When you convert a file online, two separate privacy questions apply: does the file leave your device, and who else is watching the visit. We measured both across 9 popular converters with the same procedure: load the service's JPG→PNG page in Chromium 147, dismiss cookie banners, drop the same 227 KB photo, and log every network request for 25–35 seconds. Measured 2026-08-16; raw data below.
| Service | Architecture | 3rd-party hosts | Trackers | Notable |
|---|---|---|---|---|
| OfflineConvert (this site) | local | 1 | 0 | Zero upload measured during a real conversion; the 1 third party is Cloudflare's cookie-less timing beacon |
| VERT | local | 3 | 0 | Local processing; calls a geolocation API (ipapi.co) on page load |
| Squoosh | local | 1 | 1 | Google's local image tool; Google Analytics present |
| CloudConvert | server | 0 | 0 | Cleanest surface of the server group — zero third parties, re-verified headed. The file itself still transits their servers by design |
| Convertio | server | 11 | 3 | Files stored up to 24 h per their own policy |
| Zamzar | server | 17 | 2 | |
| FreeConvert | server | 19 | 3 | 661 KB of session-recording telemetry sent to Microsoft Clarity during the visit |
| Online-Convert | server | 20 | 4 | |
| iLoveIMG | server | 24 | 5 | Heaviest surface measured: ad-tech and analytics from 24 distinct third-party hosts |
The finding worth repeating
FreeConvert's page shipped 661 KB of session-recording data to Microsoft Clarity while we were on it. Session replay tools reconstruct what you did on the page — on a site whose whole purpose is handling your personal files. Nothing suggests file contents were in that payload, but the volume of behavioral telemetry on a file-handling page is the point: the privacy cost of a "free" converter is often paid before you even press Convert.
Architecture is the bigger split
Tracker counts vary, but the structural line is local vs server. Server-side converters receive your file — that is how they work, and their own retention policies say so (Convertio: stored up to 24 hours; others: "deleted after processing"). That isn't an accusation; it's their documented design. Local converters never take custody, which is a property you can verify yourself in the network tab — here's the 3-minute procedure. CloudConvert deserves its nuance: within the server group it runs the cleanest page we measured (zero third parties), which is compatible with taking custody of your files — the two questions really are separate.
Method
- Playwright-driven Chromium 147, fresh browser context per service, 2026-08-16.
- Each service's JPG→PNG tool page; cookie banners dismissed via common consent buttons.
- Fixture: the same 227 KB, 1600×1600 JPEG dropped into each service's file input.
- Third party = any request host outside the service's own registrable domain. Tracker list: GA/GTM, DoubleClick, AdSense, Meta, Hotjar, Clarity, Amplitude, Mixpanel, Taboola, Outbrain, Criteo, AppNexus and similar.
- Upload classification: local services verified by byte-level absence of large outbound bodies during actual conversion; server services classified by architecture, corroborated by their own retention policies (completing full server conversions under automation was blocked by multi-step UIs on several sites — see limits).
Honest limits
- One page per service, one day, one region. Tracker loadouts vary by geography and consent choices; EU visitors may see fewer trackers post-GDPR-banner, US visitors more.
- We could not automate full conversion flows on every server-side site (multi-step UIs, bot walls), so per-byte upload capture is reported only where achieved; the server-custody classification rests on the services' own documentation.
- This measures the visit's privacy surface, not vendors' internal data handling.
- Session-recording was observed on FreeConvert during our visit; other services may sample sessions rather than record all.
Raw data
Download and re-analyze: data.csv · data.json (includes per-service host samples and full notes). License: CC BY 4.0 — reuse with a link and the date.
Changelog
- v1.0 — 2026-08-16. Initial 9-service measurement. Planned next: EXIF/GPS survival matrix across services, large-file handling, EU-consent variant.
Related: verify zero-upload yourself · what conversion does to your metadata.