the next tool — resize, then strip the metadata — without you downloading
it and choosing it again. Moving between two pages means the file has to survive the trip, and a
browser gives a page no way to pass one directly. So for the length of that trip, your own
browser holds it in IndexedDB: local storage on your machine that only this site can
read.
That one is worth being precise about, because it is the only thing on this site that touches your disk rather than only memory. Three things make it bounded. The record is deleted in the same operation that reads it, so it exists for the length of one navigation. Anything older than five minutes is deleted by the next page of ours you open, whether or not it was ever read. And it holds one handoff, not a history — a second chain overwrites the first.
The honest edge case: if your browser is killed in the second between the click and the next page loading, that one record sits on your disk until the next time you open a page here. It is on your own machine the whole time, we never receive it, and clearing site data removes it like everything else. You can watch the whole thing in your browser’s developer tools, under Application → IndexedDB → hermitfile, and see it empty itself.
What we do not collect
- No cookies of our own. Nothing this site's own code writes is a cookie. Google's
advertising tag, described above, does set cookies beginning
_gcl_on this domain — those are Google's, not ours, and the settings page cannot erase them; your browser's own “clear site data” will. - No accounts, logins, passwords or email addresses. What an account would normally hold — your saved settings, your chains, your licence and one preference — is kept by your browser on this device instead, and the settings page lists all of it, exports it as a file, and erases it.
- No payment information. Every tool is free; the one paid thing — a HermitFile Pro
subscription — is taken on Stripe’s own pages, so your card details never touch
this site. A Pro licence key holds a plan name, two dates and a random
reference and nothing else — no name, no email, no customer number — and it is
checked on your own device, so using Pro sends us nothing at all. The reference exists only so
that a key posted somewhere public can be switched off on its own; it is not derived from your
payment and is not recorded next to it, so it cannot be traced back to you.
There is exactly one moment when your browser does speak to a server of ours, and it is worth stating rather than burying: immediately after you pay, the welcome page asks our licence server for your key so you do not have to copy it out of an email. That request carries only the checkout reference Stripe has just put in your address bar — no file, no name, no identifier of any kind — it happens on that page only, and the key is handed over once and then forgotten. Every licence check after that is offline, on your own device, forever. - No advertising is shown to you here and no advertising network is given space on these pages. What is here is Google's conversion tag, which measures our own ads elsewhere. It is a third-party tracker by any fair definition and we are not going to call it something else.
- No analytics vendor — no Google Analytics, no product analytics, nothing that records what you click or how long you stay. The only script here from anyone else's server is Google's conversion tag; the open-source libraries the tools use are hosted here and described above. Our own completion ping goes to this domain and nowhere else.
- Nothing we build. We keep no profile of you, no advertising identifier, and no record that joins one visit to another. Google's tag keeps its own identifier, which is the point of it and the whole of what changed.
- No image data, filenames, or anything derived from the files you process.
Who receives your data
Two companies. Cloudflare, Inc. hosts the site, and the request data described above is a by-product of that hosting. Google LLC receives what its advertising tag collects, described above. No one else receives anything, and neither of them receives your files. Cloudflare's own privacy practices are described in its privacy policy, and its Data Processing Addendum, incorporating the EU Standard Contractual Clauses and the UK Addendum, applies to our account.
Do Not Track
Some browsers send a “Do Not Track” signal. Google's tag does not honour it, and we are not going to claim otherwise on Google's behalf. What we can tell you is that blocking the tag works completely: an ad blocker, Firefox's Enhanced Tracking Protection or Safari's Intelligent Tracking Prevention will stop it loading, and every tool on this site behaves exactly the same with it blocked. Nothing here detects the block, works around it, or asks you to turn it off.
Your rights
Data protection laws give people the right to access, correct or delete personal data held about them. We hold no identifiable personal data, so there is nothing for us to retrieve or erase. If you would like to ask about this anyway, write to hello@hermitfile.com and you will get a straight answer.
Children
This site is not directed at children under 13 and we do not knowingly collect personal information from them. There is nothing here for a child to sign up for.
Changes
21 August 2026 — Google's advertising conversion tag was added to every page. Before that date this page said there were no cookies, no third-party scripts and no advertising tags here, and that was true. It is not true now. The reason is plainly commercial: we run ads, and without measurement we cannot tell which ones bring people who actually use the tools. The whole of what changed is described in what we collect, and the tag's own bootstrap is a single readable file at /gads.js.
If this policy changes materially again, the effective date at the top of this page will be updated and the change will be described here. The commitment that your files are processed on your own device and never uploaded will not change; it is the point of the site, and it is the one thing the tag never touched.
Who runs this
HermitFile is operated by an individual in Pennsylvania, United States. For anything at all — a privacy question, a bug, a form specification we have wrong — email hello@hermitfile.com.