Verifiable boundary
Privacy by architecture
Your bytes stay here. This is how you can verify it.
HereBytes has no silent server-processing fallback. Source files and results are read, processed, and saved by this browser. The page can still load application code from the network, but your file bytes are not sent with it.
File data path
From selection to result, the file stays inside the browser boundary.
Tools may use browser memory, Workers, WebAssembly, and browser-managed local storage, but they do not hand your source file to a remote conversion server.
The browser grants this page access only to files you explicitly choose.
This browser decodes, converts, compresses, or repairs the file on this device.
Download the result directly or retain it in this browser's Local Workspace.
What can still use the network?
Local processing does not mean a web page never makes a request. HereBytes keeps application resources separate from your files.
- Site resources such as HTML, CSS, JavaScript, and the Service Worker.
- Static Workers, WASM codecs, and fonts required by a tool.
- Optional AI models or OCR language packs, only after you explicitly choose to install them.
What can remain in the browser?
Browser storage is managed by this device and browser profile. It is not automatically synchronized to a HereBytes account.
- Task memory and temporary outputs are released after completion, cancellation, or cleanup.
- The Local Workspace can retain selected copies, tasks, and validated results in OPFS.
- Clearing site data removes the workspace, presets, and offline caches. Download important results separately.
Cookie-free anonymous product and performance analytics
HereBytes uses Cloudflare Web Analytics for page visits and performance, plus a same-origin Cloudflare Workers Analytics Engine endpoint for tool opens, starts, completions, failures, cancellations, download initiation, anonymous issue signals, and sharing.
- These measurements set no cookies, create no user or session IDs, and do not load Google Analytics. Product events go directly to a same-origin herebytes.com endpoint and are used only in aggregate to understand product health.
- File names, paths, content, previews, sizes, file types, raw error details, and URL query parameters are excluded from product analytics.
- Allowed product events contain only published page paths, tool IDs, interface language, task states, anonymous issue categories, share methods, and fixed referral categories. Full referring URLs are excluded; events are not linked across a visitor. We respect Do Not Track and Global Privacy Control browser settings. Detailed diagnostics remain local. When emailing support, users choose which environment details to provide.
Where this promise ends
HereBytes can constrain its own application code and requests. It cannot replace device, browser, or operating-system security.
- Keep your browser, operating system, and device supported and up to date.
- Browser extensions with page access may read page content and are outside HereBytes' control.
- After download, your device, sync software, and chosen sharing destination control the file.
Verify it yourself
Inspect our promise with your browser's Network panel.
You do not need to trust a slogan. Observe one complete task on any tool page.
- 1
Open the Network panel in your browser's developer tools.
- 2
Clear the log, keep recording, and choose a non-sensitive test file.
- 3
Complete a conversion or compression. A first run may load static Worker or WASM resources.
- 4
Inspect the requests. There should be no POST, form, or upload request containing the source file or result.
If you observe file transfer that contradicts this page, stop using the tool and report it to us.
You keep control of local data
Review or delete retained content in the Local Workspace, inspect this browser's capabilities, and audit third-party component sources and licenses.