Retention

File lifetimes

Tier	Inputs	Outputs
Free	24 hours	24 hours
Pro	7 days	7 days

Files auto-delete when their expires_at timestamp passes. Two mechanisms enforce this:

1. API cleanup cron — runs every 15 minutes, deletes expired MinIO objects and their database rows, and writes an audit log entry (actor_type: 'system'). Because it runs on an interval, a file can linger for a few minutes past its expires_at before it's actually removed — the Files page hides files once they're past expiry regardless.
2. MinIO bucket lifecycle — set up on the object store itself by the operator as a safety net. Even if the cron fails, the object store removes expired files.

You can always delete a file manually before it expires — from the Files page in the web app or via DELETE /v1/files/{id} in the API. Because each account has a total-storage cap, deleting files you're done with also frees room to upload and convert more.

What "deleted" means

• The MinIO object is purged immediately (no soft-delete, no trash).
• The database row is hard-deleted.
• There is no undo.

Metadata stripping

By default, every conversion strips output metadata:

Worker	What gets stripped
Image (sharp)	EXIF, XMP, IPTC, color profiles not needed for the target format
Audio (ffmpeg)	ID3 tags, Vorbis comments, chapter markers (-map_metadata -1)
Video (ffmpeg)	Stream metadata, chapters, container tags (-map_metadata -1 -map_chapters -1)
Document (LibreOffice/pandoc)	Engine-dependent — some document properties (author, dates) may carry through; not separately stripped
Archive (7z/tar)	Archives have no metadata layer to strip — pass-through

Pro users can opt in to metadata preservation per-conversion (or globally in Settings). This applies to image, audio, and video conversions — when enabled, the worker skips the strip step and passes the source's metadata through where the target format supports it. Document and archive outputs follow the conversion engine's own defaults.

Not all formats carry metadata

Enabling "Preserve metadata" on a PNG → JPG conversion keeps EXIF, but enabling it on a TXT → PDF conversion has no effect — plain text has no metadata to preserve.

Quarantined files

If ClamAV flags an upload as infected during finalization:

• The uploaded object is deleted immediately.
• The file row is marked kind = 'quarantined'.
• The conversion is set to status = 'failed' with error_code = 'malware'.
• An audit log entry is written.
• The user sees a "Malware detected" error in the UI or a 422 in the API.

Quarantined rows are cleaned up by the same cleanup cron alongside expired files.

Privacy

• Files are stored on encrypted ZFS-backed MinIO volumes.
• Object keys are scoped per user — one user cannot reference another's file ID.
• Account data is limited to your email and display name; conversions also store basic request data (IP, user agent) for security and audit logging.
• See Data handling for the full privacy breakdown.