# Privacy & Data Retention

_Last updated: 2026-06-18_

Forma Converter is a file-conversion tool. This notice describes what happens to
files you upload. It reflects how the software behaves by default; an operator
running their own instance can change these settings.

## What we process

When you upload a file, the server:

1. Receives the file into memory and writes it to a temporary working directory.
2. Converts it to the format you selected.
3. Makes the result available to you for download and preview.

## Retention

- Uploaded files and their converted results are stored **only transiently**, in
  a temporary directory, and are **automatically deleted** after a fixed
  time-to-live (default: **1 hour**; configurable by the operator via
  `RESULT_TTL_MIN`).
- A background sweep also evicts the oldest results when configured count or disk
  limits are reached.
- Nothing is moved to permanent storage, and files are not shared with any third
  party as part of the conversion.

## What we log

The server records **operational metadata only** — for example: the conversion
type (e.g. `pdf->idml`), processing time, output size, and counts of rate-limited
or rejected requests. Logs do **not** include file contents and do not include
your original filename beyond, at most, its extension.

If the operator deploys behind a reverse proxy or hosting provider, that provider
may keep its own access logs (e.g. IP addresses) outside the scope of this notice.

## Security

Uploads are validated and processed in an isolated, time-limited sandbox. See
`DEPLOYMENT-PLAN.md` for the security model. No system is perfectly secure; do
not upload material you are not authorized to share.

## Contact

For privacy questions or to report a concern, contact the operator of this
instance. _(Operators: replace this line with your contact address.)_