Privacy policy
The short version: your audio files never reach us, because they never leave your browser. Everything below explains what does happen.
Your files stay on your device. Conversion runs entirely inside your browser using the Web Audio API. No audio is uploaded, stored, queued, logged, or transmitted anywhere. There is no server-side copy to delete because one is never created. You can confirm this by disconnecting from the internet after the page loads: conversion still works.
Your audio files
When you select or drop a file, your browser reads it from your disk into its own memory. It is decoded and rewritten there, and the result is handed back to you as a download created locally. None of this involves a network request.
We therefore hold no audio, no filenames, no durations, and no metadata about what you converted. Closing or reloading the tab discards everything the page was holding.
What is collected
The site is a set of static files served by Cloudflare Pages. Like any web host, it records standard request information so pages can be delivered and abuse can be handled:
- The IP address that requested a page
- The date and time of the request
- The page or file requested
- Browser type and version, from the user agent string
- The referring page, when your browser sends one
These are ordinary server logs, handled by Cloudflare under their own privacy terms. They are not combined into profiles, sold, or used for advertising, and they contain nothing about the files you converted.
What is not collected
- No account, because there is nothing to sign up for
- No email address, unless you choose to write to us
- No audio, filenames, or conversion history
- No tracking cookies
- No advertising or analytics cookies at the time of writing
- No fingerprinting scripts, session recording, or heatmaps
Cookies and local storage
This site sets no cookies of its own and stores nothing in local storage. Your output settings are not remembered between visits, which is a small inconvenience in exchange for storing nothing about you.
Cloudflare may set a cookie for security and bot management on some networks. That cookie is functional and is not used to track you across sites. Cloudflare describes its use in its own documentation.
Third party content
Every file the site needs is served from mp3towave.org. There are no fonts loaded from Google, no analytics scripts, no social widgets, no embedded videos, and no content delivery networks beyond the one hosting the site itself. That means no third party can observe your visit through resources on these pages.
The MP3 encoder, LAME via lamejs, is served from this domain rather than an external CDN, both for privacy and so the converter keeps working if that CDN is unavailable. It is used under the LGPL, and the licence is at /vendor/LAME-LICENSE.txt.
If you email us
Messages sent to hello@mp3towave.org are kept only as long as needed to deal with them, then deleted. Your address is used to reply and nothing else. There is no mailing list to be added to.
Please do not attach audio files. We cannot accept them and they will be deleted unread.
Your rights
Visitors in the European Economic Area and the United Kingdom have rights under the GDPR to access, correct, delete, or restrict processing of personal data, and to object to it or ask for it in a portable form. Residents of California have comparable rights under the CCPA and CPRA, including the right to know what is collected and to opt out of its sale. We do not sell personal information, and there is no mechanism here by which we could.
In practice, the only personal data we could hold about you is an email you sent us and the server logs described above. To ask about either, write to hello@mp3towave.org. Requests are answered within 30 days.
Children
This site is not directed at children and collects no information from anyone knowingly, including children. There is no account system through which a child could submit personal data.
Security
Pages are served over HTTPS only. Because conversion happens locally and no audio is transmitted, the usual risk of a converter, that your files sit on someone else's server waiting to be exposed, does not apply here. The main thing left to protect is the integrity of the page itself, which is why the site sends a content security policy and related headers.
Changes to this policy
If the site ever adds analytics or advertising, this page will be updated before that happens and the date at the top will change. Material changes will also be noted on the changelog. What will not change is where conversion happens: your files stay in your browser.