Privacy
How “nothing is uploaded” is enforced
Most converters that say your files are private mean that they delete them from a server afterwards. This one has no server to delete them from. That is a structural claim, and the point of this page is to make it checkable rather than ask you to take it on trust.
The short version
- Every conversion runs in your browser. Your file is read by the page, converted in a background thread, and saved back by the browser’s own download mechanism.
- There are no upload endpoints, no API routes, no server actions and no form submissions anywhere on this site.
- No filename, title, author or piece of metadata is transmitted. None of it is stored either — closing the tab is the delete button.
- Nothing is remembered between visits. There are no accounts, no logins, and no cookies set by this site.
Checking it yourself
In your browser
Open the network panel of the developer tools, drop a book in, and convert it. You will see the page and the conversion engine load, and then nothing — no request carrying your file, because there is no request that could.
Or go further: convert with the network disconnected. Everything except the first load of the PDF engine works offline, because there is nothing else to fetch.
In the response headers
Every page is served with a Content-Security-Policy that makes the promise enforceable by the browser rather than by our good intentions. The table below lists each directive and what it stops.
The policy, line by line
| Directive | What it stops |
|---|---|
| connect-src 'self' | The whole promise in one line. The browser will not open a network connection to any other host, from any code on the page, whatever a dependency tried to do. There is no request that could carry a book off this device. |
| form-action 'none' | No form on any page can submit anywhere. There is nowhere for a file to be posted to. |
| default-src 'self' | Every script, style, image and font comes from this origin. No CDN, no analytics vendor, no fonts service. |
| object-src 'none' | No plugins or embedded objects, which is a class of content that can bypass the rest of the policy. |
| frame-ancestors 'none' | This site cannot be framed by another, so nothing can wrap the interface to capture what you drop into it. |
| worker-src 'self' blob: | Conversion runs in a background thread from this origin, which is why the page stays responsive on a four-hundred-page comic. |
| img-src 'self' blob: data: | Covers and pages are displayed from bytes already in memory. A book cannot cause the browser to fetch a tracking image from anywhere. |
| script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' | Scripts only from this origin. The inline allowance exists because the framework emits a small bootstrap script on every page; the WebAssembly allowance is what PDF.js needs to decode certain image types, and it permits compilation only, not eval. Production grants no unsafe-eval. |
Untrusted books
A book is a file someone else made. Chapter markup is stripped of scripts, event handlers and javascript: URLs before it goes anywhere, and it is displayed in an iframe with no script permission and no access to this page. The XML parser here never resolves external entities, which is the mechanism by which parsers get turned into file-disclosure bugs. Archive entry names are sanitised, so a book containing a path like ../../.ssh/authorized_keys cannot produce a file with that name.
What is measured
Page views, through Vercel Analytics. It records which page was visited and where the visit came from. It runs in the page and has no access to what you drop into it — not because it is trusted to behave, but because a book never leaves the tab and connect-src would block the attempt regardless.
There is no cross-site tracking, no advertising and no fingerprinting.
And on DRM
Protected books are detected and refused with a plain explanation. This site does not remove digital rights management, and that is not a limitation waiting to be lifted. The formats page lists how each kind of protection is recognised.