Privacy policy

Who is responsible

This service is operated by Easy Edit PDF, based in British Columbia, Canada. We are responsible for the personal information described here. For any question about this policy or your data, or to make a request, write to our privacy contact at [email protected].

What we collect and why

The PDFs you upload

We store the file you upload, a structural analysis of it, a small image of its first page for your documents list, the edits you make, and each version you export. We need these to show you the document, apply your changes and produce the exported file. We do not read your documents for any other purpose.

PDF tools that run in your browser

Our standalone PDF tools — adding a watermark, merging PDFs, turning images into a PDF — are different: they process your files in your browser, on your own device, and the files are not uploaded to our servers. The page where a tool works on your files loads no advertising and no third-party analytics. If you choose the files on the tool's introduction page, your browser keeps them briefly in its own storage to pass them to the tool, as the cookie policy describes. We receive only the product events described below — which tool ran, why a file was refused, and ranges for the number of pages and of files — never the files, their names, their sizes or the watermark you added.

Password-protected PDFs

If a PDF needs a password to open and you give us the password, we use it once to unlock the file and then delete it. The password is never stored with your document or written to a log, and it is held for at most fifteen minutes. What we do keep is the unlocked copy of the document, because editing and exporting happen later when there is nobody to ask for the password again. That copy is protected by the same access controls, kept for the same retention period and deleted at the same time as the rest of the document.

Account information

You can edit without an account. To export, you need a free account with a verified email address. For an account we store your email address, display name, a hash of your password (never the password itself), whether and when your address was verified, and how many exports you have used this month. If you sign in with Google we store the identifier Google gives us for your account and the email address and name on it, not your Google password.

We use your email address to send you what the service needs to: a code to verify the address, password resets, and notices about your account or changes to our terms. We do not send marketing email.

Saved signatures

When you draw a signature in the editor and choose to save it to your account, we store the strokes you drew, so you can place it in other documents without drawing it again. You can keep up to five, and delete any of them from the signature dialog. A signature you place without saving it is stored only as part of that document's edits.

Sign-in sessions and security records

When you sign in we store, with that session, the IP address and browser description it started from, so you can see and end your active sessions and so we can investigate misuse. When you upload without an account we store the IP address the anonymous session started from, and keep short-lived counters by IP address to stop one network creating sessions in bulk. When you create an account, or upload for the first time without one, Cloudflare's Turnstile check may run in your browser to tell a person from an automated script; it sends Cloudflare information about your browser and device for that purpose only, and we receive only whether the check passed. Our servers log each request they handle, including its IP address. Logs never contain the contents of your PDFs, their file names, or download links.

Product events

The application reports a fixed list of events — an upload started, an export completed, an editing action of a particular kind — so we can tell whether the service works and where it fails. They are sent to our own server, which discards any detail not on the list and stores the rest. Each event carries identifiers, counts and labels from a fixed vocabulary only: a random identifier for your workspace, a document identifier, sizes, page counts, timings, and values such as the kind of edit or the reason an upload was refused. None carries your name, email address, document text or file name. The events from the in-browser PDF tools are sent without your cookies and stored with no workspace or document identifier.

Our server forwards these stored events to PostHog, our product-analytics provider. They are sent from our server, not your browser, so PostHog receives no cookie, IP address or browser details of yours from this route. This happens whatever you choose in the cookie banner, which controls the analytics that run in your browser. You can object to it by writing to us.

Analytics on our public pages

On our public marketing pages — not the editor, your documents, the pages where the in-browser tools work on your file, sign-in or these legal pages — we use Google Analytics and PostHog in your browser to see how visitors find and use the site. They load only if you accept analytics in the cookie banner, and they record the public page you are on, the site that referred you, your device and browser, and an approximate location derived from your IP address. PostHog's automatic capture of what you click and its screen recording are both switched off. See the cookie policy.

