creatorvalet
FilesConvert, compress and reshape files — without uploading them anywhere.MetadataSee what your files quietly carry, then strip exactly what you choose.Text & dataFormatters, converters, and the character-encoding fixes nobody else gets right.PublishingCheck how your pages read to crawlers, to people, and to language models.CodesBarcodes, QR and identifiers that keep working after you publish them.CharactersFind the character you can draw but cannot name — and the font you cannot place.

Is CloudConvert safe?

Yes, as far as anyone outside can tell. What the policy promises, what we measured on the front page, and the question no visitor is able to settle.

Updated 2026-08-07

Yes — and we would rather give you that plainly than bury it, because the interesting part is not the verdict but the size of the window it was reached through.

CloudConvert is operated by Lunaweb GmbH, a German company, under European data protection law. Its privacy policy is dated, it carries a visible change log, and it answers the questions a privacy policy is supposed to answer. We found nothing that would lead us to think it is run badly, and this page is not an attempt to imply otherwise.

Is CloudConvert safe? What the evidence actually supports

Here is the distinction this whole page turns on. Some things about a web service you can establish for yourself in a minute, with no trust involved. Others you can only be told, and being told is a different kind of knowing.

CloudConvert converts files on its own servers. That is not a flaw or a slip — it is the architecture, and it is what lets the service do things a browser tab flatly cannot. But it means your file is copied off your machine onto hardware you do not administer, and from that moment on, everything you know about your file’s life you know because somebody wrote it down for you. The check that settles it either way takes about thirty seconds and works on any site, this one included.

So the honest answer is layered. Safe, on all available evidence. Verifiable, no.

What the privacy policy says, read on August 7, 2026

We read CloudConvert’s privacy policy in full on August 7, 2026. It was dated April 17, 2026, and its change log records what was revised and when — which is more than several comparable services offer. Policies are revisable at any moment, so treat everything below as what we saw on that date, not as a permanent property of the company.

The document confirms outright that in the course of the conversion your files are “temporarily stored on CloudConvert’s servers.” On how long, it gives two numbers:

  • Files are “deleted immediately and irreversible from our servers when using the delete button” — the company’s own wording, and the condition is load-bearing.
  • Failing that press, deletion still happens — “at the latest after 24 hours.”

That second number is the one that keeps falling out of secondhand summaries, which routinely report the immediate deletion and drop the button that triggers it. Both figures are accurate. Only one of them applies to a visitor who converts a file, downloads the result and closes the tab, and it is the 24-hour one. Google’s own summary of this search does carry the distinction, in a parenthesis; the pages ranking beneath it mostly do not.

Separately, the policy states that log data — IP address, user agent, referrer — is kept for 180 days, and that account deletion removes associated data within 72 hours. Their security page adds that “Each conversion runs in a separate, isolated container.” and that Lunaweb GmbH holds an “ISO 27001 certification from TÜV Süd” — a genuine external audit of an information security management system. We hold no such certification and are not going to imply one.

What we measured on the front page

We ran our own measurement against cloudconvert.com on August 7, 2026. Of the six converters we track, CloudConvert returned the lowest possible count of third-party hosts: zero.

Be precise about what that sentence means, because the precision is the point. Our script reads the HTML the server sends and counts hosts referenced statically in that markup. A host injected later by JavaScript is invisible to it. So a zero here means “no statically referenced third-party hosts in the served HTML” — never “loads no third-party resources at all.” Under that method, and only that method, CloudConvert’s home page referenced nothing outside its own domain: no tag manager, no ad exchange, no analytics beacon, not even a font from someone else’s CDN.

That is unusual, and it is to their credit. Every other converter in the same run referenced at least one outside host, and two of them referenced six and four. We would rather publish a measurement that flatters a competitor than run one whose conclusion was settled before it started.

The question nobody outside the company can settle

Everything above came from a document or from markup. Neither tells you what happens on the server, and nothing available to a visitor does.

Whether a deleted file is really gone from every replica and backup rotation, which staff members can reach the storage and under what approval, how a subcontractor’s subcontractor behaves on a bad week — none of that leaves a trace your browser can inspect. It is not hidden out of malice. It is simply on the other side of an upload, which is where servers are. Any file you send anywhere carries this same silence with it, and a certification is a periodic audit of process rather than a live feed of what became of your file.

We are in no position to tell you the answers are bad. We are telling you there is no window.

What CloudConvert does that this site cannot

Being straight about the gap matters more than being flattering about ourselves, so:

  • Breadth. Their format catalog listed 212 formats across 11 categories when we counted it on August 7, 2026, including CAD, e-books, fonts and camera RAW. This site has about 55 tools, each one a single conversion on its own address.
  • Scale. Server hardware does not run out of memory the way a tab does. Long video, huge documents and hundreds of files in one pass are all comfortably theirs and awkwardly ours.
  • Automation. They offer an API, jobs that chain import, convert and export steps, an account with history, and imports straight from cloud storage. We offer none of that.
  • OCR. Turning a scanned page into selectable text needs recognition we do not ship.

If you have 400 files sitting in Dropbox and need them all converted by Thursday, close this page and use theirs. That job is not one a browser tab should be asked to do, and pretending otherwise would be the least trustworthy thing on this page.

When running it locally is the better trade

The trade flips when the file is sensitive, small enough for your own machine, and the conversion is ordinary. A payslip, a contract, a passport scan, a photo whose metadata records where you were standing — for those, the shortest route is the one where the file never travels at all, and where you can watch it not travel.

That is what the tools here are for: HEIC to JPG for a phone photo, WebP to JPG for an image saved off a website, PDF to JPG for a page out of a document, and compress image when something needs to fit under a limit. Each runs inside the tab you already have open. Not because a server would mishandle your file — but because with nothing sent, there is nothing left to take anyone’s word about.