Privacy Policy

The one-shot tools: Merge, Split, Compress, Rotate, the converters and the rest never write your file to disk. It is held in memory for the second or two the work takes, the result is sent back, and both are discarded. Nothing remains once the response has been delivered.

The editor is different, because it has to be. To let you change text, place a signature and come back after a reload, your PDF is stored on the server while you work on it. It is deleted automatically within 6 hours, sooner if disk space runs short, and you can remove it immediately with the Delete button in the editor.

Uploads travel over an encrypted connection (HTTPS). They are not separately encrypted while stored on the server, so we would rather say so than imply a protection that is not there. No person reads your documents, they are never shared with anyone, and they are not used to train any model.

So we can tell which improvements are worth making, we keep a small description of each document, never its contents. That is: how many pages it had, its size in megabytes, whether it looked like a scan, which software produced it, and how many fonts and images it contained.

No text, no images, no names, no metadata that identifies you or the document. A row reads roughly “14 pages, 2.1 MB, scanned, made by Microsoft Word”, enough to know that a fifth of visitors bring scans and that OCR is worth the server time, and useless for anything else.

If you press Allow on the banner, we record: the pages you visit, how far down each one you scroll, roughly where on the page you click, how long the tab is actually in front of you, and which tool steps you finish. Alongside that we store the country your connection comes from, the timezone and language your browser reports, and your device, browser and screen size.

If you press Decline, none of that is sent.

We do not record your keystrokes, your screen, or anything you type into a document. There is a good reason session-replay tools like Hotjar are not used here: on a PDF editor, replaying a session would film whatever you uploaded. Aggregate figures answer the same questions without ever holding a picture of your paperwork.

Your IP address is never stored. It is put through a one-way hash with a secret salt the moment a request arrives, and only that hash is written down. It lets us count unique visitors and stop somebody hammering the server, and it cannot be turned back into your address.

Server request logs (the hashed address, the path, the response code, how long it took) are kept to keep the site up and to spot abuse. That is a legitimate interest under GDPR Article 6(1)(f) and applies whether or not you allow analytics, because without it the site cannot be defended.

The optional PDF Clay browser extension has one job: open the PDF you are viewing (or a PDF link you right-click) in this editor. When you use it, the extension reads that PDF’s bytes in your browser and uploads them to our server over HTTPS, using the same upload path as the website. A new tab then opens on PDFClay with the document ready to edit.

The extension does not inject anything into other websites, does not show ads, and does not include analytics. It does not keep a history of documents or URLs after the editor tab opens. The only thing it may store is an optional server address override for developers. Uploaded files follow the same rules as any other editor upload: deleted automatically within 6 hours, sooner if disk space runs short.

Editing a PDF opened from your computer (file://) requires you to turn on “Allow access to file URLs” on the extension’s details page in Chrome. That permission is granted by you, not requested silently.

The site itself does not set tracking cookies. Two pieces of browser storage are used: one remembers whether you allowed analytics, and one holds a random id for the current tab which is erased when you close it. Neither follows you between visits or to any other site.

If advertising is enabled, Google AdSense may set its own cookies to show and measure ads. That processing is governed by Google's advertising policy. Pressing Decline on the consent banner also tells the page to request non-personalised ads only, and behavioural analytics are not sent.

You can read more about how Google uses data from partner sites at Google's ads technology page.

• Uploaded files: up to 6 hours, then deleted automatically.
• One-shot tool files: not stored at all.
• Chrome extension: no document or URL history; only an optional developer server override may be stored in the browser.
• Visit and event records: 90 days by default, then deleted.
• Document descriptions (page counts and the like): kept, as they identify nobody.

Under GDPR and CCPA you may ask what is held about you, ask for it to be deleted, or object to it being collected. In practice the answer is usually short, because there is no account and no name attached to anything: press Delete in the editor to remove your file, and choose Decline to stop analytics. Your data is not sold, and there is nothing to opt out of on that front.

Requests and questions: privacy@pdfclay.com.

If this policy changes in a way that affects what is collected, the date at the top changes and the consent banner is shown again so the choice can be made afresh.