Privacy Policy

Last updated: October 6, 2026

This policy explains what happens to the files you open in a PDFTools.studio tool, what data the site collects when you visit, which outside services are involved, and what rights you have over your data.

1. Your files

Every tool processes your file on your own device, using JavaScript that runs in your browser. Your PDFs, images and other documents are never uploaded to our servers, and we have no copy of them. A file is held in your browser's memory while the tool works on it and is discarded when you leave the page. A file you pick on the homepage is also kept in your browser's storage for the moment it takes to open the tool page, which deletes it as soon as it reads it.

Beyond loading code and fonts, two tools use the internet, and neither sends your file. OCR PDF downloads the recognition engine and language data from the cdnjs and jsDelivr content delivery networks; the language data is then kept in your browser's storage so the next run can skip that download, and the recognition itself happens on your device. The HTML to PDF tool has a "Webpage URL" mode that requests the address you enter from that website and, if that does not work, through a public proxy service (api.allorigins.win, then corsproxy.io), so the website, and the proxy when one is used, see the address. Pasted HTML and uploaded HTML files are not sent anywhere, but if they point to pictures or style sheets on other websites, your browser loads those from there, as it would when opening the page.

2. Data we collect

Because files are not processed on our servers, nothing is collected from your documents. What is collected is limited to the following:

  • Analytics: when it is switched on (section 4 says when), Google Analytics records which pages are visited, including which tool pages are opened, with general browser, device and approximate location information, so we can see what to improve. It links visits to a random identifier in its _ga cookies, not to your name or your files.
  • Server logs: our hosting provider records the technical details of each request, such as IP address, browser type and the page requested, as web servers do.
  • Email: if you write to us, we receive your email address and your message, which we use to answer you. The contact form sends nothing itself; it opens your own email app.
  • Local settings: your theme, language and cookie choices are stored in your browser's local storage. They never leave your device.

3. Third-party services

The following outside services are involved when you use the site. Each collects data under its own privacy policy:

  • Google Analytics: measures website traffic and which pages are used.
  • Google AdSense: not active yet. The cookie banner and Cookie settings already list it, but no ads are shown and no AdSense code loads. Once it runs, it will display advertisements and may use cookies to serve ads based on your prior visits to this or other websites.
  • Content delivery networks: the PDF libraries, the OCR engine and its language data are loaded from cdnjs and jsDelivr, and the handwriting fonts for a typed signature from Google Fonts. These services see the ordinary request data for those files (such as your IP address), never your documents.
  • Public proxies: api.allorigins.win and corsproxy.io, used only by the Webpage URL mode of HTML to PDF, as described in section 1.

4. Consent and cookies

Google Analytics and Google AdSense are optional, and switching them off does not limit any tool. Advertising stays off everywhere until you switch it on. For Google Analytics the starting point depends on your device's time zone:

  • European Economic Area, United Kingdom and Switzerland: a cookie banner asks on your first visit, and Google Analytics does not load until you accept it. The same applies when your browser reports no time zone or only UTC.
  • Everywhere else: no banner is shown, and Google Analytics runs from your first page view until you switch it off.

Wherever you are, the "Cookie settings" link in the footer switches either service on or off at any time. We read only the time zone your browser reports and do not look up where you are. As a second check, Google's tags are told to set no cookies for visitors Google itself places in the EEA, the UK or Switzerland unless they have accepted. On a device there that is set to another time zone, the tag still loads and counts the page view without cookies. The cookie policy lists every cookie and storage item, including the ones needed for the site to work. If your browser sends the Global Privacy Control signal we treat it as an opt-out from advertising cookies.

5. Legal bases (EU, EEA, UK and Switzerland)

  • Consent for analytics and advertising cookies. You can withdraw it at any time from Cookie settings; withdrawal does not affect processing that happened before.
  • Legitimate interest in running a secure, working website, for the technical request data (such as IP address and browser type) that our hosting provider and the content delivery networks receive when they serve pages, scripts and fonts, and in answering the emails you send us.
  • No legal basis is needed for your documents, because we never receive them.

6. How long data is kept

  • Your documents: never stored by us. They exist in your browser's memory while a tool runs, and a file handed over from the homepage stays in your browser's storage only until the tool page reads it.
  • Theme, language and consent choices: in your browser only, until you clear them (where the banner is shown, the consent record expires after 12 months and the banner asks again).
  • OCR language data: in your browser's storage after the first OCR run, until you clear site data. It holds no document content.
  • Google Analytics data: retained by Google under the retention setting of our account, which is set to the shortest available period (2 months for user-level data; aggregated reports are kept longer).
  • Hosting server logs: kept by our hosting provider for its normal security period and not used by us to identify visitors.
  • Emails you send us: kept in our mailbox for as long as needed to deal with your message.

