The privacy build is a generated deployment artifact for privacy-sensitive workflows and privacy review. It removes ads, analytics, remote fonts, Google services, Cloudflare Insights, and third-party runtime scripts from the app artifact.
Short answer
Use privacy.convertunlimited.com when you want the tracker-free ConvertUnlimited build. The public site remains ad-supported and is not the review target for no-ads/no-analytics claims.
Build boundary
The public site may load ads and analytics. The privacy build at privacy.convertunlimited.com is the no-ads, no-analytics review target.
Verification path
Use the verification page, browser DevTools, and repository privacy tests to inspect the behavior instead of relying on marketing language.
How the build is generated
scripts/build-privacy.js copies the repository into dist/privacy-build/, skipping .git, .github, dist, docs, scripts, tests, workers, ads.txt, CNAME, analytics-events.js, package.json, package-lock.json, wrangler.jsonc, and any .zip or .md file.
It then rewrites every copied .html file through a function named stripThirdPartyRuntime, every .js file through rewriteJs, and every .css file through rewriteCss, before writing a Content-Security-Policy meta tag (when one is not already present) and a separate _headers file for the hosting platform.
Removed from the privacy build
Ads: Ad provider scripts and ad slot scaffolding are removed from the generated privacy artifact.
Analytics: Google Tag Manager, the noscript GTM iframe, the site-measurement loader it can inject, and analytics-events.js are stripped or excluded from the copy.
Remote runtime assets: The Google Fonts preconnect links and stylesheet link are removed; no vendored font file replaces them.
Third-party script policy: The privacy build is audited by scripts/audit-privacy-build.js for known third-party runtime script references before it is treated as reviewable.
Runtime library substitution
JSZip 3.10.1: cdnjs.cloudflare.com in the public build; /vendor/jszip-3.10.1.min.js in the privacy build.
pdf-lib 1.17.1: unpkg.com in the public build; /vendor/pdf-lib-1.17.1.min.js in the privacy build.
jsPDF 2.5.1: cdnjs.cloudflare.com in the public build; /vendor/jspdf-2.5.1.umd.min.js in the privacy build.
PDF.js 3.4.120 and its worker: cdnjs.cloudflare.com in the public build; /vendor/pdfjs-3.4.120.min.js and /vendor/pdfjs-3.4.120.worker.min.js in the privacy build.
heic2any 0.0.4: cdn.jsdelivr.net in the public build; /vendor/heic2any-0.0.4.min.js in the privacy build.
JavaScript behavior changes
The generator's rewriteJs step replaces the shared track() analytics helper with a no-op function, so tool code that calls it does not throw, it simply records nothing.
The background-remover tool's optional AI Deep Cutout mode normally loads @imgly/background-removal from jsDelivr. In the privacy build, that load is replaced with code that rejects the operation and throws an explicit error stating that AI background removal is not available in the privacy build, rather than silently failing or falling back to a hidden network call.
The AdSense <ins> initialization script is also removed from the copied JavaScript, in addition to the ad-loader script tag being stripped from the HTML.
What stays the same
The tools remain static browser pages built from the same HTML and JavaScript as the public site, with third-party pieces substituted. They still rely on the user's browser, CPU, memory, and supported APIs for decoding, encoding, and rendering. The privacy build does not add server-side conversion, account storage, or a stronger device sandbox; output correctness still depends on the same browser encoders as the public build.
Because the privacy build is generated from the same source tree rather than maintained separately, a change to a tool's HTML or JavaScript on the public site is reflected the next time dist/privacy-build/ is regenerated with npm run build:privacy; there is no separate privacy-build fork of the tool code to keep in sync by hand.
Deployment boundary
privacy.convertunlimited.com is deployed separately from the ad-supported public site, as its own Cloudflare Worker (convertunlimited-privacy) with dist/privacy-build/ bound as its assets directory, per wrangler.jsonc.
The Worker script, workers/privacy-worker.js, adds an X-Robots-Tag: noindex, nofollow, noarchive header and injects a matching <meta name="robots"> tag only when the request hostname ends in .workers.dev; it leaves responses on privacy.convertunlimited.com unmodified. Cloudflare Web Analytics, Zaraz, Rocket Loader, email obfuscation, and other runtime script injections must remain disabled for the privacy hostname at the platform level, since none of those are controlled by this repository.
Should I use the privacy build for sensitive files?
Yes, when the workflow is supported and browser/device limits are acceptable.
Does the privacy build include ads?
No. The generated privacy artifact removes ad scripts and ad scaffold DOM.
Does the privacy build send analytics events?
No. Tracking helpers are stripped or rewritten to no-ops in the privacy artifact.
Does the privacy build include the AI Deep Cutout background-removal mode?
No. That code path is replaced with an explicit thrown error rather than a silent fallback.
Is the privacy build a different codebase?
No. It is generated from the same repository by scripts/build-privacy.js, which copies and rewrites files rather than maintaining a parallel set of pages.
Does the staging workers.dev URL get indexed?
It should not. workers/privacy-worker.js adds a noindex header and meta tag specifically when the hostname ends in .workers.dev.
Review note
Trust documentation reviewed: May 2026. These pages describe the current public and privacy-build architecture and should be updated when deployment, telemetry, or runtime dependencies change.