1. Who is responsible for your data
The data controller for this website and for purchases of 2anything is:
- George-Bogdan Ivanov, self-employed (autónomo) registered in Spain
- Tax identification number (NIF): available on request by email
- Address: Calle Américo Vespucio 68, 35009 Las Palmas de Gran Canaria, Las Palmas, Spain
- Privacy contact: support@2anything.app (alternative: me@bogs.io)
This policy is written under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD).
2. Your files are not collected
This is the part most people came here for, so it goes first.
2anything performs conversions locally on your machine. Your files, their contents, their names, and their metadata are not transmitted to us, and not transmitted to anyone else. There is no upload step, no cloud processing, and no server-side queue. We could not read your files even if we wanted to, because they never leave your computer.
The app has no analytics and no telemetry. It does not report which conversions you run, how often you use it, or what is on your machine.
The app does make two kinds of network request, and we want to be precise rather than claim more than is true:
- Licence validation. When you activate the app, and periodically afterwards, it sends your licence key to our payment provider to confirm the licence is valid. This transmits the key, not your files.
- Update checks. The app may check whether a newer version is available. This involves your IP address and the current version number, as any download does.
Both can be avoided entirely by using the app offline after activation, apart from the initial activation itself.
3. What we collect, why, and on what legal basis
Website server logs
Data: IP address, browser type and version, requested page,
date and time, referring page.
Why: to deliver pages to your browser, keep the site
available, and detect abuse or attacks.
Legal basis: legitimate interests (Article 6(1)(f) GDPR) in
operating and securing the site.
Retention: short-term, as generated by our hosting provider,
and not used to build profiles.
Analytics
Data: aggregate page views, referring source, approximate
country, device type and browser.
Why: to understand which pages are useful.
Legal basis: legitimate interests (Article 6(1)(f) GDPR) in
understanding site usage.
Retention: aggregate statistics only.
We use Plausible Analytics, which is cookieless, does not track you across sites, does not build persistent identifiers, and stores its data in the EU. This is why the site shows no cookie banner: there is nothing to consent to. We cannot identify an individual visitor from our analytics.
Purchases
Data: your email address, licence key, purchase date,
product, amount, country, and the tax status of the sale. We also see the
last four digits and card type in some receipts.
Why: to deliver the app and your key, provide support, honour
refunds, validate licences, and meet our tax and accounting obligations.
Legal basis: performance of a contract (Article 6(1)(b) GDPR)
for delivery and support; legal obligation (Article 6(1)(c) GDPR) for
accounting and tax records.
Retention: for as long as the licence is active, and in any
case for the period Spanish tax and commercial law requires records to be
kept.
We never receive your full card number, expiry, or security code. Payment is handled entirely by Gumroad. See section 4.
Support email
Data: your email address and whatever you choose to tell us
in your message.
Why: to answer you.
Legal basis: performance of a contract (Article 6(1)(b)) for
purchase-related support, otherwise legitimate interests (Article 6(1)(f)) in
responding to enquiries.
Retention: kept while the matter is open and for a
reasonable period afterwards for reference, then deleted.
Please do not email us sensitive personal data, and do not send us the files you are trying to convert unless we specifically ask and you are comfortable doing so.
4. Who your data is shared with
We do not sell your data. We do not share it with advertisers or data brokers. There are no ad networks or marketing trackers on this site.
The parties involved in running this business are:
- Gumroad — payments and licence delivery. Gumroad acts as merchant of record, which means it is the seller of record for your purchase and an independent data controller for the payment data it collects, under its own privacy policy. United States.
- Cloudflare — website hosting and delivery. Processor. United States, with a global edge network.
- Plausible Analytics — aggregate website analytics. Processor. EU-hosted.
- Our email provider — receiving and sending support email. Processor.
- Our accountant and the Spanish tax authorities — where required for accounting and tax compliance.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
5. International transfers
Plausible stores analytics data in the EU. Cloudflare and Gumroad are based in the United States, so some data is transferred outside the European Economic Area. Those transfers rely on the safeguards permitted under Chapter V of the GDPR — the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
6. Cookies
This site sets no cookies for analytics, advertising, or cross-site tracking, and shows no cookie banner because none is required.
Gumroad's checkout, which is hosted on Gumroad's own domain, does use cookies necessary for processing your payment. Those are governed by Gumroad's cookie and privacy policies, not ours.
7. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you;
- Rectification — have inaccurate data corrected;
- Erasure — have your data deleted, where we have no overriding legal obligation to keep it (tax records being the main exception);
- Restriction — ask us to limit how we use your data;
- Portability — receive your data in a portable format;
- Object — object to processing based on legitimate interests;
- Withdraw consent — where we relied on consent, withdraw it at any time.
To exercise any of these, email support@2anything.app. We will respond within one month, as the GDPR requires. There is no charge. We may need to confirm your identity first — usually by verifying the email address associated with your purchase.
For payment data held by Gumroad as its own controller, you may need to contact Gumroad directly. We will help you do that if you ask.
8. Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Spanish data protection authority:
Agencia Española de Protección de Datos (AEPD) — C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es
If you live in another EU or EEA country, you may complain to your own national supervisory authority instead.
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you.
10. Children
This product is not directed at children. We do not knowingly collect personal data from anyone under 14, the age of digital consent in Spain. If you believe a child has provided us data, email us and we will delete it.
11. Security
We keep the data we hold to a minimum, which is the most effective protection available. The site is served over HTTPS. Payment data is handled by Gumroad under its own security obligations and never reaches our systems.
12. Changes to this policy
If this policy changes, the updated version is published on this page with a new version number and effective date. If a change materially affects how we use data about existing customers, we will notify them by email.