Privacy policy
In short
- Your files are uploaded to an outside converter (CloudConvert) to be converted. They are not converted on your device.
- We delete your file and its result 1 hour after the conversion, or when you press “Delete it now”.
- We do not look at your files, sell them, or use them to train anything.
- You can use the converter without an account. Signing in is only needed for paid plans.
- We have no advertising and no analytics on this site today. If that changes, we will update this page first.
Who is responsible
9568-3744 QUEBEC INC. runs AnyToWav. For questions about your personal data write to privacy@anytowav.com.
What we collect, why, and for how long
| What | Why | How long |
|---|---|---|
| The file you upload, and the converted file | To convert it and give it back to you | 1 hour after the conversion, or until you delete it. The converter also removes finished jobs on its own. |
| A record of the job: file name, type and size, your settings, the result, when it happened, your IP address and a random visitor id | To show you the result, enforce the daily limit, stop abuse, and handle copyright notices | 30 days after the conversion. Then the record is removed, including the IP address. (The file itself is long gone by then.) |
| Daily counts of conversions per visitor id and per IP address | To apply the free daily limit | 35 days |
| Short-lived request counters per IP address | To stop floods of requests | Under 24 hours |
| Your email address (and, with Google, your name and Google id), if you sign in | To give you an account and, later, to link purchases to it | Until you delete your account |
| Purchases and payment status, when paid plans are offered (not your card number: that stays with Stripe) | To give you what you paid for, and to keep tax and accounting records | As long as the law requires us to keep accounting records |
| What you send us in a copyright report or an email (your name, email address and message) | To deal with your request | 3 years, then it is removed |
Cookies and similar storage
The cookies below are the ones the service needs to work. We do not use advertising cookies. Visit analytics cookies are the one optional kind, and they are off unless you allow them (see Google Analytics below).
- Visitor cookie (a2w_anon): a random id, signed so it cannot be forged, kept for one year. It is how the service knows which files are yours and how many you have converted today.
- Sign-in cookie (a2w_session): set only when you sign in, kept for 30 days or until you sign out. We store only a scrambled form of it.
- Sign-in check (a2w_oauth): lives for 10 minutes while you sign in with Google.
- Google Analytics cookies (_ga, _ga_*): set only if you click “Allow analytics”. They last up to 2 years and tell Google Analytics that repeat visits come from the same browser.
- Your cookie choice (a2w_analytics_consent): kept in your browser’s storage so we do not ask again. It never leaves your browser.
- Browser storage: while a conversion is running, your browser remembers its reference so the page can continue after a reload. It goes when you close the tab.
Google Analytics (optional)
If you allow it, we use Google Analytics to see which pages are visited, from which country and on which kind of device. Google receives your IP address, the page you view, your browser details and the analytics cookie id, and may process them outside Canada, including in the United States. We do not send it your files, file names, email address or anything you type. If you say no, nothing is sent to Google and no analytics cookie is set. You can change your mind at any time with “Cookie settings” in the page footer; choosing “No thanks” also removes the analytics cookies from your browser. Google’s use of the data is described in Google’s privacy policy.
Cloudflare’s human check (Turnstile) runs on the converter page. It looks at signals from your browser to tell people from bots. Its use of that data is described in Cloudflare’s privacy policy.
Sign-in with Google
If you choose “Continue with Google”, Google tells us your email address, your name and a Google account id. That is all we ask for (the scopes openid, email and profile). We do not receive your password, and we do not read your Gmail, Drive, contacts, calendar or any other Google data.
- How we use it: to create your account, to sign you in, and to link purchases and your file allowance to you. We do not use it for advertising, and we do not sell it or share it with anyone except the companies listed below that run the service for us.
- How we keep it: in our database, until you delete your account. “Delete my account” on the account page removes it, together with your sign-ins and what you have bought.
- Google’s rules: AnyToWav’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Who else handles your data
We use these companies to run the service. They may only use the data to provide their service to us.
- CloudConvert converts your files. It receives the file and its name. The storage it gave us is in its EU (Frankfurt) region. We ask it to delete your job 1 hour after the conversion. See its privacy policy for what it does with data.
- Cloudflare delivers this website, checks that visitors are people, and hosts our application and its database. Cloudflare runs a worldwide network, so your requests can pass through servers in many countries. It also keeps technical logs of requests (such as address, time and page) to run and secure the service.
- Google, only if you choose to sign in with Google. We receive your email address, name and Google id. We do not get your password and we do not read your Google data beyond that.
- Cloudflare, which sends the sign-in link when you choose to sign in by email. It sees your email address and the message.
- Stripe, when paid plans are offered, takes payments. Your card details go to Stripe, not to us.
We do not sell personal data. We may share it if the law requires it, or to protect our rights, for example in a copyright dispute.
Where data is processed
We are in Canada. Your files are processed in the EU by CloudConvert, and other data is handled on Cloudflare’s network, which spans many countries. When data moves between countries we rely on the protections that the companies above offer.
Your rights
You can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct it, or delete it. If you have an account you can delete it yourself on the account page;
- stop using it for something you did not agree to.
Write to privacy@anytowav.com. We reply within 30 days. If you are not happy with the answer you can complain to the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.
Children
The service is not meant for children under 13, and we do not knowingly collect their personal data.
Security
The site uses HTTPS. Cookies are signed, session cookies are kept only in scrambled form, and secrets are kept out of the website’s code. No system is perfectly safe, so please convert only files you are comfortable sending to a converter service.
Changes
If we change this policy in a way that matters, we will update the date at the top and, where we can, tell you. See also the terms of service.