Privacy Policy

Updated 6 October 2026. This page explains file processing, temporary storage and website analytics.

Processing on your device and on the server

Supported browser operations process file contents locally. Other operations use the server, and a local handler may fall back to server processing for an unsupported file. Server requests send the file over HTTPS. OCR is performed by the configured server engine; the free processing code does not send document contents to an external generative AI service.

A file selected on a tool landing page may be held temporarily in your browser's IndexedDB to transfer it into the processing workspace. Local output files are held by the browser for download. These browser copies are distinct from server storage. Keep your own originals; neither path is a backup service.

Server file retention

• Uploads are removed during normal operation cleanup after processing.
• Generated results are scheduled for deletion after the download response completes.
• A result you never download becomes eligible for deletion after 10 minutes. A background task checks about every minute while the service is running; this is not a guarantee of deletion to the second. An upload left behind by an interrupted job is cleaned up after one hour.
• Where premium background batch processing is enabled, results may remain available for up to 24 hours, subject to that feature's cleanup policy.

Processing is automated; human document review is not part of the normal workflow. Files are not intentionally published, sold or used as a content library. Access controls and cleanup reduce exposure, but we do not promise that hosting is risk-free. Use a locally controlled installation when your document-handling requirements do not permit uploads.

Passwords supplied for locked PDFs are used to open the file during processing and are not intentionally logged or retained as account credentials. Do not reuse a sensitive account password as a document password.

Accounts and support

The free toolbox does not require an account or email address. If you contact support, we receive the information you choose to send. If optional account or paid features are enabled, their account and transaction flows may require identifying information; the free-tool no-signup statement does not describe those separate flows.

Analytics and product telemetry

We use first-party product events to understand page visits, tool selections, successful processing, downloads, errors and processing duration. Web requests may use an anonymous first-party session cookie with a 90-day lifespan and a coarse country code supplied by the network edge. This is a browser-session identifier, not a claim that all activity is impossible to associate. Event records are pruned after 90 days by the running service.

Our product-event fields do not intentionally record filenames, file contents, email addresses or precise GPS location. Technical logs may contain IP addresses and browser or request information for service operation, debugging and abuse prevention.

The website includes DataFast visitor and conversion analytics. Cloudflare Web Analytics and Google Analytics (GA4) may also be enabled. These services receive website activity and technical information such as page URLs, referrers and browser/device information; DataFast and Google Analytics may use cookies and identifiers. File contents are not deliberately included in analytics events. See DataFast privacy information, Cloudflare Web Analytics and Google's partner-site data information.

You can manage cookies and site storage in your browser and use Google's Analytics opt-out tool. Blocking analytics can limit the usage data we receive without changing the purpose of the file tools.

Mobile applications (iOS & Android): Current mobile bundles omit DataFast, Cloudflare Web Analytics, Google Analytics and Google AdSense scripts. Server-side operation telemetry can still be recorded when a mobile tool calls the processing server.

Advertising

Pages may display Google AdSense ads when ad serving is enabled. Third-party vendors, including Google, use cookies to serve ads based on prior visits to this or other websites. Google's advertising cookies allow Google and its partners to personalize ads. Manage personalization through Google Ads Settings or participating vendors through YourAdChoices.

The site's ad preference controls manage its advertising choice; they should not be interpreted as a guarantee that every unrelated analytics or technical request is blocked. Uploaded documents are not supplied as advertising content.

Third-party requests and self-hosting

Hosting, network, font, icon and analytics providers can receive technical requests such as IP addresses. File processing and website asset requests are different activities. The public source lets you inspect the code, but does not independently verify the live server's configuration.

For self-hosting, review the installation instructions and disable or replace external analytics and assets as required. Running a local server alone does not automatically remove every third-party browser request.

Contact and changes

For a privacy question, contact [email protected]. Avoid attaching sensitive documents. This page's date changes when its substance is revised.