Keep files private: local processing & the validation gate

Start with the claim itself, stated precisely. For every conversion currently exposed in the Novus Convert interface, the work runs on your device in browser memory. Supported source files are not sent to a remote conversion service, and that includes the tricky ones: HEIC and HEIF images from an iPhone decode through a local component inside the page rather than on a server. When people say Novus Convert is private, this is the concrete thing they mean — the bytes of your file are read and transformed in the browser tab in front of you.

It is just as important to know what private does not mean, because a vague promise is worse than an honest boundary. It does not mean the result is encrypted, and it does not mean the app keeps a private copy for you. If anything the opposite is true: results are temporary and are discarded the moment you remove a job or close the page. Private here is a statement about where processing happens, not a claim that the app is a secure vault or a backup service.

There is also a quieter privacy property in how the app is scoped. The format directory is broader than the working converter, and the pages for video, office documents, ebooks, CAD, and fonts are reference guides rather than tools. Where there is no active converter there is no upload control, and therefore nothing to process at all. An upload and output control appears only on routes where the current release can build and validate a real result.

The clearest way to trust the privacy model is to watch it work, and HEIC is the best test case. Open convert.novusstreamsolutions.com/convert and drop in a photo straight from an iPhone. HEIC and HEIF rows decode through a lazy-loaded local WebAssembly worker: the app pulls in a small decoding component the first time it needs one, runs it inside your browser, and turns the photo into whatever raster output you choose. At no point is the photo uploaded.

This matters because browsers cannot natively open HEIC the way they open JPG or PNG. A lot of online converters solve that by sending the file to a server that has the right software installed. Novus Convert solves it by bringing the decoder to the file instead of the file to a decoder, which is what keeps a camera roll on the device while still producing a shareable JPG or WebP.

If you want proof rather than a promise, open your browser developer tools, switch to the network panel, and run a conversion. You will see the page load its own assets, but you will not see your image being sent anywhere. That is the whole point of doing the work locally — the evidence is right there in the network log.

A filename extension is only a label, and labels can be wrong or dishonest. Novus Convert reads the file signature — the actual bytes at the start of the file that identify its true type — rather than trusting the extension. The compatible outputs you see for a row come from what the file really is, so a screenshot that was renamed from .png to .jpg is handled as the PNG it actually is.

This is a privacy and safety property as much as a convenience. Because the app inspects the real content, a mislabeled or malformed file is caught at the door instead of being pushed through to produce a broken or misleading result. Structured text is parsed as data rather than renamed, and archives are treated as untrusted input from the start. Every part of that determination is made on your device, on the real file, before any output is built.

Here is the feature that sets the tone for the whole app. After a row finishes processing, and before any download button appears, the result has to pass a validation gate. The finished file must match its expected signature, container, or decodability: an image has to decode as a real image in that format, an archive has to confirm its true container, structured data has to be well-formed. Only when the output passes does the download control unlock.

The consequence is deliberate and worth stating plainly: a file can fail after it has processed. That can feel surprising, but it is the safe behavior. The alternative — handing you a file that merely carries the right extension — is exactly how people end up with downloads that will not open in the app they were meant for. Novus Convert would rather show a failure than offer a result it cannot stand behind. Fixing those failures is its own topic, covered in the troubleshooting guide; here the point is simply why the gate exists.

One honest caveat: passing the gate proves the file is structurally real, not that it looks right. Structural validity and visual quality are two different judgments, and the second one is yours. When a download does unlock, still open the result and check it before you rely on it. Throughout all of this the original file on your disk is never changed, whether the conversion passes or fails.

Every result you produce is held in browser memory behind a temporary object URL that belongs to the current session. It is a pointer to data that lives only in the page. The moment you remove that job from the queue or close the tab, the URL is revoked and the data behind it is released. There is no server-side copy waiting to be retrieved later.

This is the same privacy promise viewed from the other side, and it comes with a practical duty. Because nothing is stored for you — no history, no cloud folder, no way to reopen a session from yesterday — you have to save what you need before you leave. Download the results you want to keep, confirm they landed in your downloads folder, and only then close the page. Treat an open Novus Convert tab as work in progress, not as storage.

Because everything runs in your browser, the limits exist to protect the memory of your own device rather than a server. Active image routes accept files up to 100 MB and 80 megapixels each. Text and structured-data routes accept up to 25 MB. Archive routes accept compressed inputs up to 200 MB, with no more than 5,000 entries and no more than 512 MB of expanded data, and they reject path traversal and archive bombs before unpacking.

There are also daily download allowances, tracked per input format in your browser and reset by your local calendar day. The current defaults are 15 downloads for HEIC or HEIF, 20 for AVIF, 10 for archives, 50 for structured text, and 25 for other active formats. The remaining count sits right beside the download control, so you always know where you stand. The app is free, but free is not the same as unlimited, and the allowances keep local use reasonable.

When you want the canonical version of any of this rather than a tutorial summary, go to the source pages. The /security page states the privacy and validation model in plain language, and the Help centre page lists the current operational limits and how to report a problem. Those pages are the living reference; this guide is the walkthrough that shows you what they describe actually happening.