This describes what happens to the files and the information you give this service. It was written by reading the source code rather than by adapting a template, so where the answer is unflattering it says so.
The operator of this service is [name of the company, sole proprietor or individual — to be supplied], at [registered address — to be supplied]. Questions about your data go to [contact address — to be supplied].
Which country’s data-protection law governs this service, and therefore which rights you have, depends on those details. That question is deliberately left open here rather than answered with a guess.
Your file is uploaded to our server and processed there. It is not processed inside your browser. Each job gets its own directory, and the tools that do the work — the same open-source programs that read PDFs, spreadsheets and images — run on our machine and read the whole file in order to do their job.
Your file is not sent to any other company. The part of our system that handles files has no route to the internet at all, so it cannot send your document anywhere even in principle.
A file is scheduled for deletion 24 hours after you upload it. Note that the clock starts at upload, not when processing finishes. A cleanup task runs every hour, so in practice a file is removed within about an hour of its window closing.
You can delete a document yourself before then, and that removes the file from the server during the same request rather than putting it on a queue.
You can also ask us to keep a document longer. There is no limit on how many times that can be done, so a document you keep extending stays until you stop.
Files you add to your personal library are an exception by design: they are meant to be kept, and are limited by count and total size rather than by time.
Deleting the file does not delete the record of the job. We keep the name your file had, its size, its type, a checksum of its contents, the IP address and browser the request came from, and the settings you chose for the tool. For the tools you type into rather than upload to, what you typed is part of those settings and is kept with them.
At present nothing removes those records automatically. This is a shortcoming of the software rather than a decision about your data, and this paragraph should be replaced with a retention period once the software deletes them.
Passwords you supply to open or protect a PDF are an exception: they are removed from the record when the job finishes.
Your files are not encrypted while they are stored on our server. They sit on the disk in the form you sent them, for as long as the retention window described above.
Uploads and downloads are transmitted over HTTPS. The site can also still be reached over plain HTTP, which we intend to stop; until then, prefer the https:// address.
This service does not offer end-to-end encryption and cannot: the tools have to read your document in order to change it.
Only you. Every request for a document is checked against its owner before anything is returned, on the website and in the mobile API alike, and a document that is not yours is answered exactly as one that does not exist.
If you are not signed in, your documents belong to your browser session, and that session lasts about two hours. We do not create shareable links, and we do not email your documents to anyone.
If you sign in later in the same browser, the documents you worked on as a guest move to your account.
The operator has administrative access to the server and can therefore reach stored files. Nothing in the software prevents that; only the retention window limits it.
An account needs an email address and a password. We store the password only in hashed form.
Email delivery is not configured yet, which means verification and password-reset messages cannot currently be sent. Until that changes, an account cannot be recovered if you lose the password.
There is also no way to delete your account from within the service today. Until there is, deletion has to be requested from the contact address above.
Our operational log records which tool ran, for which job, how long it took, and whether it worked. It does not record the names of your files or anything from inside them.
One exception: if a message we try to send you fails, the log records the address it was going to, along with the error.
These logs are not rotated automatically and are kept until they are cleared by hand.
We count actions in order to see which tools people use: the name of the event, the tool, and when it happened. There is nothing in those records that identifies you, your session, or your file — not even an account id.
They are kept for at most 180 days.
A session cookie, which is what keeps your work and your sign-in attached to your browser. It lasts about two hours.
A cookie holding the token that protects forms against being submitted from other sites.
A language cookie, written only if you pick a language yourself, kept for a year.
A sign-in cookie, written only if you tick “remember me”.
There are no advertising or analytics cookies, and nothing here is used to build a profile of you. That is why you are not asked to consent to a banner.
None. The pages, the typeface and the PDF viewer are all served from this site, so your browser talks to no one else while you use it. No other company is involved in running this service.
Write to [contact address — to be supplied]. What we are obliged to do in response depends on the law that applies, which in turn depends on the operator details at the top of this page.
This text will change as the software does. When it is put into force it will carry a date, and material changes will be noted rather than made silently.