Cookies

The short version

If you are here to convert a file, no cookies are set at all. Every converter on this site works without an account, so for almost everyone who uses it there is nothing on this page to worry about: no analytics cookie, no advertising cookie, and none of the strictly-necessary sort either.

Signing in to a paid account sets one cookie. It exists to keep you signed in between pages, so that reaching your account does not mean proving who you are over and over. It is set for this domain and no other, it is marked so that only our server can read it and no script on the page can, nothing else is kept beside it, and signing out clears it.

Making an account sets one more, and only during the few minutes that takes. Creating an account sends a code to your email address, and this cookie is how the next screen knows which address to check the code against. It holds that address and nothing else. It is marked the same way as the one above, so no script on the page can read it, it is sent only to the account pages and not to any converter, it expires by itself after thirty minutes, and it is deleted the moment the code is accepted. It exists so that your email address does not have to travel in the web address of the page, where it would be kept in your browser history.

There is no third cookie and there is no analytics or advertising cookie in either case. Not one that is off by default, not one behind a consent toggle, not one from a partner. The list above is the entire list.

Nothing is stored between visits unless you ask for it

Cookies are not the only way a site can keep something on your machine, so to be complete: local storage and session storage are unused, signed in or not. There is one database, and only if you ask for it — a paid account can switch on a conversion history, which is kept in this browser and never sent anywhere. A paid account can also switch on saved history, which is the opposite arrangement and is described on the privacy page: it keeps the converted file on our servers rather than on your machine, so it puts nothing here for this page to describe.

The choices you make while converting — the output format, the day-first setting, a column mapping you corrected by hand — exist in the page's memory and are gone when the tab closes. Come back tomorrow and the site does not know you were here, unless you switched on a history: the browser kind, which your machine remembers and we do not, or saved history, which we do.

That is mildly inconvenient and deliberate. Remembering a preference means storing something, and the moment there is a store there is a conversation about what else could go in it.

No analytics or advertising

There is no page-view counter, no session recorder, no heatmap, no advertising pixel and no embedded widget from anywhere else. No page on this site loads anything from another domain — even the typeface is served from here rather than from a font provider.

Buying a plan, and later changing or cancelling it, are the times you reach anyone else — and both are links rather than scripts: they take you to Stripe's own page, on Stripe's own domain, where their cookie rules apply and are theirs to describe. Nothing of Stripe's runs on our pages, so nothing of theirs is set on ours. What they receive is set out on the privacy page.

This does mean we have very little idea how many people use the site or which pages they read. That is the cost, and it is one worth paying for a tool whose whole promise is that your file stays put.

How to check any of this

Do not take it on trust — it is one of the few privacy claims a visitor can verify in under a minute.

1. 1Open your browser's developer tools and go to the Application or Storage tab.
2. 2Look under Cookies, Local Storage and Session Storage for this domain. If you are not signed in, all three are empty. If you are, Cookies holds the one that keeps you signed in and the other two are still empty. Halfway through creating an account you will see the second one described above, holding the address you just typed; finish or wait half an hour and it goes.
3. 3Look under IndexedDB as well: empty, unless you switched on a conversion history, and then it holds exactly what you converted on this machine. Saved history is the one thing this check cannot show you, because it is on our servers rather than in your browser — your account's settings page lists what is there and deletes any of it.
4. 4Switch to the Network tab and convert a file. No request carries it, and no request goes to any domain but this one.

The second and third steps are worth doing while signed in as well as signed out, because they are the ones that would catch us adding something. A list this short is a claim you can count.

What your browser does on its own

Your browser will cache the page, the stylesheet and the font so a second visit loads faster. That is ordinary HTTP caching rather than a cookie: it stores the site's own files, not anything about you, and clearing your cache removes it.

Requests are also logged by the host serving the pages, as described on the privacy page. That is a server-side record of a request, not something stored in your browser.

If this ever changes

An earlier version of this page promised that if the site gained an account or a payment step, this page would change before that shipped and say precisely what is stored and why. That is what the sign-in cookie above is: it was described here before sign-in was switched on, rather than after somebody found it in their browser.

The same rule holds for whatever comes next. A cookie appears on this page before it appears in your browser, or the page is not doing its job.

Anything that does not need a cookie will not get one. If you think something here is inaccurate, write to contact@statementsmith.com — a page like this is only useful if it is exactly right.