Privacy Policy
Last updated: September 2026
1. Who is responsible for your data
FileSherpa is built and run by Samuel Blasko, one person, based in the Czech Republic, reachable at filesherpa.net@gmail.com. Under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Czech Act No. 110/2019 Sb., that makes him the “data controller” for the limited processing described below. Where this page says “we” or “us”, it means him — FileSherpa is not a company, and there is no team behind it.
2. The short version
The files you convert, resize, merge, or otherwise process on FileSherpa are never uploaded anywhere — every tool runs entirely in your browser, on your device. We don’t see, receive, or store them, and nothing in our code sends them anywhere. The sections below cover the much smaller amount of data the site does handle: your IP address (briefly, for abuse prevention), optional analytics (only if you accept cookies), and what you type into the AI-assisted “what do you need done?” box (only if you use that specific feature).
3. What we process, and why
Your files
Not processed by us at all. Every tool (image, PDF, text, vector, print) runs client-side in your browser. No legal basis is needed because no personal data reaches us — there’s nothing here for GDPR to apply to.
Your IP address (rate-limiting)
The one server-side endpoint on this site — the AI-assisted routing behind the homepage’s “what do you need done?” box — briefly checks your IP address against a request-count limit, to stop automated abuse. It is held only in server memory for up to about a minute and is never written to a database, file, or log by our code.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — securing the service against abuse.
What you type into the AI-assisted box, and measurements of your file
If you type a plain-English request (e.g. “make this 600×600 and under 250kb”) instead of picking a tool yourself, that request is first matched against our own tools entirely on your device, at no cost, with nothing sent anywhere. Only if that can’t confidently work out what you mean does your typed text get sent to an AI model to interpret, along with a small, fixed set of measurements about the file taken on your own device beforehand — its type and size, and where relevant its pixel dimensions, page count, standard page size, and whether it has bleed, selectable text, open paths, or location data (never the coordinates, only that they exist). Never the file itself, its bytes, its name, or anything else extracted from its contents. See §5 for which provider and where.
Legal basis: legitimate interest / performance of the specific feature you invoked — you can avoid this entirely by using the manual tool pages instead.
Analytics — only after you accept
We use Google Analytics 4 and PostHog to understand which tools get used and whether they work — never filenames, file content, or anything you typed. This starts only after you click “Accept” on the cookie banner; clicking “Decline” (or never choosing) keeps both fully off, with no cookie set either way. You can change your mind anytime via “Cookie settings” in the footer.
Legal basis: your consent (Art. 6(1)(a) GDPR; § 89 of Act No. 127/2005 Sb., the Czech Electronic Communications Act).
4. Cookies
| Cookie | Purpose | Set when |
|---|---|---|
cookie-consent (local storage, not a cookie) | Remembers your accept/decline choice. | Always — this is what makes “Decline” stick. |
theme (local storage, not a cookie) | Remembers light/dark mode. | Always — not tracking, no consent needed. |
Google Analytics (_ga*) | Usage analytics. | Only after you accept. |
PostHog (ph_*) | Usage analytics. | Only after you accept. |
The first two are “strictly necessary” (remembering your own choice) and don’t need consent under ePrivacy rules. The last two are analytics — off by default, on only if you accept.
5. Who else sees any of this
Your files: no one — they’re never transmitted anywhere. The limited data above may pass through:
- OpenAI, L.L.C. (USA) — only if the AI-assisted box escalates your typed request to it. We require this transfer to be covered by an appropriate GDPR safeguard (such as the EU Standard Contractual Clauses).
- Google LLC (USA) — Google Analytics, only after consent; we rely on Google’s own EU-U.S. Data Privacy Framework certification as the safeguard for this transfer.
- PostHog — only after consent. Our PostHog project is configured to its EU region (Frankfurt), so this analytics data stays in the EEA.
- Our hosting provider, to serve the site at all — under its own data processing agreement.
We don’t sell data, and we don’t have any other advertising or data-broker relationships.
6. How long we keep it
Rate-limiting data: under a minute, in server memory only. AI-routing requests: governed by OpenAI’s own retention terms, not ours — we don’t separately store your request. Analytics: per Google Analytics’s and PostHog’s standard retention settings, until you withdraw consent, after which no new data is collected under your identifiers.
7. Your rights
Under GDPR, you can ask us to access, correct, delete, or restrict the (very limited) data we hold about you, object to processing based on legitimate interest, and withdraw analytics consent at any time via “Cookie settings” in the footer. To exercise any of these, email filesherpa.net@gmail.com. You can also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ, uoou.gov.cz), or your own country’s supervisory authority.
8. Automated guidance, not a human
The “what do you need done?” box is an AI-assisted feature, not a person — as required by Article 50 of the EU AI Act, we’re telling you that plainly here and at the point you use it.
9. Children
FileSherpa isn’t directed at children and we don’t knowingly collect data from anyone under 16.
10. Changes to this policy
If what we collect or why ever changes, this page will be updated and the date at the top will change with it.
See also: About FileSherpa and the Terms of Service.