Effective 26 September 2026
Privacy policy
Written in plain prose rather than borrowed legal boilerplate, and written to be accurate about this particular site. Most privacy policies describe how a company handles your data carefully. This one mostly describes why there is so little of it.
- Files uploaded
- None
- Accounts
- None
- Analytics
- Opt-in only
The short version
Your documents never reach us, so we cannot do anything with them.
Every PDF tool on this site runs inside your browser tab, in JavaScript and WebAssembly, on bytes your own browser read from your own disk. No tool transmits your document to a server. There is no document-upload queue, temporary document directory or document storage bucket, so there is no server-side document retention period. Content-free analytics has its own retention rules below.
- We never receive your files, so we never store, process, scan, share or train on them.
- We hold no account records, because there are no accounts and no email collection.
- Analytics is off until you allow it, and records no document content of any kind.
- Your consent preference stays in your browser; first-party analytics uses no persistent visitor identity.
The sections below say the same thing at greater length, with the exceptions and edge cases spelled out rather than omitted.
Section one
Your files and their contents
When you use a tool here, your browser reads the file you selected directly from your device into the memory of the tab. The processing — merging, splitting, compressing, converting, inspecting — is performed by code already running on your machine. The result is assembled in that same tab memory and handed to your browser’s download mechanism.
Consequently we do not collect your documents, do not store them, do not transmit them to any third party, do not analyse their contents, and do not use them to train anything. These are not restraints we are exercising; they are things we are not in a position to do.
Document metadata is treated the same way. Titles, authors, creation dates, embedded fonts, form field values, annotations, signatures and extracted text all stay inside the tab. When a tool displays a document’s metadata to you, it is being read locally and shown to you only.
OCR needs additional assets: a recognition engine compiled to WebAssembly and a trained language model. Like the page and its processing code, these files travel to your device. This is not an exception to local document processing: your document is not part of those requests. The local processing page explains how to verify this.
Section two
Server logs
Serving pages and receiving optional measurement requests requires network infrastructure. A host or reverse proxy may log request paths, times, status codes, IP addresses, user-agent strings or referrers. Those infrastructure logs are separate from our application analytics store, which does not record IP addresses, user agents, referrers or visitor identifiers.
Tool requests do not carry documents, filenames, document text or processing options. A request to a measurement endpoint can indicate activity, but its permitted payload contains only bounded content-free event fields. Hosts should not log request bodies or cookies; deployment logging must not be treated as covered by the analytics database retention rules.
Infrastructure log collection, access and retention are the operator’s hosting responsibility. This application cannot enforce or verify those external settings. Contact us for information about the deployed hosting arrangement rather than assuming that no network metadata exists.
Section three
Optional analytics
Off unless you turn it on. The first-party store holds content-free aggregates and temporary delivery receipts rather than document contents or visitor profiles.
Analytics is disabled until you actively accept it. If you decline, or simply never answer, no optional analytics provider script is loaded and no analytics event is sent. Declining does not degrade any tool — there is no feature gated behind it.
If you do accept, the first-party service receives a deliberately narrow set of fields. These describe tool activity without collecting the documents or their contents:
- Tool and event
- A published tool identifier, locale and a bounded view, click, operation or download event.
- Reported outcome
- Success, partial success, failure or cancellation; download actions are counted separately.
- Safe failure code
- A fixed category such as file-too-large, never the exception message or document text.
Never included in first-party analytics
- Filenames, in whole or in part
- Document text or extracted OCR output
- Document metadata, titles or authors
- Passwords, PINs or certificate material
- Form field values or signature images
- Exact file sizes or page-level content
- Processing options or arbitrary error messages
- IP addresses, user agents or visitor IDs
These counts help us identify heavily used tools and recurring safe failure categories. They describe accepted browser reports from consenting visitors, not all traffic or unique people. A download action means the browser was asked to download, not that a file was saved. Missing completions are not assumed to be failures, and browser reports are not proof of processing.
Counts are aggregated by server-observed UTC time. Minute totals are retained for 200 days; daily totals remain from collection start. Grouped failure details by day and minute are retained for 90 days. Random operation/event delivery IDs are hashed in receipts that expire after 24 hours; signed delivery tickets expire within 12 hours. These are delivery safeguards, not visitor identities. Scheduled maintenance removes expired rows; no history is backfilled.
First-party measurement sets no analytics cookies and keeps its short delivery queue only in memory. It operates independently of optional Google Analytics. GA, if configured, also needs consent and a non-admin eligibility check, may use its own cookies and follows its own terms. Its property-side Enhanced Measurement must be disabled by the operator before use. The admin dashboard never draws its totals from GA.
Section four
What is stored in your own browser
The consent preference written to your browser’s localStorage is the decision you made in the banner, under the key mypdfiles.consent.v1. It records whether you accepted or declined analytics and advertising, so that you are asked once rather than on every visit.
