Privacy Policy

PDFPA ("PDFPA", "we", "us" or "our") provides browser-based tools for working with PDF and related document formats. This Privacy Policy applies to the public PDFPA website and the document-processing services available through it.

PDFPA currently does not offer public user registration, user accounts, paid subscriptions or a checkout/payment system. We therefore do not collect public account profiles, account passwords, billing addresses or payment-card information as part of normal tool usage.

Some information is nevertheless processed to operate the website, measure usage, prevent abuse and process files. If you voluntarily contact us or use a feature that requires information—such as a signature request—we also process the information you choose to submit.

When you visit PDFPA, our first-party analytics may process technical and usage information such as:

• IP address and a security/analytics hash derived from technical identifiers;
• page or tool visited, landing page, visit time and referrer;
• browser, operating system or platform, device category and user-agent information;
• screen size, viewport size, pixel ratio, browser language and browser-reported timezone;
• approximate country, region, city, timezone, ISP, organization and network/AS information inferred from a public IP address.

This information is used for aggregate traffic reporting, product improvement, security monitoring, rate limiting, fraud detection and preventing misuse. Approximate location derived from an IP address is not GPS or precise device-location tracking and can be inaccurate.

PDFPA also uses or may enable Google Analytics to understand website traffic and interactions. Google Analytics can receive information such as page activity, browser/device information and IP-address-derived information, and may use first-party analytics cookies or identifiers. Google states that GA4 uses IP addresses during collection and does not log or store raw IP addresses in Analytics. Google Analytics handling is also governed by Google's own terms and privacy controls.

PDFPA first-party page-view analytics are collected automatically when you use the public website. For public Internet addresses, PDFPA may also perform a server-side IP lookup to derive approximate country, region, city, timezone, ISP, organization and network/AS information. This lookup uses the visitor IP already received by the service; it does not request GPS permission or precise device location.

Files you upload are processed only to perform the tool action you request. PDFPA is not intended to be a permanent document-storage or backup service.

• Uploads are placed in temporary server-side job storage while they are being received and processed.
• Completed results for the standard processing tools are made available for a short download window of up to 10 minutes after processing completes. The download page displays a countdown.
• The Delete result control requests immediate deletion of the associated temporary server job/files instead of waiting for automatic expiry.
• Abandoned/incomplete uploads and queued jobs can have separate short technical expiry windows so the service can safely finish or clean up interrupted work.
• Sign PDF request mode is an exception: when you deliberately create a shareable signing request, the document and request information may remain available for up to 7 days so the recipient has time to sign it.

After file bytes are deleted, PDFPA may retain limited processing metadata—such as the tool used, job timestamps, file size, processing status, error codes and similar operational records—for analytics, reliability, abuse prevention and system administration. This metadata is not intended to preserve the contents of your document.

Encryption: PDFPA uses HTTPS/TLS when the production site is served securely, which protects data while it travels between your browser and the service. The current local/server job-storage implementation relies on access-controlled server storage and random access tokens; it does not presently claim application-level encryption of temporary uploaded files at rest. Do not rely on PDFPA as an encrypted document vault.

PDFPA can use cookies, local browser storage and similar technologies for analytics, security, fraud prevention, session continuity and tool-abuse controls.

• PDFPA first-party analytics: a randomly generated browser token is stored locally to group page views into a short visitor session. The current token expires after approximately 30 minutes and is checked/renewed in the browser.
• Security and limits: cookies or browser storage may be used where necessary to detect abuse, enforce fair-use/daily limits, reduce automated misuse or preserve short-lived tool state.
• Google Analytics: Google Analytics may set first-party cookies such as _ga and a property-specific _ga_* cookie to distinguish users/sessions. Cookie duration depends on configuration and browser behavior.

You can clear or restrict cookies and local storage using your browser controls. Doing so may reset analytics identifiers and can affect features that depend on browser storage. Browser or extension-level blocking may also prevent third-party analytics requests from loading.