7. International transfers

Google and the content delivery networks process data in the United States and other countries. Where Google's data leaves the EEA, the UK or Switzerland, Google relies on the EU-US Data Privacy Framework and standard contractual clauses. The content delivery networks and the two proxies are run by other companies; how and where they handle request data is set out in each provider's own privacy policy.

8. Children

The site is not directed at children under 13 (or the higher age your country sets for consent to online services), and we do not knowingly collect personal data from them. Because no account exists and no file is uploaded, the only personal data that could be collected is described above: analytics data when Google Analytics is switched on, the hosting provider's server logs, and any email sent to us.

9. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, the CCPA/CPRA in California, or the Digital Personal Data Protection Act in India), you may have the right to:

  • Know what personal data we hold about you and receive a copy.
  • Have inaccurate data corrected.
  • Have your data deleted.
  • Object to, or restrict, processing based on legitimate interest.
  • Withdraw consent at any time (Cookie settings in the footer).
  • Receive your data in a portable format.
  • Not be discriminated against for exercising any of these rights.
  • Complain to your data protection authority. In the EU that is the supervisory authority of your country; in the UK it is the Information Commissioner's Office.

Because we hold no account and no documents, most requests concern an email you sent us or Google Analytics data, which we can only act on through Google's own controls. Email us and we will explain what is possible, or use Google's My Ad Center and the Analytics opt-out add-on directly.

10. Notice for California and other US states

In the past 12 months the only categories of personal information collected through this site are identifiers (IP address, cookie identifiers, and your email address if you write to us) and internet activity (pages visited, tool pages opened). Cookie identifiers and page visits are collected by Google Analytics unless it is switched off (section 4); IP addresses also appear in our hosting provider's server logs. We do not sell personal information for money. AdSense is not active yet, so no personal information has been shared for advertising. Once it runs, advertising cookies used for personalised ads may count as "sharing" for cross-context behavioural advertising under the CPRA; you can opt out through the "Do Not Sell or Share My Personal Information" link in the footer, which opens Cookie settings so you can turn advertising cookies off, or by sending the Global Privacy Control signal from your browser. We do not use or disclose sensitive personal information, and we do not knowingly sell or share the personal information of anyone under 16. To exercise a right, email us; we will ask only what is needed to confirm the request relates to you, and we will respond within 45 days. An authorised agent may act for you with written permission.

11. Notice for India

This section is for visitors in India. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are coming into force in stages. Until their sections on notice, consent and rights apply, what follows is what the site does today and what we commit to ourselves.

  • Personal data and purposes: Google Analytics processes a random identifier kept in its _ga cookies, the pages and tool pages you open, your browser and device type, and an approximate location worked out from your IP address, so that we can count visits and see which tools to improve. Our hosting provider logs your IP address, browser type and the pages requested, to deliver the site and keep it secure. The outside services listed in section 3 see your IP address when your browser fetches their files. If you email us, we use your address and your message to answer you. Nothing is taken from your documents.
  • Your choice: no banner asks first in India: Google Analytics is on unless you switch it off. Cookie settings switches it off, or on again, at any time, and no tool depends on it.
  • Your rights: you can ask us for a summary of the personal data we process about you, what we do with it and who it was shared with, ask us to correct, complete, update or erase it, and name another person to use these rights for you if you die or become unable to act. Google Analytics data is held by Google, so there we can act only through Google's own controls (section 9).
  • Requests and grievances: write to support@pdftools.studio, which is also the contact for any question about how your personal data is handled. Say what the request is about (for an email you sent us, the address you wrote from) and we will answer within 45 days.
  • Complaints: if our answer does not settle the matter, the Act lets you complain to the Data Protection Board of India once its sections on complaints are in force. It asks you to use our grievance contact first.
  • Children: in India a child is anyone under 18. The site is not directed at children, has no age check and aims no advertising at them. A parent or guardian can switch Google Analytics off in Cookie settings on a device a child uses.

12. Changes to this policy

If we change what is collected or why, we update this page and the date at the top. Where the cookie banner is shown, a material change also makes it ask for your choice again.

13. Contact us

If you have a question about this policy or about how the site handles data, email us at:

support@pdftools.studio