Skip to main content
Video Mender

Privacy

Your video is never uploaded

Most tools that say this are asking you to trust a policy. Video Mender is built so that uploading is not possible, and this page explains the difference.

What is collected

Nothing about your files. No video, no audio, no filename, no thumbnail, no duration, no format, no size — not even the fact that you opened one. No account, no email address, no cookie and no fingerprint. The site sets no cookies of any kind.

One thing is measured, and it is worth stating plainly rather than burying: anonymous page views. Which page was viewed, roughly where in the world from, and what kind of device — the same information any web server writes to a log. It is cookieless, it does not identify you, and it is described in full below.

Why uploading is structurally impossible here

  • No endpoint exists. The application has no /api route, no server action and no server-side media handling of any kind. There is nowhere to send a file, so no bug or misconfiguration can start sending one.
  • The browser is instructed to refuse. A Content-Security-Policy header sets connect-src 'self', so the page is not permitted to open a network connection to any other origin. A third-party request would be blocked by the browser before it left your machine.
  • The engine is self-hosted. The FFmpeg WebAssembly build is served from this domain at a version-stamped path, not fetched from a CDN. No third party learns that you used the tool, let alone what you converted.
  • Nothing persists. Files live in tab memory for as long as the tab is open. Close it and both your inputs and any results you have not downloaded are gone.

The one thing that is measured

Page-view analytics runs through Vercel Analytics, and it is constrained in three ways that matter for a tool like this one.

  • Same origin. Measurements are sent to /_vercel/insights/ on this domain, not to a third-party analytics host. That is why the Content-Security-Policy can still forbid every other origin outright.
  • Page views only. The application defines no custom events and never calls the tracking function. A wrapper drops any event that is not a page view, so adding one later fails closed rather than quietly shipping data.
  • No query strings. Only the path is reported; query strings and fragments are stripped before anything is sent. No filename could reach it even in principle, because nothing about your files is ever put in the URL.

It is cookieless and stores nothing on your device. If you block analytics, every feature of this site still works — the measurement is entirely separate from the conversion engine.

How it is verified

The repository contains tests that fail the build if this ever stops being true, which is the part that matters — a promise nobody checks decays.

  • A source scan asserts no /api directory, no 'use server' directive and no upload-shaped call anywhere in the application code.
  • A runtime test replaces fetch, XMLHttpRequest, navigator.sendBeacon and WebSocket with recorders, drives the real workspace with a real video file, and asserts that no request is made at all and that no request body ever contains media bytes.
  • A further test asserts the analytics wrapper drops non-page-view events and strips query strings, so the measurement described above cannot widen without failing.
  • A configuration test asserts the Content-Security-Policy still restricts connect-src to this origin.

What this costs you

Being straightforward about the trade-off: because there is no server, your device does the work. Re-encoding a long or high-resolution video takes real time and real memory, and a phone is slower than a laptop. There is also no job to come back to — closing the tab ends everything, so download your results before you leave.

See the tested limits for what that means in practice.