Privacy Policy

Last updated: 18 September 2026

1. Who we are

PDFDad ("we", "us", "our") operates this website. We are the data controller for the limited personal information described in this policy. You can reach us at support@pdfdad.com with any question about your data, or about this policy.

2. The most important thing: your files

All thirty tools on this site run as JavaScript and WebAssembly inside your own web browser. When you add a document to a tool, the file is read from your disk into your browser tab's memory, processed there, and written back out as a download. It is never transmitted to our servers or to anyone else's.

This is not a promise about how carefully we handle your uploads. It is a statement that there are no uploads. We have no file storage, no processing queue and no retention schedule, because there is nothing to store. If a court asked us to produce a document you processed here, we could not, and neither could anyone who compromised our hosting.

You do not have to take our word for it. Open your browser's developer tools, select the network tab, and run any tool on this site. You will see the page and its libraries load, and then nothing further. Alternatively, load a tool page, turn off your network connection, and use the tool — it works, because it never needed the network.

The same applies to passwords. When you encrypt a document with Protect PDF or decrypt one with Unlock PDF, the password is used to derive a key in your browser and is then discarded. It is never transmitted and we never hold a copy, which is why we cannot help you recover a lost one.

3. What we do collect

3.1 Information you give us voluntarily

If you use the contact form or email us, we receive whatever you choose to send: typically your name, your email address and the content of your message. We use it to answer you and for nothing else. We keep correspondence for up to 24 months so that we can follow up on bug reports and see patterns in what people are asking for, then delete it.

3.2 Information stored in your own browser

We store two small pieces of information in your browser's local storage. Local storage is not a cookie and is not transmitted to any server; it stays on your device and you can clear it at any time through your browser's settings.

• pdfdad-theme — whether you chose light or dark mode, so the site does not forget between visits.
• pdfdad-consent — the cookie choice you made in the consent banner, so we do not ask again on every page.

3.3 Server logs

Like virtually every website, our hosting provider records standard access logs when a page is requested: the IP address of the requesting device, the time, the page requested, the referring page and the browser's user-agent string. These logs exist for security and for diagnosing faults. They are retained for up to 30 days and then deleted. We do not use them to build profiles of individual visitors.

4. Cookies and similar technologies

We set no cookies of our own beyond what is described above. Cookies on this site come from third-party advertising and analytics services, and only after you consent to them in the banner shown on your first visit.

4.1 Google AdSense and the DoubleClick DART cookie

This site displays advertising served by Google AdSense. Google and its partners use cookies to serve ads based on your prior visits to this and other websites.

• Google, as a third-party vendor, uses cookies to serve ads on this site.
• Google's use of the DoubleClick DART cookie enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• You may opt out of personalised advertising by visiting Google's Ads Settings.
• You can opt out of third-party vendors' use of cookies for personalised advertising at aboutads.info/choices or, in Europe, at youronlinechoices.com.
• Third-party vendors and ad networks other than Google may also serve ads on this site and may use their own cookies to do so.

If you decline advertising cookies, you will still see advertisements — they will simply be contextual rather than personalised, and less relevant to you.

4.2 Google Analytics

If you consent to analytics cookies, we use Google Analytics to understand which tools are used and which pages fail, so that we can prioritise fixes. IP addresses are anonymised before storage. We do not use Analytics for advertising remarketing. If you decline, no Analytics script is loaded at all.

4.3 Consent Mode

We implement Google Consent Mode v2. Before you make a choice, advertising and analytics storage are set to denied, and the relevant scripts do not run. Your choice updates that state. You can change your mind at any time using the "Cookie settings" link in the footer of every page.

4.4 Content delivery networks

The PDF processing libraries are loaded from jsDelivr, a public content delivery network, and one web font is loaded from Google Fonts. Making a request to those services necessarily discloses your IP address to them, as any request to any server does. Both are loaded with Subresource Integrity hashes, so a modified file would be refused by your browser. We ship local copies of the libraries as a fallback, and after a tool's first use your browser caches them, so subsequent uses need no external request at all.

5. Legal bases for processing (UK and EU visitors)

Where the UK GDPR or EU GDPR applies, we rely on the following bases:

• Consent (Article 6(1)(a)) for advertising and analytics cookies. You give it in the banner and may withdraw it at any time.
• Legitimate interests (Article 6(1)(f)) for security logging and for keeping the site available and free from abuse. We have assessed that this does not override your rights, given the short retention period and the absence of profiling.
• Legitimate interests for responding to correspondence you initiate.

6. Your rights

6.1 Under the UK and EU GDPR

You have the right to request access to the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office.

In practice we hold very little: unless you have written to us, the only personal data in our possession is likely to be an IP address in a server log that will be deleted within 30 days. To exercise any right, email support@pdfdad.com. We respond within one month.

6.2 Under the CCPA and CPRA (California)

California residents have the right to know what personal information is collected, used, shared or sold; to delete personal information; to correct inaccurate information; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising those rights.

We do not sell your personal information and we never have. Under the CPRA's broad definition, the use of third-party advertising cookies may constitute "sharing" for cross-context behavioural advertising; declining advertising cookies in our banner opts you out of that entirely. To make any other request, email support@pdfdad.com.

7. Children's privacy (COPPA)

This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it promptly. Because the tools require no account and process files locally, there is in practice very little for a child — or anyone — to disclose.

8. International transfers

Our hosting and the third-party services described above may process data outside your country, including in the United States. Where the UK or EU GDPR applies, such transfers rely on the providers' standard contractual clauses or on an adequacy decision. Your documents are not affected by any of this, because they are never transmitted anywhere.

9. Security

The site is served over HTTPS. External scripts are pinned to specific versions and loaded with Subresource Integrity hashes, so a tampered file will not execute. Because we hold no user files and no accounts, the most damaging class of breach — a leak of customer documents — is not possible here by construction rather than by policy.

10. Third-party links

Our pages link to external sites, such as the advertising opt-out pages above. We are not responsible for their content or their privacy practices, and we encourage you to read their own policies.

11. Changes to this policy

We may update this policy as the site changes or the law does. The "last updated" date at the top always reflects the current version. Material changes that affect your rights will be announced with a notice on the site. Continued use after a change constitutes acceptance of the updated policy.

12. Contact

Questions about this policy, or about data we may hold, go to support@pdfdad.com. We aim to respond within two working days and are obliged to respond to formal data-protection requests within one month.