That value stays on your device. It is not transmitted to us, is not an identifier, and contains nothing about you beyond the choice itself. Clearing your browser’s site data removes it, and the banner will then ask again. The cookies page lists everything stored, why, and for how long.
Some tools keep working state in memory while you use them — a page order you are dragging, a preview being rendered. That state lives in the tab and is discarded when you close or reload the page. It is never written to a server. Administrators have a separate root-scoped HttpOnly authentication cookie, valid for eight hours, which also lets the server exclude their public activity while signed in in the same browser. Logged-out or incognito activity cannot be recognised as administrative.
Section five
No public accounts or document histories
Public tools have no sign-up, login, email capture, newsletter or profile. You can use every tool on this site without telling us anything about yourself, and there is no reduced-functionality “guest mode” that quietly pushes you towards registering.
The tools collect no name, email address, billing detail or public-account password. Anonymous aggregate counts are not attached to a person. The restricted administrator login is separate and stores an operator-supplied password hash, never the password. If you email us, we receive and retain that correspondence because you chose to contact us.
Section six
Third parties, including advertising
We keep third-party code to an absolute minimum, and the site’s Content-Security-Policy enforces that rather than trusting it: by default no third-party script origin is permitted at all. Fonts and the core page assets are served from our own origin; OCR also loads the configured engine and language assets. None of those asset requests includes document content.
Display advertising is planned as the way this site pays for itself, and is disclosed here before it is switched on rather than after. An ad network is a genuinely independent third party that sets its own cookies and processes data under its own policy. For that reason its script is loaded only if advertising is configured and enabled, you have accepted advertising, and the server confirms that this browser is not an authenticated administrator. A failed eligibility check blocks loading. Declining does not load the ad network.
Our hosting provider processes requests to serve the site; a configured database provider may store the content-free aggregates described above. Optional GA or advertising adds the relevant third-party provider, so such a deployment is not entirely first-party or cookieless. PDF document processing itself still happens only in your browser.
Section seven
Your rights, and the honest limit on them
Depending on where you live you may have rights to access, correct, delete, restrict or port personal data held about you, to object to processing, and to withdraw consent. We respect all of them, and would rather be candid about what exercising them looks like here.
We cannot look up a personal history in aggregates that have no visitor identifier. Requests can nevertheless concern correspondence or separately held infrastructure data. You can withdraw consent from the cookie settings without affecting any tool; this stops future reporting and discards queued events, but does not undo already aggregated counts. You may also complain to your local data protection authority.
To make a request, or simply to ask what we hold, email hello@mypdfiles.com. Please do not attach documents to that message.
Sections eight and nine
Children, and changes to this policy
Children
This is a general-purpose document utility rather than a service aimed at children. Public tools require no account and do not upload documents. The consent, infrastructure and correspondence considerations described above still apply; please do not send personal or confidential documents when contacting us.
Changes
If this policy changes, the effective date above changes with it. Where a change affects what is collected or who receives it, the consent banner will ask for a fresh decision rather than carrying forward the old one. Because collection is limited by how the site is built, a materially different policy would require a materially different site.
Effective date 26 September 2026
Questions about privacy
Do you store my PDF files?
No, and not as a matter of policy — as a matter of architecture. Your file is read from your own disk by your own browser and processed in the tab. It is never transmitted to us, so there is no server-side copy to store, retain, scan or delete. You can confirm this in your browser’s Network panel while a tool runs.
What is the single most sensitive thing you hold about me?
The first-party analytics store has no visitor identity, IP address, user agent or document content. The hosting provider may separately retain request details such as an IP address; infrastructure logging and its retention depend on the deployment. If you contact us by email, we also receive that correspondence. Public tools require no account.
Is analytics on right now?
Only after you choose to allow it and the service is available. First-party measurement counts tool views and clicks, operation starts, reported success, partial success, failure or cancellation, and download actions. It uses a tool identifier and fixed safe failure codes, not filenames, content, options or arbitrary error messages. Declining does not affect any PDF tool. Authenticated administrators in the same browser are excluded.
Do you sell data or share it with advertisers?
We do not sell data, and we have very little that could be sold. If display advertising is enabled, the ad network is an independent third party that sets its own cookies and follows its own policy — which is exactly why its script only loads after you have accepted advertising cookies.
How do I exercise a data subject request?
Email hello@mypdfiles.com. Our aggregate analytics does not keep an identifier that lets us retrieve a history for a particular person. We can still address requests about correspondence or infrastructure data where applicable. You can withdraw analytics and advertising consent from the cookie settings without affecting the tools; withdrawal stops future collection, but does not identify or undo already aggregated counts.
What happens if this policy changes?
The effective date at the top of this page changes with it, and material changes affecting what is collected will be reflected in the consent banner so a fresh choice is requested rather than assumed. Since the architecture is what limits collection, most conceivable changes would require rebuilding the site rather than rewriting this page.