Privacy Policy — Image Converter by Sovrest

Last updated: September 22, 2026

This Privacy Policy explains what data Image Converter by Sovrest ("the Extension") processes, how it is processed, and your rights as a user.

By installing or using the Extension, you agree to this Policy.

1. Who we are

Data Controller: Sovrest
Contact: info@sovrest.com
Telegram: https://t.me/sovrest_official

2. What the Extension does

The Extension converts images between formats (PNG, JPG, WebP, AVIF, TIFF) directly in your browser.

All conversion happens on your own computer. Your images are never uploaded anywhere: the Extension contains no code that sends an image to any server, and it requests no permission to reach one.

Two local code paths are used, and the difference is purely technical:

(a) Your browser's OffscreenCanvas API: for PNG, JPG and WebP.

(b) Encoders bundled inside the Extension: for AVIF (WebAssembly) and TIFF (JavaScript). These are loaded on demand the first time you pick one of those formats.

3. Data we process

3.1. Locally (on your device):

• Image files you select for conversion. They are held in memory for the conversion and are never transmitted.
• Your settings (default output format, quality, name strategy, resize options): stored in your browser's chrome.storage.local. These never leave your device.
• Your Pro licence data, stored in chrome.storage.local under these keys: sovrest:key (licence key), sovrest:jwt (signed licence token), sovrest:refresh (refresh token), sovrest:device_id (a random UUID generated at install, not derived from your hardware), sovrest:last_refresh (timestamp) and sovrest:license_meta (cached licence details: plan, edition, licence end date, activation count, last check time).

This data lets the Extension verify your Pro licence offline using a public-key signature (RS256 / RSA-2048) and keep working for up to 14 days without a network connection.

3.2. Sent over the network: ONLY for licensing, and only if you use a Pro licence:

• To https://sovrest.com/api/licenses, when you activate, refresh or deactivate a Pro licence: your licence key, your device ID, the refresh token, and a header identifying which Sovrest extension is asking (X-App-Id), and a short label naming this browser and operating system (for example "Chrome · Windows") so you can tell your devices apart when freeing an activation slot. The label is built from the browser and platform only: it is not a device fingerprint.

Nothing else is ever sent. No images, no filenames, no file contents, no settings.

If you never activate a Pro licence, the Extension makes no network requests at all.

3.3. We do NOT use cookies, analytics, ad networks, or tracking pixels. The Extension contains no third-party SDKs.

4. Permissions we request and why

• storage: to save your settings and your licence locally.

That is the only permission the Extension requests. It asks for no host permissions, so it has no standing access to the pages you visit. It does not request the "downloads" permission either: converted files are saved through an ordinary download link, the same way any web page offers you a file.

5. Third parties

• Sovrest License System (https://sovrest.com): when you activate a Pro licence, the Extension communicates with Sovrest's licence servers to verify your key. See https://sovrest.com/pages/privacy for Sovrest's general policy.
• No other third-party services. No advertising networks. No analytics platforms.

6. Data retention

• Your settings and licence data remain in your browser until you uninstall the Extension or clear browser data.
• Sovrest's licence system keeps a record of your licence activations (licence key, device ID and activation timestamps) for as long as the licence exists: this is what enforces the device limit.
• We hold no images. There is nothing to retain, because nothing is uploaded.

7. Your rights

You can at any time:

• Delete the Extension: this removes all locally stored data including your licence.
• Deactivate your Pro licence inside the Extension: frees up a device slot.
• Request deletion of your licence activation records: write to info@sovrest.com. Note that Sovrest holds no images and no file data of yours; the only record is the licence activation itself.

8. Children

The Extension is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to this Policy

We may update this Policy. The "Last updated" date at the top reflects the latest revision. Material changes will be announced inside the Extension and on https://sovrest.com.

10. Contact

Questions or complaints:

email: info@sovrest.com
telegram: https://t.me/sovrest_official

Operator, lawful basis and rights — edition 3.0

Published: October 2, 2026. Operator: Individual Entrepreneur Kalendzhyan Artur Eduardovich (SOVREST), INN 235503700740, OGRNIP 326237500273341. Privacy contact: info@sovrest.com. Site-wide Privacy Policy and Terms.

This section supersedes earlier general wording on consent, response deadlines and operator identity in this policy. Installation, browsing or continued use alone is not personal-data consent. Processing necessary for the requested function/licence has a contractual basis; required consent is a separate affirmative action. Advertising and optional analytics require separate consent.

Processing-information requests: 10 working days, extendable by 5 working days with a reasoned notice. Confirmed inaccuracies are corrected, and confirmed unlawfully obtained/unnecessary data destroyed, within 7 working days. Unlawful processing stops within 3 working days; where it cannot be made lawful, destruction follows within 10 working days. Consent withdrawal or purpose completion: stop processing/destroy within 30 days unless another lawful basis applies. Stop-processing requests: 10 working days, extendable by 5 working days with a reasoned notice and statutory exceptions (Art. 20–21 of 152-FZ).

Mandatory settlement records are kept for applicable tax deadlines to the necessary extent; key delivery does not justify indefinite retention of all user data. Core-infrastructure backups have restricted access and rotation up to 190 days; recorded erasure requests are reapplied after restoration. See Privacy Policy, §5 and §9.

Where a function described above sends text/audio to OpenRouter, Groq, Alibaba Cloud/Qwen or the selected model provider, personal data in the content may be transferred across borders. Before enabling a route, identify its recipient, countries, lawful basis and safeguards and comply with Art. 12. User consent and policy publication do not replace a separate Roskomnadzor notification. External zero-retention promises apply only with a confirmed contract and route settings. Do not send special-category, biometric or third-party data without a lawful basis.