Privacy

We never receive your images.

Not "deleted after an hour". Not "encrypted in transit". Never received. Here's what that means in plain words, how the browser enforces it and how you can check it in two minutes.

Summary

What we never receive

  • The images you convert
  • The SVGs you create
  • Your colours, settings or presets
  • Anything you type or paste into the tool

What our host sees

Like every web host, ours handles page requests: the page, the time, your browser type and IP address. We never receive these as logs. We only see aggregated visit counts and security figures in our host's dashboard.

Why there's no cookie banner

We set no cookies and load no third-party scripts: no Google, no Meta, no ad networks, no analytics script. The only thing stored is your light or dark theme choice, in your own browser. With nothing to consent to, there's nothing to ask.

Verify it yourself

Watch the network while you convert

Works in Chrome, Edge, Firefox and Safari. No technical background needed.

  1. svgharbor.com/convert
    ElementsConsoleNetwork
    1

    Open the converter and DevTools

    Press F12 on Windows or ⌥⌘I on a Mac, then pick the Network tab.

  2. ClearFilter: All
    Recording network activity…
    2

    Clear the list

    Click the clear button. The page has loaded, so anything new from here on would be your image travelling.

  3. Drop any image
    3

    Convert an image

    Use a real one. Change the colours, export the SVG, copy the code. Take your time.

  4. 0requests · 0 B transferred
    4

    Count the requests: zero

    Nothing left your browser. For a second test, switch on airplane mode and convert again. It still works.

Under the hood

How the promise is enforced

Content Security Policy

Every page is served with this policy. connect-src 'none' tells your browser to refuse any fetch, XHR, WebSocket or beacon from the page. Even if our code tried to send your image, the browser would block it and log an error you could see in the console.

Content-Security-Policy: default-src 'self'; connect-src 'none'; script-src 'self' 'wasm-unsafe-eval' 'sha256-…'; img-src 'self' blob: data:; font-src 'self'; worker-src 'self'; form-action 'none'; object-src 'none'; frame-ancestors 'none'

The sha256 hashes allow exactly two small inline scripts: the theme switcher and the app's start-up configuration. Nothing else can run.

A sealed-off worker

The tracing runs in a separate Web Worker. The same policy applies there, so the code that handles your image can't open a connection either.

Served from the nearest server

Pages are delivered by Cloudflare, Inc. from the server nearest to you, wherever you are. Your images never touch it.

How sponsor slots work

A sponsor is a static image and a plain link, served from our own domain and chosen by the page's topic. No ad network, no pixel, no cookie, no profile.

"Buy me a coffee" is a plain link to Buy Me a Coffee. That site only sees you if you click it, under its own privacy policy.

Privacy policy

Effective 19 October 2026. This is the formal version of everything above.

1. Who we are

Siebe Vander Henst, Felix Timmermansstraat 4, 3191 Hever, Belgium, company number BE0757785180, is the controller for the personal data described in this policy (“SVG Harbor”, “we”, “us”). For anything about your data, write to privacy@svgharbor.com.

2. What we process

Your images and SVGs: nothing. Conversion runs entirely in your browser. We never receive the files, their contents or your settings.

Request data at our host. When your browser loads a page, our host (Cloudflare, Inc.) handles the requested address, the time, the HTTP status, your browser type, the referring page and your IP address. It does this to deliver and protect the site, under its own retention rules. We receive no raw logs, only aggregated figures.

Your theme choice. If you pick light or dark mode, that choice is saved in your own browser. It never reaches us.

Emails. If you write to us, we process your email address and what you send.

We do not process special categories of personal data, and we do not build profiles of visitors.

3. Children

SVG Harbor is not aimed at children under 16, and we do not knowingly collect data about them. If you believe we hold data about a minor without consent from a parent or guardian, email privacy@svgharbor.com and we will delete it.

4. Purposes and legal bases

  • Running a secure, working website by our host: our legitimate interest (Art. 6(1)(f) GDPR).
  • Counting visits in aggregate, from our host's dashboard: our legitimate interest (Art. 6(1)(f) GDPR).
  • Answering your emails: our legitimate interest, or taking steps at your request before a contract (Art. 6(1)(b) and (f) GDPR).
  • Invoicing Pro, once available: performance of a contract and our legal obligations (Art. 6(1)(b) and (c) GDPR).

We do not send newsletters, show personalised ads or analyse your behaviour on the site.

5. How long we keep it

We keep personal data no longer than needed for the purpose it was collected for.

DataKept forWhy
Request data held by our host (IP address, browser type, requested page)Set by Cloudflare, not by us. We receive no raw logsDelivering and securing the site
Aggregated visit countsNo limitContain no personal data
Emails you send usUntil the conversation is finished, then deletedAnswering your question
Invoices for Pro, once available7 yearsBelgian accounting law

6. Sharing with others

We never sell your data. Cloudflare, Inc., a company in the United States, hosts the site and processes the request data on our behalf, under a data processing agreement. Its network delivers each page from the server nearest to the visitor, so your request may be handled outside the EU, including in the United States. Where that happens, the agreement relies on the European Commission's standard contractual clauses. We share data with others only when the law requires it. We use no analytics, advertising or tracking services of our own.

7. Cookies and local storage

SVG Harbor sets no cookies and loads no third-party scripts, so there is no cookie banner. The only thing stored on your device is your light or dark theme choice, in your browser's local storage, because you asked for it. You can clear it at any time in your browser settings.

8. Security

We take appropriate technical and organisational measures against misuse, loss and unauthorised access. Pages are served over HTTPS with a strict Content Security Policy that stops the converter from sending data anywhere. If you think your data is not properly secured or see signs of misuse, email privacy@svgharbor.com.

9. Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time.

Send your request to privacy@svgharbor.com. If we cannot confirm from your email that the request is yours, we may ask for proof of identity; black out your photo and national register number in any copy you send. We answer as soon as possible and within four weeks.

10. Complaints

You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) at gegevensbeschermingsautoriteit.be.

11. Changes and contact

When SVG Harbor changes, this policy changes with it. We update the date at the top and describe important changes on this page. Questions or requests: privacy@svgharbor.com.

/html>