Privacy policy

The controller for the processing of personal data on switchfile.io and api.switchfile.io is:

Aura UG (haftungsbeschränkt)
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: [email protected]

For questions about your data or to use your rights, write to [email protected]. Our full company details are in the imprint.

• We use your files only to convert them. Nobody looks at them, and we do not pass them on or use them to train AI models.
• Uploads and results are deleted 24 hours after the conversion finishes.
• The service runs on a server in Poland. Files are stored in the EU.
• We do not use analytics or advertising tools. The site loads no fonts or other content from third-party providers.
• Without an account we set one cookie, which is needed to count the free daily files. You will not see a consent banner because we only store what is strictly necessary.

When you convert a file, we process the file, its name, the formats and options you choose, its size and the processing time. Our server converts the file automatically. Nobody looks at its content. We do not pass files on to anyone, and we do not use them to train AI models or for any other purpose than the conversion you asked for.

If you paste a link instead of uploading a file, our server downloads the file from that address. The website behind the link sees the IP address of our server, not yours.

Uploads and results are deleted 24 hours after the conversion finishes. Files that you upload but do not convert are deleted 24 hours after the upload. As a safeguard, the storage itself deletes every file no later than 3 days after it was stored. Working copies on the server are removed when the conversion ends.

Legal basis: Art. 6(1)(b) GDPR, because the conversion is the service you request.

You can convert 50 files a day without an account. To count these files and to keep your conversions visible only to you, we use two things:

• A cookie named __Host-sf_visitor. It holds a random ID and the time it was set, with a signature so that it cannot be forged. It contains no other information. When you come back, we renew it at most once a day with the same ID. The cookie expires 30 days after your last visit, and then you get a new random ID.
• Your IP address. For IPv4 we store the full address, for IPv6 only the first 64 bits (the network part). We count the free files per IP as well, so that deleting the cookie does not give anyone unlimited free files, and we use it to block abuse.

The counter for the daily quota, which holds the ID and the IP, is deleted after 2 days. The IP stays with each conversion until the conversion is deleted 24 hours after it finishes. Rate limit counters that contain the IP are deleted after 24 hours.

Storing the cookie in your browser is strictly necessary to provide the free conversions you request (§ 25(2) no. 2 of the German TDDDG), so it does not need your consent. The further processing of the ID and the IP is based on Art. 6(1)(b) GDPR for the conversion and on Art. 6(1)(f) GDPR. Our legitimate interest is to share the free quota fairly and to protect the service from abuse.

Our browser extension for Chrome, Edge and Firefox converts files through the same service as this website and uses the same free quota. It does not read or change the pages you visit, and it contains no analytics or advertising code.

• When you install it, the extension asks our server for an install token. The token holds a random ID and the time it was issued, with a signature so that it cannot be forged. It contains no other information. The extension keeps it in the extension storage of your browser and sends it with each conversion, so that we can count your free daily files the same way as the cookie on this website does. The token expires 30 days after it was issued. The extension renews it at most once a day while you use it.
• When you choose “Convert with switchfile” on an image, video, audio file or link, the extension sends the address of that file to our server, and our server downloads the file from there. It does not send the address of the page you are on. Some pages embed an image directly in the page (a data: address) instead of linking to a file. For such an image there is no address to send, so the extension uploads the image data itself, the same way as a file you pick. When you pick a file in the extension window, it uploads that file the same way as this website.
• Your IP address and the conversion data are processed as described above under Converting files and Free use without an account.
• The extension stores the install token, your last chosen formats and the conversions of the last 24 hours in the extension storage of your browser. Removing the extension deletes them.

Legal basis: Art. 6(1)(b) GDPR for the conversion you request. Storing the token in your browser is strictly necessary for this service (§ 25(2) no. 2 of the German TDDDG). The browser vendors (Google, Microsoft, Mozilla) deliver the extension through their stores under their own privacy policies. We receive no data about you from them.

