Privacy Policy

1. Who we are

MiniFiles.io is operated as a sole-trader service. For any data protection enquiry, contact us via our contact form.

2. How MiniFiles works

MiniFiles is a browser-based tool for compressing images (PNG, JPEG, WebP, GIF) and PDF files, and for adding password protection to PDF documents. Unlike traditional online tools, MiniFiles processes your files entirely within your web browser using JavaScript and WebAssembly. This means:

• Your files are never uploaded to any server
• All processing runs locally on your device
• We have no technical access to your files at any point
• File retention on our side: zero seconds

For a full technical explanation see our Security & Trust page.

3. Personal data we collect

We collect only the minimum data necessary to provide the service:

• Account data — your email address (and, if you sign in with Google, the name and profile picture Google shares with us), session records (including the IP address and browser user agent of each sign-in), and plan/subscription status. We never ask for or store a password: you sign in with Google or with a one-time email link. Legal basis: performance of contract (GDPR Art. 6.1.b).
• Billing data — name and payment method, collected and stored exclusively by Stripe when you subscribe to a paid plan. Legal basis: legal obligation (GDPR Art. 6.1.c).
• Anonymous usage statistics — for each processed file, the file format, its size before and after, and the tool used (compress, protect, merge or split). No file names, contents, or identifying information are included. Legal basis: legitimate interest (GDPR Art. 6.1.f).
• Guest daily limit — if you use MiniFiles without an account, we store a salted hash of your IP address with a daily usage counter that expires after about 26 hours. Your raw IP address is not stored. Legal basis: legitimate interest (GDPR Art. 6.1.f).
• Website image analyzer — when you enter a URL, our server fetches that public page and its images and passes them to your browser. They are not stored. We keep the site's domain name with a count and the date of the last analysis, to show how many websites have been analysed — never linked to you, your account or your IP. The URL may appear in our hosting provider's request logs, and a hashed-IP counter limits requests per hour. Legal basis: performance of the service you request (GDPR Art. 6.1.b).
• Website analytics — aggregated, cookieless page-view and performance statistics for all visitors, and Google Analytics only if you accept analytics cookies. Legal basis: legitimate interest (GDPR Art. 6.1.f) for cookieless statistics; consent (GDPR Art. 6.1.a) for Google Analytics.
• Contact form messages — name, email, and message body when you contact us. Legal basis: legitimate interest (GDPR Art. 6.1.f).

4. Sub-processors

We share limited personal data with the following third-party processors. None of them receive your files.

• Neon — account database (serverless Postgres, London, UK)
• Vercel — web hosting and CDN, serverless API functions (including sign-in), key-value store for the guest daily limit, and cookieless Web Analytics and Speed Insights
• Stripe — payment processing for paid plans (PCI-DSS Level 1)
• Resend — delivery of sign-in (magic link) emails
• Google — Google sign-in (if you choose it) and, only with your consent, Google Analytics
• Ahrefs Web Analytics — cookieless, aggregated page-view statistics (no files, no cross-site tracking)
• Web3Forms — contact form message delivery

Full sub-processor details are available on our Security & Trust page.

5. Cookies

Essential: a session cookie that keeps you signed in (set by our authentication system, Better Auth). Your compression preferences (quality level, output format) and your cookie-consent choice may also be stored locally in your browser.

Analytics (optional): Google Analytics is loaded only after you accept analytics cookies in the cookie banner. It then sets analytics cookies, with IP anonymisation enabled. If you decline, Google Analytics is not loaded.

Ahrefs Web Analytics and Vercel Web Analytics/Speed Insights are cookieless and report only aggregated statistics. We do not use advertising cookies.

6. Data retention

Account data is retained until you delete your account. Guest usage counters expire after about 26 hours. Billing records are retained for 7 years to comply with tax obligations. Contact form messages are retained for up to 1 year after resolution. Anonymous usage statistics are retained indefinitely as they contain no personal data.

7. Your rights (GDPR)

If you are in the European Economic Area, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. To exercise any right, contact us via our contact form. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority (in Spain: AEPD).

8. International transfers

Account data is stored by Neon in London, United Kingdom (AWS eu-west-2); the UK benefits from an EU adequacy decision. Stripe may process billing data in the USA under Standard Contractual Clauses. Other sub-processors listed above may process limited data outside the EEA under their own transfer safeguards. No file data is ever transferred internationally — it never leaves your device.

9. Changes to this policy

We may update this policy to reflect changes in the service or applicable law. Material changes will be notified by email to registered users. The date at the top of this page indicates the last revision.

10. Contact

For any privacy-related question or to exercise your GDPR rights, use our contact form.