Privacy Policy

Last updated: October 25, 2026

TL;DR: Your files are processed in your browser and are never uploaded — not to us, not to anyone. To improve PDFree, we count anonymous usage events (for example, which tool was used and whether it worked). These never include your files, their contents, their names, or anything that identifies you.

Our Privacy Commitment

PDFree is built on a simple principle: your documents are yours. Every tool runs entirely on your device (client-side), so your files never need to leave your computer, tablet, or phone.

What Never Leaves Your Device

Your files: All PDF processing happens in your browser using JavaScript and WebAssembly. We have no document-processing servers, so your documents never reach us.
Their contents and names: Text, images, page contents and file names are never sent anywhere.
What you type into a tool: Passwords for Protect and Unlock, form values in Fill, text you add to a page — all stay on your device.
Personal information: No account, no email, no name required. We don't ask for it.

What We Count to Improve PDFree

To find out which tools fail, on which kinds of files and in which languages, and how long processing takes — so we can fix what doesn't work — PDFree sends small, anonymous usage events to our own server. An event contains only:

what happened: a tool was opened, a file was added, processing started, finished, failed or was cancelled, a result was downloaded;
the tool's name, and for a failure, its category (for example "password-protected file") or, for an unexpected one, the first 60 characters of the program's technical error message (for example "Invalid PDF structure") — messages from the PDF libraries about what failed, not your document's text or name;
the file's size as a range (for example "1–10 MB") and the processing time rounded to 5 seconds;
the site's language, and — added by our server — your country, your device type (desktop or phone) and browser family (for example "Chrome");
a random key created when the page loads and gone when you reload or close it, used only to tell which events belong to the same visit. It is not stored on your device and cannot link one visit to another;
for the site's tool search: how many tools matched, and, only when nothing matched, the text you typed (up to 50 characters), so we can add what people are looking for. Please don't type personal information into the search box.

We do not store IP addresses, use cookies, create a persistent identifier, fingerprint your browser, or sell or share this data for advertising. Visits from automated browsers are not counted. The events are kept in Cloudflare Workers Analytics Engine and deleted automatically after about three months.

We also use Cloudflare Web Analytics to count page views. It doesn't use cookies, and Cloudflare states it doesn't fingerprint visitors (cloudflare.com/web-analytics).

Feedback You Choose to Send

If you use the feedback form, we receive what you write, your email address if you choose to give one (only to reply to you), the tool and the error message if you're reporting a failure, the page's address, your device type and browser family, and a screenshot only if you attach one — please make sure it doesn't show anything confidential. Feedback is delivered to the developer through Telegram and is not stored in any database of ours.

What Is Stored on Your Device

Some things are kept in your browser's storage so the site works better for you. None of it is sent to us:

your theme (light or dark) and settings you saved for a tool;
your OCR language choices;
in Fill: a draft of the form values you're typing (deleted once you download the filled PDF), and your signature only if you choose to save it (you can remove it in Fill at any time);
downloaded resources that make tools faster next time: OCR language models, fonts for searchable PDFs, and the site itself for offline use;
when you click "Continue in…" to pass a result to another tool, that result is kept for up to 5 minutes so the next tool can open it, then deleted.

You can clear all of this at any time in your browser's settings (site data for pdfree.io).

Technical Details: How Privacy Works

Client-Side Processing

PDFree uses open-source libraries such as pdf-lib and pdf.js that run entirely in your browser. When you open a PDF in a tool:

The file is loaded into your browser's memory
JavaScript processes the file (merge, split, compress, etc.)
A new file is generated in memory
You download the result directly from your browser

At no point is the file transmitted over the internet to any server.

What Happens to Your Files

When you close or reload the tab, your files are cleared from memory. The only exception is a result you chose to pass to another tool, kept on your device for up to 5 minutes (see above). There are no server-side copies, because no server ever receives your files.

Third-Party Services

Like any website, PDFree loads some code and data from other servers. These requests carry the usual technical information of any web request (such as your IP address) to that server, but never your files:

Cloudflare hosts pdfree.io. The OCR engine, its language models and the fonts for searchable PDFs are served from pdfree.io itself.
cdnjs.cloudflare.com delivers pdf.js.
cdn.jsdelivr.net and unpkg.com deliver open-source libraries some tools load when you use them (for example the Excel, PowerPoint and Word converters).
huggingface.co delivers the name-detection model when you use automatic name detection in Redact. The model runs in your browser; your document is not sent.
Telegram and WhatsApp are opened only if you click a share button.

Data Security

Since your files never leave your device, the primary security model is your device's security:

HTTPS encryption: PDFree.io is served over HTTPS to prevent man-in-the-middle attacks
Content Security Policy: Strict CSP headers prevent cross-site scripting (XSS) attacks
No server-side attack surface for documents: Because no server processes files, there's no server holding them to hack

Your responsibility: Keep your device secure with up-to-date software, strong passwords, and antivirus protection.

Children's Privacy

PDFree does not knowingly collect personal information from anyone, including children under 13. The usage events described above are anonymous.

Changes to This Policy

If our practices change, we will update this page before the change takes effect and note the revision date at the top.

Compliance

GDPR (EU): Your documents are never processed by us — they stay on your device. Our usage statistics are designed to avoid personal data: no cookies, no stored IP addresses, no identifiers that link visits.

CCPA (California): We do not sell or share personal information.

Contact

If you have questions about this privacy policy or PDFree's privacy practices, you can reach us at:

Email: privacy@pdfree.io

Bottom line: We built PDFree to be the PDF tool we'd want to use with our own confidential documents. Your files never leave your device; what we count is anonymous and only there to make PDFree better.