ConvertoomPrivacy Policy — Convertoom
Last updated: 11 October 2026
Who we are
The app is operated by Asylbek Kalybek, an individual developer, 280 Bayzakov Street, Almaty, Kazakhstan. Contact for privacy questions and data requests: [email protected].
The short version
- No account, email, password or sign-in is needed.
- No ads, no advertising identifiers, no third-party analytics or tracking SDKs, no AI processing.
- Images and basic PDF tools run on your device. Those files are not uploaded.
- Office and advanced PDF conversions are uploaded to our servers in Kazakhstan only when you start them. Results are available for 2 hours, then deleted.
What happens to your files
On-device conversions
Image conversions, image tools, PDF page tools, PDF to images/text, text and spreadsheet data conversions marked "Processed on this device" never leave your device. Unsaved results stay in the app for up to 7 days (visible in Recent) unless you delete them earlier. Files you save to Files or share with another app are under your control.
Server conversions
Before your first server conversion the app tells you that the file will be uploaded. Each server job shows "Uploaded to our servers in Kazakhstan for conversion. Results are available for 2 hours, then deleted."
- The file travels over HTTPS to infrastructure operated by us in Kazakhstan (servers rented from Hoster.KZ in Almaty).
- Only isolated conversion processes read it. They have no internet access. No AI vendor or per-conversion conversion provider receives your files.
- The original file name stays on your device. The server stores the file under a random name.
- Interrupted uploads expire after 30 minutes. Inputs and intermediate files are removed within 5 minutes after processing ends. Results can be downloaded for 2 hours after they are ready and are removed within 5 minutes after that.
- Delete from server now in the result screen revokes downloads immediately; removal follows within 5 minutes.
- Document storage is excluded from backups and caches. We do not read, index or reuse document contents and we do not deduplicate content across customers.
Other data we process
| Data | Why | How long |
|---|---|---|
| A random installation key and session tokens (stored in your device Keychain) | To authorize your own jobs without an account | Sessions: expiry + 7 days; inactive installations: 90 days |
| Signed App Store transaction data | To verify the introductory server conversions and Pro subscriptions | While the subscription is active and up to 90 days after it ends |
| A one-way pseudonymous customer key derived from the App Store app transaction | To give the 2 introductory server conversions once per Apple Account | While the introductory offer exists; reviewed annually |
| Job status, file size and checksum (no contents, no names) | To run jobs, count allowances and prevent double charges | 7 days after the job ends |
| Usage counts and daily starts | Allowance limits (100 / 30 days, daily start protection) | 35 days |
| Security and diagnostic logs (no file names or document text) | Abuse prevention and fixing errors | 7 days (up to 30 days during an incident) |
| Aggregate operational statistics | Capacity and cost planning | Up to 13 months, not linked to you |
We receive no email address or Apple Account address from Apple. Payments are processed by Apple; we never see payment details.
Legal basis
- Converting the files you choose, keeping allowances and verifying purchases: necessary to provide the service you request (performance of a contract).
- Security logs, abuse prevention and aggregate operational statistics: our legitimate interest in running a safe, reliable service.
For users in the EU, UK and other regions with transfer rules, server conversions involve a transfer of the uploaded file to Kazakhstan. The transfer happens only when you start a server conversion after seeing where it runs; on-device tools involve no transfer.
Your rights
You can delete server results at any time with Delete from server now, and all local files with Settings → Delete local files. You may request access, correction, deletion or restriction, and object to processing, by writing to [email protected]. You may also complain to the data protection authority in your country of residence.
Deleting the introductory-offer record on request may make the offer available again; we do not use fingerprinting to prevent that.
Subprocessors
Hoster.KZ (Almaty, Kazakhstan) provides the rented servers and has no role in processing document contents. Let's Encrypt issues our TLS certificates and Cloudflare provides DNS for convertoom.com; neither receives your files. Apple processes purchases under its own terms.
Children
The app is not directed to children under 13.
Changes
We will update this page and the date above when this policy changes.