Privacy

There are two halves to this, and the second one is the half most sites leave out.

Your files never leave your device

Every tool on this site runs in your browser. The PDF is read, changed and written by code running on your own machine, and the result is handed straight back to you. There is no upload step, no queue, no temporary copy on a server, and nothing to delete afterwards because nothing was ever there.

You do not have to take our word for it. Open your browser's developer tools, switch to the Network tab, and run any tool. You will see the page and its code load, and then a few small requests to our server: one asking whether you have tasks left, one saying a task finished. Each one carries a tool name, a task class and a hash of the bytes. What you will not see is your document, or its name, or its page count, because none of them are in any of it.

The same fact in a different form: once the page has loaded, turn your connection off and the tools still run. Only the allowance check wanted the network, and when it cannot be reached the task runs anyway. Keeping the site installed so it also opens with no connection is part of Pro.

What we do store

Since the site now has free limits and paid plans, there is a server, and it keeps a small amount of information. It never sees a document.

Your email address, if you made an account. Nothing else about you - there is no password, no name field and no profile.
A count of how many tasks you have run today, and which tool each one was. Not the file, not its name, not its size: a tool slug and a number.
A hash of the file's contents, used only to notice that you re-ran the same job within five minutes so we do not count it twice. A hash of a document we have never seen tells us nothing about the document.
A rough fingerprint of your browser - screen size, timezone, language - so the free allowance survives you closing the tab. It is hashed again before it is stored. Your timezone is also kept as itself, because the daily limit has to reset at your midnight rather than ours.
A truncated one-way hash of your IP address, kept as a second signal when something looks like abuse. Eight bytes, never the address, and it is not enough on its own to decide anything - an office and a campus share one address.
Your country, the two letters the network connection reports. It is used to guess which prices to show you before you have a payment method, and to count usage by region. It does not set your price band: that comes from where your payment method is registered.
Payment records, if you bought something. Handled by the payment provider; we keep an amount, a date and a reference.

That is the whole list. There is no analytics script from anyone else, no advertising network, no session recorder, and no third party receiving any of it.

You do not have to make an account

Every tool works without signing in. An account raises the daily limit, and that is the only thing it does.

Deleting your account

One button on your account page. It removes your email address, your device record and your usage counts permanently, and it cuts every task your account ran loose from you - the log line keeping a tool name, a time and a hash stops belonging to anybody the moment you press it. Those lines are then deleted with the rest of their month, within 90 days. Payment records stay, because a receipt is a legal record of a transaction - what remains is an amount, a date and a reference, not a person.

If this changes

This page is versioned in the same repository as the site. If we ever store something new, it appears here first, and anyone with an account is emailed before it takes effect.