Privacy Policy

What We Do NOT Collect

• No document data: Your PDF file content, text edits, images, and metadata are never transmitted to any server.
• No personal information: We do not ask for your name, email, phone number, or any identifying information. No account creation is required.
• No cookies for tracking: We do not use tracking cookies, advertising pixels, or analytics that identify individual users.
• No usage telemetry: We do not log what you type, what files you open, or how you use the editor.
• No IP address logging: We do not store or process your IP address beyond standard web server access logs (which are rotated and not linked to user identity).

How Client-Side Processing Works

When you load a PDF in EditPDF:

1. The PDF binary is read via the browser's native FileReader API into your device's local memory (RAM).
2. PDF parsing, text extraction, and rendering are performed entirely by JavaScript and WebAssembly running in your browser's sandboxed V8/SpiderMonkey engine.
3. When you edit text, changes are applied to an in-memory representation of the PDF.
4. When you click "Download", a new PDF is generated client-side and saved to your local device.
5. When you close the browser tab, all data is purged from memory. Nothing persists.

You can verify this yourself: Open your browser's Developer Tools → Network tab. You will see zero outbound requests containing document data during the entire editing session.

Third-Party Services

EditPDF uses the following external services, none of which have access to your document data:

• Google Fonts (fonts.googleapis.com): Used to load the Inter typeface. Google Fonts does not set cookies or track users in compliance with GDPR.
• Static web hosting: Our HTML, CSS, and JavaScript files are served from a CDN. Only static assets are served — no server-side document processing occurs.

Regulatory Compliance

Because EditPDF processes zero personal data on remote servers, our architecture inherently complies with data protection regulations:

• GDPR (EU): No personal data is processed by us, eliminating data controller/processor obligations.
• CCPA (California): No personal information is sold, shared, or collected.
• HIPAA (US Healthcare): Since Protected Health Information (PHI) never leaves your device, no Business Associate Agreement (BAA) is required.