Privacy
The PDF is written by code already running in this tab — your photographs are read from disk into memory, drawn onto pages, and handed back to your Downloads folder, and no request carrying image data is ever made.
What happens to a photograph you open
Choosing a file gives this page a reference to it. The browser decodes the picture into memory, a small thumbnail is made for the photo tray, and the rest is released. When you save, each photograph is read again, drawn onto its page, compressed if it needed to be, and written into the document. The finished file is handed to the browser as a download.
By default, closing the tab ends all of it: no photograph is kept between visits, and there is no queue, server-side cache or account holding a copy. Camera data in the file — the make and model, the date, and on a phone photograph the latitude and longitude — is dropped rather than carried into the document.
What this site can keep on your device, and only if you ask
Three things can be stored in your own browser. None of them is ever sent anywhere, and all three are removed by Clear local data (on the builder’s Quality step) or by clearing this site’s data in your browser’s settings.
- A kept document. After the tenth photo, or the first time you reorder the pages, the builder asks whether to keep the document on this device so a reload does not lose it. Only if you say yes, the photos and the settings are stored in this browser’s own database (IndexedDB), with a note in the status bar while it is on. It is deleted after 1, 7 or 30 days — your choice — or the moment you press Clear.
- Saved requirements. If you save a portal’s settings under a name, those figures (paper, margins, size limit, resolution) are kept in this browser’s local storage. Never a photograph.
- The offline copy. After a page has finished loading, a service worker saves this site’s own pages, scripts and fonts in the browser’s cache so the builder opens with no connection. It holds no photos and nothing about you. See the offline page for how to check it.
There is no server to send anything to
This site is a set of static files on a content network. It has no application server, no database, and no endpoint that accepts an image. A build-time check fails the release if any code that touches picture data acquires the ability to make a network request, which is a rule enforced mechanically rather than promised in a paragraph.
What the PDF itself carries
Location, camera model and editing-software details are removed from every photo placed in the PDF. A JPEG copied straight into the document loses its EXIF, XMP and comment blocks on the way in; a page that is redrawn is drawn from pixels alone. The document has no author or producer field, and no title unless you type one on the Save step, so nothing in it says where it was made or what your files were called. It does say which language it is in (English unless you choose another), which screen readers use. If you choose to keep a photo’s colour profile, that profile — a description of its colours, not of you — is embedded too.
What is measured
On the live site, convertphotostopdf.com, page views are counted with Cloudflare Web Analytics. It sets no cookie and builds no profile across sites. For each page view it records the address of the page, the site that linked to it, the country, and the family of browser and operating system — the figures this site uses to know which pages people find. The property belongs to this domain alone.
The count never receives anything from the builder: not a photograph, not a file name, not a page count, not a setting, because nothing inside the builder is reachable from the script. On any other address — a preview, a copy of these files, your own computer — the script is not loaded at all. Blocking it changes nothing about how the builder works.
Advertising
This site shows no ads. No advertising code is loaded on any page, and no advertising identifier is read.
Check it yourself
The claim on this page is testable, so test it. Open your browser’s developer tools, choose the Network tab, add a few photos and save the PDF. You will see this site’s own code and fonts arrive, and you will see no request leave carrying a photograph, a page or a file name — the PDF appears in your Downloads folder without one. A PDF you open on the add-photos page is read the same way: in this tab, never sent.
Children
The site is not aimed at children. There is no account to open and no cookie set by this domain; the only personal information it ever receives is what somebody chooses to type into the contact form.
The contact form
The contact page is the one place this site sends anything anywhere, and it waits for you to press send. At that moment the name, email address and message you typed, plus the name of this site, are posted to a Google Form read by the people who run it. Opening the page requests nothing from Google, no photograph or builder setting is attached, and no other page here contacts Google at all.
Changes and contact
If this page changes it will be because the site changed, and the new wording will replace this one here. Questions about it are welcome through that same contact page.