Privacy Policy

Images and SVG files

Tracing runs in WebAssembly inside a Web Worker in your browser. We do not operate an upload API for source images or exported SVG. Opening a file with the picker, drag-and-drop, or paste keeps that bitmap in local memory for the session. Closing the tab discards it. We cannot recover your artwork from our servers because it was never sent there.

Static site hosting (currently Vercel / Cloudflare Pages) still receives normal HTTPS requests for HTML, JavaScript, CSS, fonts, and the WASM engine. Those requests do not include your picture.

Optional account

You can convert images without an account. If sign-in is turned on, you can use Google or an email address and password. New email sign-ups confirm the address with a one-time code sent by email, and a forgotten password is reset with an emailed link. We store the email address, a salted hash of your password if you set one (never the password itself), a hashed session, and the plan field used for a future subscription.

If you save a parameter preset, we store only the name you give it and its trace settings (mode and slider values). We do not store images, thumbnails, source files, or SVG output, and we keep no record of your conversions. Deleting the account removes the email, the sessions, and your saved presets.

Analytics (optional)

If your browser is not sending Do Not Track (DNT=1) or Global Privacy Control, the site may load:

• Google Analytics 4. Configured with IP anonymization, ads personalization off, and Google signals off. Events include page views plus product actions (image upload, trace start/complete/error, export, mode change, preset select/save/update, account sign-in CTA and auth completion). Parameters are limited to things like file format, tracing mode, approximate file size in KB, duration, layer counts, preset quota counts, and error keys. Preset names, email addresses, original filenames and pixel buffers are not sent.
• Microsoft Clarity. Used for aggregated interaction analytics and custom tags (auth state, plan, tracing mode, preset slot counts). The converter preview and account text are masked so session replay should not capture source or SVG pixels, emails, or preset names.

If DNT or GPC is enabled, the analytics loader skips injecting those tags. You can also block them with a content blocker. We do not run a cookie consent banner that re-enables tracking after you opted out via DNT/GPC.

Cookies and local storage

Theme preference uses localStorage key img2vector_theme. Locale uses img2vector-locale. The converter keeps your last-used trace settings in img2vector_tracerParams so they are restored on your next visit; it never contains image data. pv_auth_hint only remembers that this browser was signed in. Saved presets live in your account, not in local storage. A signed-in session uses an HttpOnly cookie named pv_session. GA4 and Clarity may set their own cookies when analytics is allowed - see Google and Microsoft’s documentation for those cookies. We do not sell personal data and we do not use analytics to build advertising audiences (allow_ad_personalization_signals is false).

Legal bases and international users

Pic2Vector is a free website. An account is optional and is not required to convert an image. Analytics, when active, is our legitimate interest in understanding whether the converter works (error rates, export completion) and which landing pages help people find it. You may refuse analytics via DNT/GPC or by blocking third-party scripts. Source images are not stored. An optional account can be deleted from the account page.

Google and Microsoft process analytics data on their infrastructure. Their policies apply to that processing.

Children

The site is a general-purpose design tool. We do not knowingly collect personal information from children.

Contact form

If you use the contact form, the name, email address, and message you submit are sent to our email provider, Resend, and delivered to the site operator so we can reply. The form does not accept or transmit images or other files. Do not include confidential information in the message.

Changes and contact

We will change the “Last updated” date when this policy changes. Operator identity: see About.