When you create an account, we process:

• your email address and your name
• your password, stored only as a salted hash that cannot be turned back into the password
• your sessions: when you sign in, we store the session together with your IP address and your browser's user agent
• your credits and the usage history shown in the dashboard
• the presets you save: a name, the formats and the conversion settings

A session ends 30 days after you last used it or when you sign out. Under Settings in the dashboard you see your sessions with a shortened IP address and can sign them out. We delete ended sessions. Legal basis: Art. 6(1)(b) GDPR for the account and Art. 6(1)(f) GDPR for the session data. Our legitimate interest is to keep accounts secure.

API keys are stored only as a hash. To help you recognize a key, we keep its prefix, its last four characters, its name and when it was last used. If you send an idempotency key with a request, we keep it for 24 hours to recognize repeated requests.

If you set a webhook address, we send notices about your conversions to that address. We keep each delivery together with the address and the message for 7 days after it was delivered or finally failed. A delivery that is still open is deleted 7 days after its last planned attempt. Legal basis: Art. 6(1)(b) GDPR.

If you build our API into your own product and send us files of your users, you decide about that processing. Please tell your users about it in your own privacy policy.

This section applies only when you buy a paid plan or a credit pack. Paid plans and credit packs are not on sale yet. Once they start, our reseller Paddle.com handles the order and the payment as Merchant of Record.

Paddle processes your payment details, your billing address and the order data as a separate controller under its own privacy policy. We do not receive your full payment details. From Paddle we receive your email address, the plan or pack you bought, your country and the status of your payments, so that we can activate the purchase on your account and answer your questions.

Legal basis: Art. 6(1)(b) GDPR, because we need the data to provide what you bought. For records we must keep for tax reasons, the legal basis is Art. 6(1)(c) GDPR. We keep these records for the periods required by German tax and commercial law.

We send emails only when your account needs a link, for example to confirm your email address or to reset your password. If you change your address, the link goes to the new address. To change it you enter your password or sign in again. Once the change is confirmed, we tell the old address about it, so that you notice if someone else changed it. That email has no link. The emails contain a short text and, where needed, the link. They have no images, and the link is not tracked. We send them through Resend (Plus Five Five, Inc., USA), which receives your email address and the content of the message for delivery. Legal basis: Art. 6(1)(b) GDPR.

Emails to [email protected] are received by the email routing service of Cloudflare, Inc. and forwarded to our mailbox at Proton AG, Geneva, Switzerland. Both process the email only to deliver and store it for us.

If you write to us, we use your email address and your message to answer you. Legal basis: Art. 6(1)(b) GDPR if your message relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR, our interest being to answer your request. If you use your rights under the GDPR, we keep the request and our answer to be able to show that we handled it (Art. 6(1)(c) GDPR together with Art. 5(2) GDPR). We delete messages when they are no longer needed for these purposes.

Our services write technical logs for operation and error analysis. We do not keep a log of each request, and we do not log IP addresses. Error entries can contain internal IDs and, depending on the error, the data that caused it, for example a file name or the address of a link. Each service keeps at most 5 log files of 10 MB. Older entries are overwritten. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a working service.

We use only the following cookies and browser storage. All of them are needed for the function you use.

The legal basis for storing these on your device is § 25(2) no. 2 of the German TDDDG, because each is strictly necessary for a service you request.

We share personal data only with these recipients. Unless marked otherwise, they process it on our behalf under a data processing agreement.

We do not sell personal data. We pass data to authorities only where the law requires it (Art. 6(1)(c) GDPR).

Cloudflare and Resend are based in the USA. Where personal data is transferred to the USA, the transfer is based on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR), which are part of each provider's data processing agreement. Where the provider is certified under the EU-U.S. Data Privacy Framework, the transfer is also covered by the adequacy decision of the European Commission for that framework (Art. 45 GDPR).

Proton AG is based in Switzerland. For Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR). Paddle.com Market Limited is based in the United Kingdom, for which there is also an adequacy decision.

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have incorrect data corrected (Art. 16)
• have your data deleted (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a common machine-readable format (Art. 20)
• object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21)

To use these rights, write to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or the one responsible for us:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg, Germany
datenschutz-hamburg.de

We do not make decisions based solely on automated processing that have legal effects on you or affect you in a similar way (Art. 22 GDPR).

We update this policy when our service or the law changes. The date at the top shows the current version. Providing your data is not required by law. Without the data described above for a function, we cannot provide that function.