FormatKit Privacy Policy Last updated: 2026

FormatKit does not collect, store, transmit, or share any personal data.

All file conversions are performed locally on the device. FormatKit does not use analytics, tracking technologies, third-party services, or external servers.

FormatKit does not access, collect, or transmit user information beyond the files explicitly selected by the user for conversion.

If you have questions, contact: ajbeaver@me.com

Developer Note: Archive Lifecycle Events

FormatKit logs archive lifecycle events through ArchiveExecutionCoordinator using the prefix FormatKit archive event=....

• reserved Emitted after the archive lock is persisted and the job owns a final output path plus staging path. No archive subprocess has started yet.
• running Emitted after the archive subprocess launches and its PID has been durably written into the lock. The subprocess is actively writing only to the staging file.
• publishing Emitted after the archive subprocess exits successfully and the lock has transitioned to publishing. The staged file exists, is non-empty, and is about to be atomically renamed into place.
• completed Emitted after the staging file has been atomically moved to the final path and the job lock has been released.
• recovered Emitted after stale or orphaned archive state has been cleaned up and the prior lock/staging artifacts have been removed safely.
• cancelled Emitted after an in-flight archive subprocess has been terminated successfully and cleanup has completed.
• recovery_failed Emitted when FormatKit attempted to terminate an orphaned or active archive subprocess but could not verify that it stopped.
• failed Emitted when archive execution fails after reservation or launch, including subprocess exit failure, missing staged output, launch failure, or final publish failure.

Expected success path: reserved -> running -> publishing -> completed

Expected crash/recovery path: reserved/running -> recovered -> reserved -> running -> publishing -> completed