Privacy Policy

The short version

• Your files never leave your device. Every tool on this site does its work inside your browser tab.
• Nothing here requires an account. Every tool works signed out, and no page asks you to sign in to use it. You can create one — see below — and you can give us an email address for the PDF to Word waitlist. Both are optional and neither changes what any tool does.
• We set no cookies unless you sign in. Browse and use every tool without an account and your browser is given none — which is why there is no cookie banner. Signing in sets one session cookie, because that is what being signed in is. We run no advertising and no cross-site tracking either way.
• We count anonymous usage — which pages are visited and whether a tool finished — and nothing else. If your browser asks not to be measured, we send nothing at all.
• Fonts and the PDF engine are served from pdfbull.com itself, so loading a page here does not tell Google or anyone else that you did.

Your files

When you choose a file, your browser reads it from your device into the memory of the page you have open. Merging, splitting, rotating, compressing, password-protecting, unlocking, watermarking, signing, resizing and converting all happen there. The finished file is handed to your browser's downloads.

No part of that involves a server. Your file is not uploaded, not streamed, not queued and not stored — there is nowhere for it to go. Closing the tab discards everything that was in it.

This is verified, not just intended: each tool's tests fail if any file content appears in a network request, and the suite fails if a page contacts any service beyond the usage measurement described below. The current scope of that promise is stated on every tool's own page, because it is a per-tool commitment rather than a blanket claim.

Passwords

Protect PDF and Unlock PDF both ask for a password. That password is used in your browser to derive an encryption key — to apply encryption in one case, to remove it in the other — and is never transmitted, stored, logged, written into a filename or included in an error message. Two consequences worth stating plainly: we cannot recover a password you forget, because we never had it, and Unlock cannot open a file whose password you do not know — it removes a password you supply, and has no way to guess or break one.

Usage measurement

We use PostHog for anonymous usage measurement, sent through our own domain rather than contacting PostHog directly — your browser only ever talks to pdfbull.com. There is no advertising network involved and nothing is sold.

We do not use a cookie for this, and we do not use the browser storage PostHog would use by default either. Each visit is measured on its own; we do not link two visits together as the same person, even anonymously. That is a deliberate choice, not PostHog's default behaviour — see the code that configures it if you want to check.

What it records:

• Which page you visited.
• Whether a tool page was opened, whether a job was started, and whether it finished — and if it didn't, which of a fixed list of reasons applied: the file was password-protected, unreadable, or the input was rejected.
• Rough bands, never exact values: a file-size band (under 1 MB, 1–10, 10–50, over 50), a page-count band, how many files were involved, and how long a job took.
• Whether the file went in as a PDF or an image, and what came back — so we can tell, say, whether PDF-to-JPG or JPG-to-PDF gets used more, without recording anything about a specific file.

What it never records, by design:

• Your file, or any part of it. Nothing is uploaded, so there is nothing to send.
• Filenames. A filename is often the most revealing thing about a document, and none ever leaves your browser.
• Passwords or watermark text, or their length.
• Exact page counts, exact file sizes, or any text from your document.

This is enforced in the code rather than promised: every measurement is a fixed value from a short list, so there is no field a filename could occupy even by mistake. Our automated tests fail the build if any page contacts a service other than this one, or if a value outside that list ever reaches it. The full list of what is measured and why lives in docs/ANALYTICS.md in the project's repository, alongside the code.

Screen or session recording is not enabled. PostHog offers it as a feature; we have not turned it on, and it stays off until masking that keeps a recording from ever showing a file name, a rendered page, or anything typed into a field has been verified against a real account rather than assumed to work.

We use it to answer one question — which tools people actually use, and whether they work — so effort goes to the tools that matter. Under GDPR terms, the lawful basis is legitimate interest: understanding whether a free tool works, using the least data that can answer it.

Turning it off

If your browser sends Global Privacy Control or Do Not Track, PDFBull sends no measurement at all — not the page view, not the events, and PostHog is never even loaded. Nothing is recorded and nothing is estimated in its place. Brave, DuckDuckGo and Firefox's strict mode send this by default; most browsers have a setting for it, and several extensions add one.

We honour it because it is a stated preference, not because a regulator requires it of anonymous measurement. Because measurement is proxied through our own domain, blocking a specific analytics host in an ad blocker will not work the way it did before — Global Privacy Control or Do Not Track is the reliable way to opt out, and the tools carry on working normally either way.

