What the privacy build changes

How the build is generated

It then rewrites every copied .html file through a function named stripThirdPartyRuntime, every .js file through rewriteJs, and every .css file through rewriteCss, before writing a Content-Security-Policy meta tag (when one is not already present) and a separate _headers file for the hosting platform.

Removed from the privacy build

• Ads: Ad provider scripts and ad slot scaffolding are removed from the generated privacy artifact.
• Analytics: Google Tag Manager, the noscript GTM iframe, the site-measurement loader it can inject, and analytics-events.js are stripped or excluded from the copy.
• Remote runtime assets: The Google Fonts preconnect links and stylesheet link are removed; no vendored font file replaces them.
• Third-party script policy: The privacy build is audited by scripts/audit-privacy-build.js for known third-party runtime script references before it is treated as reviewable.

Runtime library substitution

• JSZip 3.10.1: cdnjs.cloudflare.com in the public build; /vendor/jszip-3.10.1.min.js in the privacy build.
• pdf-lib 1.17.1: unpkg.com in the public build; /vendor/pdf-lib-1.17.1.min.js in the privacy build.
• jsPDF 2.5.1: cdnjs.cloudflare.com in the public build; /vendor/jspdf-2.5.1.umd.min.js in the privacy build.
• PDF.js 3.4.120 and its worker: cdnjs.cloudflare.com in the public build; /vendor/pdfjs-3.4.120.min.js and /vendor/pdfjs-3.4.120.worker.min.js in the privacy build.
• heic2any 0.0.4: cdn.jsdelivr.net in the public build; /vendor/heic2any-0.0.4.min.js in the privacy build.

JavaScript behavior changes

The background-remover tool's optional AI Deep Cutout mode normally loads @imgly/background-removal from jsDelivr. In the privacy build, that load is replaced with code that rejects the operation and throws an explicit error stating that AI background removal is not available in the privacy build, rather than silently failing or falling back to a hidden network call.

The AdSense <ins> initialization script is also removed from the copied JavaScript, in addition to the ad-loader script tag being stripped from the HTML.

What stays the same

The tools remain static browser pages built from the same HTML and JavaScript as the public site, with third-party pieces substituted. They still rely on the user's browser, CPU, memory, and supported APIs for decoding, encoding, and rendering. The privacy build does not add server-side conversion, account storage, or a stronger device sandbox; output correctness still depends on the same browser encoders as the public build.

Because the privacy build is generated from the same source tree rather than maintained separately, a change to a tool's HTML or JavaScript on the public site is reflected the next time dist/privacy-build/ is regenerated with npm run build:privacy; there is no separate privacy-build fork of the tool code to keep in sync by hand.

Deployment boundary

privacy.convertunlimited.com is deployed separately from the ad-supported public site, as its own Cloudflare Worker (convertunlimited-privacy) with dist/privacy-build/ bound as its assets directory, per wrangler.jsonc.

FAQ

Should I use the privacy build for sensitive files?

Yes, when the workflow is supported and browser/device limits are acceptable.

Does the privacy build include ads?

No. The generated privacy artifact removes ad scripts and ad scaffold DOM.

Does the privacy build send analytics events?

No. Tracking helpers are stripped or rewritten to no-ops in the privacy artifact.

Does the privacy build include the AI Deep Cutout background-removal mode?

No. That code path is replaced with an explicit thrown error rather than a silent fallback.

Is the privacy build a different codebase?

No. It is generated from the same repository by scripts/build-privacy.js, which copies and rewrites files rather than maintaining a parallel set of pages.

Does the staging workers.dev URL get indexed?

It should not. workers/privacy-worker.js adds a noindex header and meta tag specifically when the hostname ends in .workers.dev.