Convoro does not store the file that was uploaded. It decodes it into a picture and writes a new file from that.
🚨 That matters because a file that opens perfectly well as a JPEG can still carry anything in the parts a decoder skips. Checking the first few bytes proves nothing about the rest; re-encoding means the bytes on disk are ones Convoro produced.
It has a second effect worth telling your members about: the EXIF is dropped, including location. Somebody posting a photograph of their garden is not choosing to publish their home address, and "strip the metadata" is not a setting anybody finds.
Orientation is the one piece deliberately kept, applied before re-encoding, or every phone photograph would land sideways. SVG files are refused outright: an SVG is a document that can carry script.
Images in a restricted album are served through a permission check rather than straight off disk, so an address pasted elsewhere stops working.