Privacy

Acceptable converts your files on your device. It collects nothing.

This is the privacy policy of Acceptable, the browser extension, whichever browser you install it in. Where one browser differs from the others, it says so.

Your files

When you drop a file into a web form, Acceptable reads it to find out its real format. If the site expects another format, Acceptable converts the file and hands the result to the page, in place of the original.

Acceptable only takes up a file you pick or drop yourself. A file that a script of the page puts in one of its inputs, or drops, is left to the page as it is. In Firefox, a page can put a file of its own in something you drag on that page: when you drop it, Acceptable takes up that file as one you dropped.

All of this happens on your device, in your browser. Your files are never sent to a server: Acceptable has none.

A site often writes near a file field the heaviest file it takes, as "Max. file size: 1 MB". To find it, Acceptable reads the words near the field you give a file to, and near the place you drop it on: what the field and that place say of themselves, a label, and the text of the few parts of the page around them, stopping at one that holds more than 1,500 characters. It reads them on your device, when you give the field a file. It hands 1,500 characters of them at most to the part of Acceptable that reads the limit, and keeps them nowhere. When a photo weighs more than the site takes, Acceptable makes it lighter before the site sees it, and the notice says so.

Some files point at things on the web, or hold scripts, as an SVG can. Acceptable converts them without fetching what they point at and without running what they hold.

The only place a file goes is the site you chose to give it to.

A site can tell Acceptable is there, whether you give it a file or not. As its page opens, Acceptable widens what its file inputs accept, and when Acceptable takes up a file, it puts frames of its own in the page, the notice among them. In Chrome, Edge, Opera and Brave, a page can also ask for those frames itself. None of it tells the site who you are.

A converted file is not the original under another name: it holds what its format holds, as Acceptable writes it. A photo made lighter for a site keeps the way up it was taken, and every pixel unless its quality alone cannot make it light enough: it is then drawn smaller, and the notice says its size. It loses what the camera wrote of it, such as where it was taken. The MP4 made of a video keeps its title, the name it gives as its author, its comment, its album, its genre, its description and the day it says it was taken. It no longer says where a phone wrote it was taken, at what hour, with what device or with what program. It says which library wrote it, and when. Its pictures and its sound are moved as they were coded, with what the program that coded them wrote inside them, which is often its own name. A video that was cut without being coded again still holds a little of what comes before the cut and after it, hidden: the MP4 holds it too, and hides it as the video did.

An audio file that becomes another format of audio keeps what it says of itself where that format can hold it: its title, its artist, its album, its genre, its comment and its date among it, and the picture of its album. A WAV holds no picture, no lyrics and no description. What a program wrote in the file for itself is left behind, and so is where a phone wrote it was recorded. Its sound is decoded and coded again, by the browser or by an encoder that ships with Acceptable. An M4A then says which library wrote it, and when; an OGG and a FLAC say which library wrote them, and its version; an MP3 says that LAME coded it.

What Acceptable collects

Nothing.

No telemetry, no analytics, no crash reports.
No account, no identifier, no cookie.
No network request of its own: Acceptable never contacts a server, ours or anyone else's.

This is a design decision, recorded in ADR 0006, not a default that a future version could quietly change.

Acceptable uses what it handles, your files, the words near a field and what it stores, only to convert the files you give pages, and shares it with nobody. That use adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

What Acceptable stores

Three things, in the extension's own storage, in your browser. None of them leaves your device, and uninstalling the extension deletes them all.

The sites you turned Acceptable off for: their names, and nothing else.
The largest file you let Acceptable convert: one size, once you have chosen one on its options page. Until then nothing is written, and the limit is 25 MB.
A history of what Acceptable converted: which format became which, on which site, when, and whether the conversion lost something. Never the file, and never its name. It shows the last 100 conversions, and none that is more than 30 days old: an older one is erased the next time Acceptable converts a file or you open the popup. You can clear the history from the popup at any time.

The history is kept where no web page can read it, not even the part of Acceptable that runs inside the pages you visit.

The sites you turned Acceptable off for are kept where that part of Acceptable can read them, so that it knows at once, on a page, whether to stay out of it. It reads whether its own site is one of them, and no other. Web pages cannot read that storage, but a page that had broken into that part of Acceptable could read the whole list, and change it.

Private windows

What Acceptable does in private windows depends on your browser.

In Chrome, Edge, Opera and Brave, Acceptable stays out of private windows unless you let it in, from your browser's page of extensions.

If you do, it converts your files there as anywhere, and writes nothing of it on your device. What it does in a private window is kept in memory, apart from what it does in your other windows, and forgotten when you close the last private window:

What it converts there, which only the popup of a private window lists.
The sites you turn Acceptable off for, or back on, from a private window. That choice counts in private windows only.

The sites you turned Acceptable off for in your other windows are off in private windows as well, until you choose otherwise there.

The largest file Acceptable converts is one setting for all your windows. Chosen from a private window, it is written on your device as from any other: it is a size, and says nothing of what you did there.

This was checked in Chromium, the engine of Chrome, Edge, Opera and Brave.

In Firefox, Acceptable does nothing in private windows, and cannot be let into them.

Why Acceptable asks to run on every site

File inputs and drop zones can be on any page, so the extension needs permission to run on all of them. On a page, it only looks at file inputs and drop zones: which formats they accept, the files you give them, and the words near a field or a drop zone you give a file to, for the heaviest file the site takes. It uses nothing else: not the rest of the page, your browsing history or what you type.

When you install Acceptable, your browser warns that it can "Read and change all your data on all websites", in the words of Chrome, or "Access your data for all websites", in those of Firefox. That warning says what running on every page would allow an extension to do. What Acceptable does there is what this page says.

You can turn Acceptable off for any site from its popup. To know which site that is, the popup asks the part of Acceptable that is already in the page: Acceptable has no permission to read the addresses of your tabs.

If this ever changes

If Acceptable ever offers a conversion that cannot run on your device, it will be opt-in, asked for each file, and impossible to miss. This page would change first.

Questions

Write to [email protected]. The help page says what to put in a message.