What is stored, where, and what is never collected at all.
Last updated 21 October 2026
Converting happens in your browser. The file is read, converted and rendered on your own machine, and no part of it is sent to a server. The history you see is your browser’s own storage, not an account.
An account exists so documents can follow you between devices and be shared. It holds:
We count visits and a handful of actions — a page opened, a conversion run, a download, a save, a share — as anonymous daily totals, on our own server and in our own database. Counting sets no cookie and stores nothing in your browser; the totals keep no identifier and no IP address, and nothing about a document beyond which conversion or format it was. Where a visit came from is recorded only as the referring site’s name — Product Hunt, Google, “direct” — or as the campaign tag in the link you followed.
A shared link also records its opens, for its owner to see: the time of each one, and whether it was the shared page or the app — nothing about who opened it. The page asks our server for a one-pixel picture, and that request is the whole of what is recorded; no cookie is set. So that one machine cannot run the count up, a one-way hash of its address is kept beside a per-minute tally and deleted within a day. The opens go with the link when it is revoked, and none is kept longer than a year. A document shared with specific people is the one exception: its reader signed in as one of the addresses the owner named, so each open also records which of those addresses it was — and the page tells the reader that the owner can see it.
The extension converts the page you are on, in that page, on your own machine. It reads a page only after you press its button or open the side panel on it, it never writes to a page, and nothing from a page goes anywhere until you press Save or Share — signed out, it never talks to us at all.
There is no advertising, no tracking pixel and nothing sold. Google Tag Manager loads on every page, and brings Google Analytics only if you allowed analytics in the cookie banner. Microsoft Clarity, which shows where people click and scroll, loads on the same answer and only once the page has finished loading — with every word and picture masked in your browser before anything is sent, and never on a shared document or folder. Refused or unanswered, Google’s tags write nothing to your browser and Clarity does not load at all. Nothing is shared with anyone except the infrastructure that runs the service: the database, the blob store, the authentication provider, the two email providers and the host.
Your documents are not read by us, and they are not used to train anything.
Email is sent in these cases and no others: to confirm your address and to reset a password, which come from the authentication provider; to tell somebody that a document has been shared with them, which comes from the email provider; and, to an account holder, a few emails in the first weeks — a welcome, a couple of tips on using it, and a question about how it is going. Those come from Brevo and each carries an unsubscribe link — and so does the monthly product update, which goes only to people who subscribed to it.
What the email provider is given is the recipient’s address, the address of the person sharing where there is one, and the message itself. It is never given a document.
Brevo is given your address and name, the day you registered, and a few counts that decide which of those emails is useful to you: how many documents you keep and have shared, how often your shared links were opened, which apps you connected, and when you last used TransformPipe. Never a document, its name or its text. If you answer the 1-to-10 question in one of them, the score is kept with your account, and the people who run TransformPipe are told who gave it so they can ask what would make it better. Unsubscribing from one of these emails stops them all; deleting your account removes you from Brevo too. Subscribing to the monthly update while signed out gives Brevo only the address you type, and nothing is sent to it until you confirm from the email.
One session cookie, set by our authentication provider when you sign in, first-party and HttpOnly. A short-lived cookie exists during the sign-in round trip and expires in ten minutes. One more is set only if you open a shared link that has a password and enter it: it remembers, for a day, that you did. That is all of them — there is nothing optional to turn off. The cookies page has the detail.
Your theme and, when signed out, your history live in your browser’s local storage. They never leave it.
Deleting a document moves it to the Trash, where it waits for 14 days in case you want it back; then the row and the stored Markdown are deleted together. Emptying the Trash, or deleting a document from it, deletes it at once. Revoking a share drops the token, so a link already sent stops working.
To remove an account and everything in it, ask — see the support page. Reaching a storage limit refuses the write; it never deletes something you chose to keep to make room.
This is a tool for work, not a service for children, and it is not directed at anyone under 16.
If this page changes in a way that affects what is collected, the date above changes with it.