Who runs this site
LidarKit is an independent, one-person project rather than a company. The operator is the data controller for the limited processing described below, and can be reached at lidarconverter.contact@gmail.com — for any question about this policy, or to make a data-protection request, which is answered within 30 days.
Your files are never uploaded
This is the part that matters most, so it comes first. The LAS, LAZ, COPC, E57, PLY and GeoTIFF files you open here are never transmitted anywhere. They are not sent to us, because there is nowhere to send them: this site is static files on a CDN with no backend, no database and no upload endpoint.
Your file is read through the browser's own File API and processed by a WebAssembly module running in a Web Worker on your machine. Converted output is written to your browser's origin-private file system, which is storage on your own disk that only this site's code can read and that your browser clears when you clear site data. You can verify all of this yourself: disconnect from the network after the page has loaded and the converter keeps working, or open your browser's network inspector and watch that nothing leaves. See how it works for the mechanism in detail.
Accounts
Most of the site needs no account: opening, viewing, inspecting and processing files, converting between formats, and downloading converted files, DEMs and orthophotos. An account is needed only to download three kinds of result: a classified point cloud, the difference map from a DEM or point-cloud comparison, and images exported from an E57 file. You sign in with your Google account, and that is the only way to sign in.
Sign-in is handled by Firebase Authentication, a Google service. When you sign in, Firebase receives from Google and keeps your name, email address, profile picture link and a Google account identifier, plus the times you signed up and last signed in. That is the whole account: we do not ask for anything else, and nothing about your files, their names or their contents is attached to it, because none of that ever leaves your browser. We do not sell account data or use it for advertising.
Why we process it. We process these account details only because they are needed to provide what you asked for: the download of a result that requires an account. Where the GDPR or a similar law applies, this is processing necessary to perform a contract with you (Article 6(1)(b) GDPR).
Where it is processed. Firebase Authentication is run by Google, acting as our processor under the Firebase Data Processing and Security Terms. Wherever you are, your account data may be processed in the United States and in other countries where Google operates, which may not be the country you live in. Where the law of your country restricts such transfers, for example in the European Economic Area, the United Kingdom or Switzerland, they rely on Google's certification under the EU–US Data Privacy Framework and its UK and Swiss extensions, and on the standard contractual clauses included in Google's terms.
How long it is kept. Your account is kept until you ask us to delete it. To do so, email us from the address the account uses (see Contact below); we delete it within 30 days, and it is then gone from Firebase for good. Signing out only ends the session on your device and does not delete the account.
Analytics
The site uses Cloudflare Web Analytics to count page views. It sets no cookies and stores nothing on your device. It reports aggregate figures only — page, referrer, country, browser — with no way for us to identify an individual visitor. Cloudflare's handling of that data is covered by the Cloudflare privacy policy.
The tools also count a few anonymous product events, so we know which tools people actually use: that a file was opened, that a result was produced, that a download button was pressed, and whether the sign-in prompt was completed or closed. Each event carries only the tool's name, coarse ranges such as "10–100 MB" or "1–10 million points", and the country Cloudflare derives from the connection. It never carries a file name, a coordinate or anything else from inside your file, your IP address, or your account. No cookie is set, nothing is stored on your device, and no events are sent at all if your browser has Do Not Track or Global Privacy Control switched on. The events are stored with Cloudflare (Workers Analytics Engine), under the same Cloudflare privacy policy, and are deleted after three months.
Advertising
This site is free, and the plan for covering its running costs is advertising. Every page except the error page and these policy pages loads Google's advertising script (AdSense). Unlike the rest of the site, that code does involve a third party that can set cookies in your browser, whether or not an ad appears, so the standard Google disclosures apply:
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
- You may opt out of personalised advertising by visiting Google Ads Settings.
- You may opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info/choices or, in Europe, youronlinechoices.eu.
Google's own handling of this data is described in How Google uses information from sites that use its services. To be explicit about where the boundary sits: advertising cookies relate to your browsing, not to your data. The contents of a point cloud or raster you open here are never seen by Google or by any advertiser, because that data never leaves your machine in the first place.
If you are in the EEA, the UK or Switzerland
Consent for Google's advertising cookies is handled by Google's own consent management platform, which is part of its advertising code and is certified under the IAB Transparency and Consent Framework; no personalised advertising is served by Google unless you have agreed to it through that consent message, and you can decline or withdraw consent later through the same control. Declining restricts nothing: every tool on this site behaves identically either way, because none of them depend on advertising or on any cookie.
Fonts
Typefaces load from Google Fonts, so your browser makes a request to fonts.googleapis.com and fonts.gstatic.com that necessarily reveals your IP address to Google, as a request to any server does. Google states it does not use this to build advertising profiles; see the Google Fonts privacy FAQ.
What is stored on your device
| What | Purpose | Cleared by |
|---|---|---|
| Origin-private file system entries | Temporary storage for a conversion's output, so multi-gigabyte results need not fit in memory | Removed when the conversion finishes, and when you clear site data |
| Firebase sign-in session (IndexedDB) | Keeping you signed in between visits, only once you have signed in | Signing out, or clearing site data |
| Google advertising cookies | Ad selection, measurement and frequency capping, subject to your consent choice where consent is required; only set if Google's advertising script runs on the page | Clearing cookies, or opting out via Google Ads Settings |
| Consent record (set by Google's consent management platform) | Remembering whether you have been asked for, and what you answered to, the advertising consent message | Clearing site data |
The tools themselves — converters, viewers, inspector and analysis pages — set no cookies at all.
Children
This is a professional LiDAR and geospatial tool. It is not directed at children, and we do not knowingly collect information from anyone under 16.
Your rights
Under the GDPR and comparable laws you have the right to access, correct, export or erase personal data an operator holds about you, and to object to its processing. In our case an access request returns, at most, the account details listed under Accounts: there is no upload and no analytics record tied to you. For data Google holds in connection with advertising, use the Google controls linked above, which act on Google's own records directly. You also have the right to complain to your national data protection authority.
Changes
If this policy changes materially — a new third-party service, a new category of data — the "last updated" date above changes with it. There is no mailing list to notify you, by design.