Who processes it, and for how long

PostHog is the processor. Requests are proxied through our own domain so your browser never contacts them directly, but PostHog still receives and stores the measurement described above, the same way Vercel does as our host. We do not export it, join it to anything, or keep our own separate copy.

If you create an account

Accounts are optional and new. Every tool works without one, no page asks you to sign in before using it, and we do not intend to change that.

You sign in with Google. If you do:

• We store your email address, and your name and profile picture URL if Google supplies them. That is the whole record.
• One session cookie is set, so the site knows you are signed in between pages. It holds a signed token, not your details, and it is the only cookie this site ever sets.
• Your files are still never uploaded. Signing in changes nothing about how any tool works. We do not record which tools you used, which documents you opened, or what any of them were called — the tools are not told whether anyone is signed in.
• Google is told you signed in to PDFBull, as it is for any site you use it on. We receive no other information about your Google account and cannot see anything else in it.
• You can delete it yourself, immediately, from your account page. It removes the record rather than marking it deleted, and you do not have to ask us.

The PDF to Word waitlist

This is the only thing on PDFBull that collects something about you personally, and you have to type it in yourself for it to happen.

Converting a PDF into an editable Word document cannot be done well inside a browser tab, so PDFBull does not offer it. The PDF to Word page says so, and offers to tell you if that ever changes. If you leave an address there:

• We store the address and nothing else. No name, no IP address, no record of which pages you looked at before or after, and nothing linking it to any file you have processed — there is nothing to link it to, because your files never reach us.
• We use it once. One email, when PDF to Word works. It is not a newsletter, and there is no second message.
• We do not sell, share or rent it, and we do not use it to advertise to you anywhere else.
• You can have it removed at any time by asking at the address in Contact below. If we decide not to build the tool, the list is deleted rather than kept.

The form posts to pdfbull.com itself, not to a third-party mailing service, so submitting it does not hand your address to anyone else in the process. It is held by our storage provider, Upstash, on our behalf.

Nothing else on this site asks for an address, and every tool works without one.

What is stored on your device

One item, and only if you change the setting: if you pick a light or dark appearance, your browser stores that choice under the key pdfbull-theme in local storage, so the site does not flash the wrong colours on your next visit. It contains the word light or dark and nothing else. Choosing “system” removes it. It is never sent anywhere.

We set no cookies — not for the site, and not for the usage measurement described above — which is why this site has no cookie banner. There is nothing to consent to.

PostHog would normally store an identifier in local storage or a cookie so it can recognise a returning visitor. We turned that off: the theme preference above is genuinely the only thing stored on your device, by anything on this site, for any reason.

What our hosting provider sees

Serving a web page requires a server, and that server necessarily receives the ordinary information any web request carries: your IP address, the page requested, the time, and your browser's user-agent string. Our hosting provider processes these as standard server logs to deliver the site and protect it from abuse.

Along with the usage measurement above, this is the extent of what is handled about you — and we would rather name it than let the sentence “we collect nothing” do work it cannot do. Those logs never contain your files, their names, or their contents — none of that reaches the server in the first place.

What we do not do

• We do not upload, store, inspect or process your documents.
• We do not run advertising, or tracking that follows you across sites.
• We do not sell or share data.
• We do not build a profile of you or fingerprint your browser.
• We do not send marketing email. The only message we will ever send is the single notification you asked for by joining the PDF to Word waitlist — and if you have not joined it, we have no address for you and nothing to send.
• We have no ability to view a file you processed, and no internal tool that could — the feature does not exist.

Children

PDFBull is not directed at children and collects no personal information from anyone, including children.

Your rights

Data-protection law gives you rights to access, correct, export and delete personal data held about you. We hold none, so in practice there is nothing for us to return or erase. If you want to remove the one setting stored on your device, switch the theme to “system” or clear this site's data in your browser.

Any request about your hosting-provider log entries should go to the contact address below, and we will pass it on.

Changes to this policy

If PDFBull ever adds something that genuinely cannot run in your browser, that tool will say so on its own page before you use it, and this policy will be updated first — a new tool will never quietly inherit the promise made here. The date at the top of this page changes whenever the substance does.

Contact

Questions about this policy can be sent to privacy@pdfbull.com.