PDFPA does not ask visitors to create a public account. We do, however, process information that you voluntarily submit through specific features:

• Contact form: name, email address, subject and message, together with limited technical information such as IP address and user agent used for rate limiting, spam/fraud prevention and administration.
• Signature features: depending on how you use Sign PDF, this can include signer name, recipient name, recipient email, a short message, signature text/image and related document/request settings.
• Document contents: files may naturally contain names, contact details, financial information, signatures or other personal/confidential information chosen by the uploader. PDFPA processes that content only as necessary to perform the requested tool operation.

Please do not upload or submit information you are not authorized to process or share.

We use information only as reasonably necessary to:

• provide, process and deliver the tool action you request;
• maintain reliability, diagnose errors and improve PDFPA;
• measure traffic and understand which tools and pages are useful;
• detect automated abuse, fraud, security threats and attempts to bypass usage limits;
• respond to contact messages and support requests;
• protect PDFPA, users and third parties, and comply with applicable legal obligations.

Depending on applicable law, these activities may rely on your request to provide the service, legitimate interests in operating, measuring and securing the service, and compliance with legal obligations. Where a jurisdiction requires a different legal basis or a consent mechanism for analytics technologies, PDFPA may need to provide additional controls for visitors in that jurisdiction.

PDFPA does not sell your uploaded documents or personal information. Information may be processed by infrastructure, hosting, CDN/security, analytics or other technical service providers that help us operate PDFPA, subject to their own contractual and legal obligations.

Google Analytics is a third-party analytics service and is subject to Google's applicable privacy terms and controls.

If PDFPA later offers a voluntary Donate / Buy us a coffee button through a third-party payment or donation provider, the provider will process the payment transaction under its own privacy policy and terms. PDFPA does not intend to receive or store full payment-card details. We will update this policy if the donation implementation changes the information PDFPA receives.

We may also disclose information when reasonably necessary to comply with law, enforce our terms, investigate abuse, protect rights/safety, or respond to valid legal process.

• Standard completed processing files/results: generally up to 10 minutes after completion, unless deleted sooner.
• Temporary/incomplete upload data: short technical windows are used to finish or clean up interrupted uploads.
• Sign PDF request documents: up to 7 days when request mode is used.
• Raw IP addresses and detailed user-agent/fingerprint fields in PDFPA visitor analytics: configured for removal after approximately 30 days.
• Detailed page-view analytics: configured for approximately 90 days.
• Pseudonymous visitor-session records: configured for removal after approximately 120 days.
• Contact messages: retained for as long as reasonably necessary to respond, maintain support history, prevent abuse or meet legal/administrative needs. PDFPA does not currently promise a fixed automatic deletion period for contact messages.
• Operational/job metadata may be retained separately from file bytes for reliability, security and aggregate analytics.

Retention periods can be shortened when data is no longer needed, and may be extended where required for security investigations, legal compliance, dispute handling or system backups that cannot reasonably be edited immediately.

PDFPA uses reasonable technical and organizational safeguards appropriate to a document-processing service. Current controls include HTTPS/TLS in production when correctly deployed, private server-side processing routes, random upload/job access tokens, file-type/signature validation for supported tools, upload-size limits, rate limits, short retention windows, access-controlled temporary directories and no-store response headers for downloadable results.

No Internet service can promise absolute security. You are responsible for deciding whether a document is appropriate to upload and for avoiding highly sensitive files if the available safeguards do not meet your requirements.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection or portability of personal information, or to withdraw consent where processing is based on consent. These rights can be subject to legal exceptions and verification requirements.

You can use the contact form for privacy requests. Please provide enough information for us to understand and verify the request without sending unnecessary sensitive documents.

You can also use browser controls, extensions or network-level tools to clear or restrict cookies/local storage and to manage or block third-party analytics technologies. Some privacy signals may create additional legal obligations depending on your jurisdiction.

PDFPA is a general-purpose document utility and is not designed specifically for children. We do not knowingly create public user profiles for children because PDFPA currently has no public registration system. If you believe a child has submitted personal information through a contact or document feature in a way that should be removed, contact us through the form.

We may update this Privacy Policy when PDFPA adds features, changes infrastructure, introduces accounts/subscriptions/payments, changes analytics practices, or needs to reflect legal requirements. The date at the top will be updated when material changes are published.

For privacy questions or requests, use the PDFPA contact form. PDFPA intentionally does not publish a phone number or street address on this page.