ConvertUnlimited Trust Center

What this Trust Center covers

This section documents the technical trust model behind ConvertUnlimited. It separates public-site behavior from privacy-build behavior and avoids broad claims that cannot be verified from the page itself.

The main trust boundary is the browser tab. Supported tools use browser APIs, local JavaScript, Canvas, Web Crypto, and vendored client-side libraries to process selected files without a server-side upload endpoint for those processing flows.

Every page in this section summarizes source files that are part of the repository, not marketing copy written separately from the code: scripts/build-privacy.js (the generator that produces the privacy build), scripts/audit-privacy-build.js (the static third-party audit), tests/no-network-processing.js (the runtime network test), and the policy documents THIRD_PARTIES.md, THREAT_MODEL.md, and SECURITY.md. Where a page states a version number, a header value, or a file limit, that value is taken from one of these files.

Two builds, one codebase

convertunlimited.com is the public, ad-supported site. Every page loads a Google Tag Manager container (GTM-KQHC5ZGV) and, on the homepage, an AdSense loader script. privacy.convertunlimited.com is a generated artifact, deployed as the Cloudflare Worker convertunlimited-privacy with its assets served from dist/privacy-build/, as declared in wrangler.jsonc.

The privacy build is not a separately hand-maintained codebase. Running npm run build:privacy copies the repository into dist/privacy-build/ (skipping scripts, tests, docs, and a short list of other paths) and rewrites the copied HTML, JavaScript, and CSS files in place before the artifact is deployed.

What gets checked, and how

• Content Security Policy: The privacy build's HTML and a generated _headers file both carry a 13-directive CSP, including connect-src 'none'. See Security architecture for the exact string.
• Static audit: scripts/audit-privacy-build.js scans every .html, .js, .css, .json, .xml, and .txt file under dist/privacy-build/, skipping the vendor/ directory, against a list of disallowed hostnames and phrases.
• Runtime test: tests/no-network-processing.js serves the built artifact from a local HTTP server, patches fetch, XMLHttpRequest, and sendBeacon to throw if called, and exercises three representative tool flows in headless Chrome.
• Threat model: THREAT_MODEL.md scopes these claims to dist/privacy-build/ and lists explicit non-goals, including a compromised browser, OS, or malicious extension.

By the numbers

• 5: runtime libraries vendored same-origin in the privacy build: JSZip, pdf-lib, jsPDF, PDF.js, and heic2any.
• 13: directives in the privacy build's Content Security Policy, applied both as an HTML meta tag and as an HTTP header.
• 3: representative tool flows exercised by the automated network test: the homepage image converter, the metadata remover, and the background remover.
• 1: codebase generating both builds; the privacy build is produced by copying and rewriting this repository, not by maintaining a second one.

Where to start

• Local processing
  Which browser APIs each tool family uses, per LOCAL_PROCESSING.md, and a worked example from the background-remover source.
• Privacy build
  How scripts/build-privacy.js generates dist/privacy-build/, and what it rewrites in the HTML, JS, and CSS.
• Verification
  Exact DevTools steps, the requests to expect on each build, and what the automated network test asserts.
• Limitations
  Real numbers: decode memory, PDF size guidance, a hard character-count guard, and the AI background-removal model download.

FAQ

Is the public site the privacy-reviewed build?

Does every workflow run without upload?

No. Trust claims are scoped to supported local-processing flows. Pages should state when browser support or device limits apply.

How can I verify the behavior?

Use the verification guide, browser DevTools Network panel, and the repository privacy tests before processing sensitive files.

What exactly does the privacy build remove?

Google Tag Manager, the AdSense loader, Google Fonts, and CDN-hosted runtime libraries. The five runtime libraries used by the tools are replaced with same-origin files under /vendor/ instead of being dropped. See Third parties for the full list.

Who maintains this Trust Center?

It is generated from scripts/data/trust-pages.js in the same repository as the tools, so it can drift out of date if the build changes without the data being updated. Each page's review note states the last review date.

Where is the source code?

https://github.com/dunkin-novice/convertunlimited.com, including the generator scripts, the privacy tests, and the policy documents this Trust Center summarizes.