Privacy Policy

When you upload a video or image, it is sent to our server, converted with FFmpeg, and made available to you through a private, unguessable link. We don't open, inspect, or share your files.

Free and anonymous conversions are deleted automatically within about an hour. Pro accounts keep their conversions in a permanent library until you delete them. You can delete any conversion yourself at any time.

We never add a watermark and never reuse your files for anything.

An account is optional (and required only if you buy Pro). A paid Pro plan adds a permanent library, reusable presets, and batch conversion. If you create an account, we store your name, your email address, and a securely hashed password — we never store your password in plain text.

If you turn on two-factor authentication or a passkey, we store only the data needed to verify it. You can delete your account and everything tied to it at any time from Settings.

To keep the service running and to prevent abuse, our server processes your IP address. We do not store your raw IP address next to your conversions — it is one-way hashed, so it can enforce rate limits without being reversible back to you.

Standard web-server logs (such as request time, path, status code, and browser user agent) may be kept briefly for security and debugging.

We use privacy-friendly, cookieless analytics to understand overall traffic — aggregate page views and referrers. It does not set cookies, does not fingerprint you, and does not build a profile of individual visitors.

If you sign in, we set a single essential cookie to keep you logged in. We do not use advertising or third-party tracking cookies, and browsing anonymously sets no tracking cookies at all.

LightBox runs on a dedicated server and sits behind Cloudflare, which provides our CDN, HTTPS, and bot and abuse protection. Payments for Pro are handled by Paddle, our payment provider and merchant of record — they process your billing details, and we never see or store your full card number. These providers process requests on our behalf under their own privacy and security commitments. We don't sell or rent your data to anyone.

All traffic is served over HTTPS. Passwords are hashed, your media is processed in an isolated workspace, and each conversion is reachable only through an unguessable link. No system is perfectly secure, but we keep the data we hold minimal, so there is little to expose.

LightBox is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us information, contact us and we will remove it.

You can use LightBox without an account, delete any conversion at any time, and delete your account and its data from Settings. Depending on where you live, you may have the right to access, correct, or erase your personal data — reach out and we will help.

We may update this policy as the service evolves. We will change the date at the top when we do, and we will highlight any significant changes on the site.