Your files stay on your device.

• All six tools run inside your browser tab. File content is never uploaded, never stored on a server and never reaches us.
• Loading the site still creates ordinary web requests to our hosting provider, which sees technical data such as your IP address.
• We use Lovable Analytics, the visitor analytics of our hosting platform, to understand visits and which tools are used, and to maintain and improve FormatOnce. It records page views and sets a session-id cookie with a 30-minute lifetime. It is loaded without a consent mechanism. This is set out in full below.
• Your theme choice is stored locally under the key formatonce-theme.
• If you email us, your email address, your message and any attachment leave your device and reach our mailbox.

The controller for the personal data described here is Black Sheep Digital Ltd, a company registered in England and Wales under number 16989285, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Contact for all privacy matters: hello@blacksheepdigital.co. Full operator details are on the Imprint.

When you open or paste a file in Compress image, Convert image, Fix CSV, CSV ↔ JSON, JSON validator or SVG to PNG, the browser gives the page a reference to that file and the content is read into the memory of the tab. Images are decoded and re-encoded on a canvas element, CSV and JSON are parsed in JavaScript, SVG is sanitised and drawn to a canvas. The output is created as a temporary in-memory blob that your browser turns into a download.

There is no upload step, no server-side processing, no database, no account, no payment, and no AI or external API involved in handling your file. Neither we nor any third party receives the content or the name of the file. Because of this, we also cannot recover a file for you, audit what you processed, or inspect a result you are unhappy with.

While a tool is open, the file content lives in the tab’s memory, and the download link is a temporary object URL created by your browser. When you change a setting, the previous result and its object URL are discarded, while the file you selected is kept in memory so the tool can process it again. When you press “Start over”, load a different file, navigate away or close the tab, the references to the file and to the results are dropped and the object URLs created for them are revoked.

That is normal memory release, not a guaranteed forensic erasure. Memory is reclaimed by the browser and the operating system on their own schedule and may persist in swap, crash dumps or reserved memory for some time. In addition:

• Any output you download stays in your downloads folder until you delete it.
• Your browser or operating system may keep its own records, such as a download history entry or an entry in a recently-opened-files list.
• Nothing about your file is written by us to localStorage, sessionStorage, cookies, IndexedDB or the page address, and file content is never serialised into a URL.

Delivering a web page is itself a data-processing operation. When your browser requests a page, a script, a stylesheet, a font or the favicon, our hosting provider and the network infrastructure in front of it process, as applicable, your IP address, the date and time of the request, the request path and method, the response status and size, your user agent string and, where your browser sends one, the referring page.

Fonts are served from this site itself, so no third-party font service receives a request. Links to the other Once sites are ordinary links: nothing is sent to them until you click.

We use Lovable Analytics to understand visits and which tools are used, and to maintain and improve FormatOnce. Lovable Analytics is the visitor measurement built into the Lovable platform that hosts this site. The script is injected by the platform at the hosting level rather than written into this site’s own code, and it is loaded when a page opens. This site does not operate a consent mechanism for it.

For a page view, Lovable Analytics records, as applicable:

• the path and full address of the page viewed, and the referring page where sent;
• your browser user agent and language setting;
• a country value derived from your device’s time zone; and
• a randomly generated session identifier stored in a cookie named session-id with a lifetime of 30 minutes, refreshed on each recorded event.

The script does not receive the content or the names of the files you process in the tools. The identifier is not linked to a name or an account.

This notice does not constitute consent or replace consent where required by applicable law. Rules on storing and reading information on your device can require consent independently of the lawful basis for any later processing; the lawful bases we rely on are set out below. The Cookies page explains how to block or delete the cookie, and you may object to the processing as described below.

If you write to us, your email address, your message and anything you choose to attach leave your device and pass through your email provider and ours before reaching our mailbox, where they are readable by us. That is different from the file content you process in the tools, which never leaves your browser.

Please send us as little personal data as possible. Describe the problem and use a redacted or invented example rather than a real file. Please do not send original documents, exports or images containing personal or confidential information: once emailed, they are in our mailbox and are handled as correspondence. We will never ask you to send us a file you processed here.

The site itself writes exactly one value to your browser’s local storage: the key formatonce-theme, holding either dark or light. It records the appearance you selected so the site does not flash the wrong theme on your next visit. It contains nothing about you or your files, is never transmitted, and remains on your device until you change the theme or clear site data. The Cookies page lists everything stored locally, including the analytics cookie described above.

Under the UK GDPR and the EU GDPR, we rely on the following bases.

