Privacy Policy
Last updated: September 2026
1. Who is responsible for your data
FileSherpa is operated by [Operator name], based in the Czech Republic, reachable at privacy@filesherpa.net. Under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Czech Act No. 110/2019 Sb., this is the “data controller” for the limited processing described below.
2. The short version
The files you convert, resize, merge, or otherwise process on FileSherpa are never uploaded anywhere — every tool runs entirely in your browser, on your device. We cannot see, receive, or store them, and nothing in our code sends them anywhere. The sections below cover the much smaller amount of data the site does handle: your IP address (briefly, for abuse prevention), optional analytics (only if you accept cookies), and what you type into the AI-assisted “what do you need done?” box (only if you use that specific feature).
3. What we process, and why
Your files
Not processed by us at all. Every tool (image, PDF, text, vector, print) runs client-side in your browser. No legal basis is needed because no personal data reaches us — there’s nothing here for GDPR to apply to.
Your IP address (rate-limiting)
The one server-side endpoint on this site — the AI-assisted routing behind the homepage’s “what do you need done?” box — briefly checks your IP address against a request-count limit, to stop automated abuse. It is held only in server memory for up to about a minute and is never written to a database, file, or log by our code.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — securing the service against abuse.
What you type into the AI-assisted box, and your file’s type/size
If you type a plain-English request (e.g. “make this 600×600 and under 250kb”) instead of picking a tool yourself, that request is first matched against our own tools entirely on your device, at no cost, with nothing sent anywhere. Only if that can’t confidently work out what you mean does your typed text — plus your file’s type and size, never its name, content, or bytes — get sent to an AI model to interpret. See §5 for which providers and where.
Legal basis: legitimate interest / performance of the specific feature you invoked — you can avoid this entirely by using the manual tool pages instead.
Analytics — only after you accept
We use Google Analytics 4 and PostHog to understand which tools get used and whether they work — never filenames, file content, or anything you typed. This starts only after you click “Accept” on the cookie banner; clicking “Decline” (or never choosing) keeps both fully off, with no cookie set either way. You can change your mind anytime via “Cookie settings” in the footer.
Legal basis: your consent (Art. 6(1)(a) GDPR; § 89 of Act No. 127/2005 Sb., the Czech Electronic Communications Act).
4. Cookies
| Cookie | Purpose | Set when |
|---|---|---|
cookie-consent (local storage, not a cookie) | Remembers your accept/decline choice. | Always — this is what makes “Decline” stick. |
theme (local storage, not a cookie) | Remembers light/dark mode. | Always — not tracking, no consent needed. |
Google Analytics (_ga*) | Usage analytics. | Only after you accept. |
PostHog (ph_*) | Usage analytics. | Only after you accept. |
The first two are “strictly necessary” (remembering your own choice) and don’t need consent under ePrivacy rules. The last two are analytics — off by default, on only if you accept.
5. Who else sees any of this
Your files: no one, ever. The limited data above may pass through:
- Groq, Inc. and OpenAI, L.L.C. (both USA) — only if the AI-assisted box escalates your typed request to them; transferred under the EU Standard Contractual Clauses.
- Google LLC (USA) — Google Analytics, only after consent; Google is a certified participant in the EU-U.S. Data Privacy Framework.
- PostHog — only after consent; transferred under the EU Standard Contractual Clauses unless our PostHog project is EU-hosted.
- Our hosting provider, to serve the site at all — under its own data processing agreement.
We don’t sell data, and we don’t have any other advertising or data-broker relationships.
6. How long we keep it
Rate-limiting data: under a minute, in server memory only. AI-routing requests: governed by Groq’s/OpenAI’s own retention terms, not ours — we don’t separately store your request. Analytics: per Google Analytics’s and PostHog’s standard retention settings, until you withdraw consent, after which no new data is collected under your identifiers.
7. Your rights
Under GDPR, you can ask us to access, correct, delete, or restrict the (very limited) data we hold about you, object to processing based on legitimate interest, and withdraw analytics consent at any time via “Cookie settings” in the footer. To exercise any of these, email privacy@filesherpa.net. You can also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ, uoou.gov.cz), or your own country’s supervisory authority.
8. Automated guidance, not a human
The “what do you need done?” box is an AI-assisted feature, not a person — as required by Article 50 of the EU AI Act, we’re telling you that plainly here and at the point you use it.
9. Children
FileSherpa isn’t directed at children and we don’t knowingly collect data from anyone under 16.
10. Changes to this policy
If what we collect or why ever changes, this page will be updated and the date at the top will change with it.
See also: About FileSherpa.