Privacy policy

• Files you upload, and the files our tools create from them. We also store each file's name, type, size and page count.
• Job details: the tool you used, when, whether it worked, and the settings you chose. Depending on the tool, settings can include text you add, form answers, the areas you redact or a web address you convert. The file name is shown in your activity list.
• Account details. Accounts are created with Sign in with Google, which you need to download files: we receive your Google account ID, email address and name. We don't receive your Google password or access to anything else in your Google account. Accounts created earlier with an email and password keep that password only as a one-way Argon2id hash.
• Session details: when you sign in we store a random session ID (only as a hash), the browser type it was created with, and when it was last used.
• Usage totals: for accounts, daily counts of jobs, pages and data processed, which power the charts in your dashboard. For the site as a whole, a daily count of how often each tool is opened and used, which holds no account, IP address or file information.
• Website analytics: we use Google Analytics to see how the site is used, such as the pages you visit, how you found the site, your device and browser type and your approximate location, linked to a random ID stored in a cookie. Google Analytics never receives your files or their names, and isn't loaded on share links.
• Hosting logs. Requests pass through Amazon's content delivery network, which records details such as your IP address, browser type and the page requested, as standard for websites. Our own servers keep short technical logs of requests (time, address requested, response and browser type).
• Emails you send us, and our replies.

We don't collect payment details, precise location, contacts or advertising identifiers.

• To run the tools you ask for and give you the results.
• To keep your documents, activity and usage charts in your account.
• To keep the service secure and working: limiting repeated sign-in attempts, preventing misuse and fixing problems.
• To understand which pages and tools people use, so we can improve them.
• To answer you when you contact us.
• To meet legal obligations.

We don't sell personal data, show ads, build advertising profiles or use your files to train AI models. People at PocketPDF don't open your files unless you ask us to help with a specific file or the law requires it.

We process personal data with your consent, which you give when you upload a file or create an account and can withdraw at any time, or for the legitimate uses allowed by section 7 of the DPDP Act, such as using data you have voluntarily given us for the purpose you gave it.

We use the cookies the service needs to work, plus Google Analytics cookies. None is used for advertising, and the site stores nothing else in your browser.

• pdfsaas_session keeps you signed in. It lasts 14 days, or until you sign out.
• pdfsaas_guest links the files you make before signing in to your browser, so they move into your account when you sign in there. It lasts 7 days, or until you sign out; the files themselves are deleted after 1 hour unless you sign in.
• pdfsaas_oauth protects Sign in with Google. It's set only while you sign in and expires after 10 minutes.

These three can't be read by scripts on the page and are sent only to this site.

• _ga and _ga_T4Y4Q3Y89P are set by Google Analytics to tell visits apart. They last up to two years. Google signals and ad personalisation are switched off.

To stop analytics, block cookies for this site in your browser, use your browser's tracking protection or install Google's Google Analytics opt-out add-on. The tools keep working either way.

We use a small number of service providers to host and run PocketPDF. They process data only on our behalf:

• Amazon Web Services, in its Mumbai (India) region, runs the servers that process files and stores the files, encrypted. AWS also delivers the website itself through its content delivery network.
• Neon hosts our database (account details, file records, activity and usage totals) on AWS in Singapore.
• Google, which provides Sign in with Google (needed to download files) and Google Analytics. Google may process analytics data outside India, including in the United States.
• Our email provider, for messages you send to us.

When you convert a web page by its address, our server visits that address for you, so the website sees our server rather than you.

Files you put in a share link can be downloaded by anyone who has the link until it expires or you revoke it. Apart from that, we disclose personal data only when the law requires it, or when it's needed to protect the safety of people or the service.

Because the database is in Singapore and analytics are processed by Google, some personal data is processed outside India. The DPDP Act allows this, except to countries the Government of India restricts by notification.

• Files made before signing in, and their results: deleted automatically after 1 hour, with their activity records, unless you sign in on the same browser, which moves them into your account.
• Files in an account: until you delete them, or your account (up to 1 GB of storage).
• Activity history in an account: 30 days.
• Daily usage totals: until you delete your account.
• Share links: up to 7 days, and never longer than the file.
• Passwords you give Protect PDF or Unlock PDF: only until the job finishes. They're then removed from our records.
• Our servers' technical logs: deleted on a rolling basis, generally within a few weeks.
• Google Analytics data: kept by Google for the retention period set in our Google Analytics account.
• Emails: as long as needed to deal with your message.

Deleted files are removed from storage straight away. We don't keep hidden copies.

Under the DPDP Act you can ask for a summary of the personal data we hold about you, ask us to correct, complete or update it, ask us to erase it, withdraw your consent, nominate someone to exercise these rights for you if you die or become unable to, and have grievances dealt with.

• Delete files one by one or all at once in Documents.
• Delete your account, with every file and record in it, under Settings in the dashboard.
• Sign out of every device from Settings.
• For anything else, including a copy of your data or a correction, email hi@pocketpdf.in from the address on your account.

We'll respond within 30 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

Connections are encrypted, stored files are encrypted, and each file can be downloaded only by the browser or account that owns it. Passwords and session IDs are stored only as hashes. How your files are handled has the details.

Accounts are for people aged 18 or over. If you believe a child has created an account, email hi@pocketpdf.in and we'll delete it.

When we change this policy we update the date at the top. If a change affects how we use data you've already given us, we'll say so on the site before it takes effect.

Questions, requests and complaints about personal data go to hi@pocketpdf.in. See also the Terms of service.