• Delivering and securing the website — hosting requests and server logs. Legitimate interests, Article 6(1)(f). Our concrete interests are: getting the page to load at all, diagnosing errors and outages, detecting and blocking abuse such as denial-of-service traffic and scraping, and keeping the service available for everyone. Processing is limited to what delivery and security require, and none of it is used to build a profile of you.
• Visitor analytics — the purpose is understanding aggregate usage of the site. For the processing of the data recorded, we rely on legitimate interests, Article 6(1)(f). Storing and reading the session-id cookie on your device is a separate question that can require consent, and no consent mechanism is in place; see the analytics section above. You may object at any time or block the cookie in your browser.
• Responding to your correspondence — legitimate interests, Article 6(1)(f), in dealing with questions, feedback and reports about our own service and keeping a record of what was asked and answered.
• Genuine pre-contractual or service requests — Article 6(1)(b), only where you contact us about entering into or performing an agreement with us. It does not apply to ordinary use of these free tools, which involves no contract-based processing of your data.
• Legal obligations — Article 6(1)(c), where we must keep or disclose information to comply with a legal requirement, for example responding to a lawful request from an authority or retaining records we are obliged to keep.

Where consent is the basis for a specific processing operation, you may withdraw it at any time, and withdrawal does not affect the lawfulness of processing before withdrawal. We do not currently rely on consent for anything described in this notice.

Categories of recipient, and what each actually receives:

• Hosting and content delivery provider — serves the site and processes the request data described above, including the analytics events. The site is hosted on the Lovable platform; the provider’s own privacy information is published at lovable.dev/privacy.
• Email provider — receives and stores the messages you send to us, as any email provider does.
• Professional advisers and authorities — only where we are legally required to disclose information or need advice about a legal claim.

No recipient receives the content or names of the files you process, because those never leave your browser. We do not share data with advertising networks or data brokers.

We are based in the United Kingdom. Our hosting and email providers operate internationally, so the technical data and correspondence described above may be processed on infrastructure or by staff located outside the United Kingdom and the EEA.

Where personal data is transferred outside the United Kingdom or the EEA, the transfer requires a valid transfer mechanism under data protection law, such as an adequacy decision covering the destination or appropriate safeguards. We do not state here which mechanism or which processing location applies to an individual provider. If you need that information for a specific provider, write to hello@blacksheepdigital.co and we will provide what we are able to establish and document.

We keep data by category, according to these criteria.

• File content — not retained by us. It exists only in your browser’s memory while the tool is open, subject to the caveats set out above.
• Hosting and security logs — retained by our hosting provider for the period that provider applies to its own logs, for operational and security purposes. That retention period is set by the provider and not by us. Where we need an extract from a log for a specific security investigation, we keep it only for as long as that investigation and any resulting action require.
• Analytics events — retained by Lovable under its own arrangements. The session-id cookie on your device expires 30 minutes after the last recorded event.
• Correspondence — kept as long as necessary to answer you, handle any follow-up, and establish, exercise or defend legal claims, or where a legal obligation requires us to keep it. There is no automatic mailbox deletion rule; we review correspondence periodically and delete what is no longer needed.
• Theme preference — stays on your device until you change the theme or clear site data. We never receive it.

Subject to the conditions and exceptions in data protection law, you have the right to request access to the personal data we hold about you, to have inaccurate data corrected, to have data erased, to have processing restricted, to object to processing based on legitimate interests, and — where processing is based on consent or on a contract and carried out by automated means — to receive your data in a portable format or have it transmitted to another controller. Where processing rests on consent, you may withdraw it at any time.

Write to hello@blacksheepdigital.co and describe what you want. We may need to ask reasonable questions to confirm that the request really comes from you, but we will not demand more identification than is proportionate. We respond within one month, which may be extended by up to two further months for complex or numerous requests; if we extend, we will tell you within the first month and explain why.

One practical limit: because the files you process never reach us, we cannot retrieve, restore, correct or delete them for you. Only you have them.

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests under Article 6(1)(f) — including the hosting and security processing and the visitor analytics described above.

If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. Send an objection to hello@blacksheepdigital.co. We do not use personal data for direct marketing; if we ever did, you could object to it at any time with no exceptions.

If you are unhappy with how we handle your data, you can complain to a supervisory authority. In the United Kingdom this is the Information Commissioner’s Office: ico.org.uk/make-a-complaint/. If you are in the EEA, you may instead complain to the supervisory authority of your country of habitual residence, your place of work, or the place of the alleged infringement.

You do not have to contact us first, though we would like the chance to put things right.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. We do not sell personal data, we do not run advertising on this site, and we have not added any advertising, remarketing or cross-site tracking technology to it. The only measurement present is Lovable Analytics, described above.

FormatOnce is a general-purpose utility. It is not directed specifically at children, we do not knowingly collect data from children, and there is no age verification on this site because there is no account, no purchase and no content requiring one.

The site is served over HTTPS, all file processing stays on your device, and our runtime error reporting transmits only a fixed error code — never a message, file name, stack trace or any fragment of your content. We keep our dependencies current and size-limit and validate inputs before processing, and SVG input is sanitised before it is ever rendered.

We take appropriate technical and organisational measures, but no website, transmission method or storage system can be guaranteed absolutely secure, and we cannot promise that. If you spot a weakness, tell us at hello@blacksheepdigital.co.

We update this notice when the service or the processing behind it changes — for example if the analytics described above changes. The date at the top shows the current version. Questions about anything here: hello@blacksheepdigital.co.