Security and privacy

What this is, and what it is not

frogConvert is maintained in spare time, and it is provided as is. There is no warranty of any kind - not of merchantability, not of fitness for a particular purpose, and not of security. Sections 15 to 17 of the GPLv3 are the operative terms; this paragraph is the plain-English version, not a replacement for them.

Concretely, that means:

• No guarantee your files survive. The engines are third-party WASM builds of large, complicated software. They have bugs. Keep your originals - the app is deliberately built never to overwrite an input, but do not make it the only copy of anything you care about.
• No security guarantees, and no audit. Nobody has paid for a penetration test or a code audit of this, and none has been done. The privacy properties below are real and are how the thing is designed, but they are described honestly rather than certified.
• No SLA, no bug bounty, no commitment to fix anything. Reports are welcome and taken seriously; see below. Nothing is promised about when, or whether, a given issue is addressed.
• Not for anything where being wrong is expensive. If you are handling regulated, legally sensitive or safety-critical documents, use software that carries an assurance someone will stand behind.

Anyone is free to use, study, modify and redistribute it under the GPLv3. The absence of a warranty is part of what makes that possible.

What happens to your files

All conversion runs on your device, in the browser tab, in a Web Worker, with WebAssembly. The site at frogconvert.xyz serves static files plus WASM; once that lands, your files don't go anywhere else.

A few specifics:

• Every handler is a WASM module or a browser API. There's no server-side conversion path at all.
• No analytics, telemetry, crash reporters, or usage beacons. None of it.
• bunx frogconvert mcp talks over stdio (no network port). bunx frogconvert api binds to 127.0.0.1:3000 only and rejects cross-origin requests via Origin/Host header validation. Files passed in stay on the machine running the server.
• Inter is bundled via @fontsource-variable/inter. If it doesn't load for some reason, the browser falls back to system fonts. No requests go to Google Fonts or any other font CDN.
• The PWA service worker caches files in your browser. You can clear it from the browser's site-data UI or via the in-app cache controls.
• Files dropped into the Converter, the PDF Editor or Compress get saved to IndexedDB so the Resume prompt can offer them back. Compress stores the chosen level alongside them. They auto-purge after 7 days; clearing site data wipes them right away.

Limits worth knowing

• Safari struggles with some PDFs. See docs/CONVERTER.md § Known limitations.
• Password-protected PDFs aren't supported. Strip the password first with another tool.
• When the REST API or MCP runs next to a production build, some conversions fall back to a Puppeteer-launched headless Chromium locally. Still your machine, but a real browser process spawns. See INTEGRATIONS.md § Browser-Assisted Conversions.
• The notes above describe this repo and frogconvert.xyz. A fork, mirror, or self-hosted copy is its own thing and could have been modified.
• The REST API and MCP will write to the local disk if given paths. There's no automatic permission check or cleanup. Setting FROGCONVERT_SANDBOX_ROOT=/some/dir pins those paths to one root (src/mcp/core/fileInput.ts).
• Dependencies are pinned in package.json; upstream advisories aren't actively monitored.

Issues and PRs welcome on GitHub.

See also

• docs/CONVERTER.md and docs/PDF_EDITOR.md: the user-facing flows.
• docs/INTEGRATIONS.md: MCP and REST.
• CHANGELOG.md: release history.