How fast our pages load

On every page, your browser measures how long the page took to load and sends those timings to our own server. This uses no cookies and stores nothing on your device, and it does not need your consent because nothing in it identifies you or your documents. Each timing is recorded with the kind of page (the address itself only for our public pages), whether your device looks like a phone or a computer, and where you are: your country and, in the United States and Canada, your state or province, as worked out by our network provider from your connection. We do not keep your IP address, or your city, with it. We use it to find places where the site is slow.

Feedback and messages

If you send feedback from inside the application, we store your message, the reply address you give, and any screenshots or files you attach. If you email us, we keep the correspondence so we can answer it. Please do not send us a confidential document to explain a problem; a document ID is enough.

Payments

Paid plans are sold through Link, a service of Stripe, as the seller of record. We hold no payment details:

• Your card or other payment details go to Stripe directly, never to our servers. Stripe handles them, your billing address and the transaction under its own privacy policy, linked at checkout.
• We give Stripe your account's email address and an internal identifier for your workspace. Of what Stripe sends us about your purchase, we keep only Stripe's identifiers for your customer record and subscription, which plan you bought, whether it is active, and when it renews or ends. For a 7-day Pro pass we keep Stripe's identifier for the checkout in which you bought it, and when the pass starts and ends. We never receive your full card number.
• You can ask Link to delete your payment data. Doing so cancels any subscription bought through it; a pass you have already paid for keeps running to its end.

What we never do

• We do not send the contents of your PDFs, or their file names, to any analytics or advertising system. Event details are filtered against a fixed list on our server, so content cannot be sent even by mistake.
• We do not use your documents to train machine-learning models.
• We do not sell your personal data.
• We do not perform OCR. There is no service, queue or third party that reads text out of images of your documents.

Our legal basis

In Canada, we rely on your consent. By using the service you consent to us collecting and using the information above for the purposes described, which are the ones needed to provide and protect it. Optional analytics in your browser need your express consent through the cookie banner; the page-load timing described above does not, because it stores nothing on your device and identifies no one. You may withdraw consent at any time; withdrawing it for the information the service cannot run without means closing your account.

If you are in the European Economic Area or the United Kingdom, we rely on these bases under the GDPR and UK GDPR:

• Performing our contract with you — storing and processing your documents, running your account, keeping the signatures you save, running a paid plan you buy, and sending the email the service needs.
• Our legitimate interests — keeping the service secure and preventing abuse (session records, logs, rate limits, the robot check and backups), understanding whether the product works through the product events described above, finding the places where our pages load slowly through the page-load timing described above, and answering feedback. We keep each of these to what its purpose needs, and you can object to them.
• Your consent — the optional analytics that run in your browser on our public pages. Refusing or withdrawing it changes nothing else about the service.
• Legal obligation — records we are required by law to keep, and responding to lawful requests.

Where your data is processed

Your documents, account and the records above are stored on servers we run ourselves in Canada, and our backups are kept there too. Some of our providers are based in the United States or operate worldwide, so information they handle is processed outside Canada: Cloudflare, which carries every request to the site; Resend, which sends our email; PostHog and Google Analytics; Google, if you sign in with it; and Stripe, once you start buying a paid plan. Information held in another country is subject to its laws, and may be accessible to its courts and authorities.

If you are in the EEA or the UK: Canada is recognised by the European Commission and the UK as providing adequate protection for personal data handled by commercial organisations. For transfers to providers in the United States we rely on the safeguards in each provider's data processing terms, such as the EU Standard Contractual Clauses and the UK addendum to them, or on the EU–US Data Privacy Framework where the provider is certified under it.

Who else processes your data

We use a small number of service providers: a network provider, an email provider, sign-in with Google, and two analytics providers. Each receives only what it needs. They are listed, with the data each receives and where it is based, on the subprocessors page. We may also disclose information where the law requires it.

How long we keep things

Your documents

Files uploaded without an account are kept for one day from upload. Files on a free account are kept for 7 days from upload — or from when the file moved into your account, if you uploaded it before you had one. You can delete a file yourself at any time before then. The structural analysis, the first-page image, your edits, your exported versions and any unlocked copy are all deleted with the file.

Deletion happens in stages. The file is first marked for deletion, and we record when. It is then removed from our primary storage, normally within 24 hours, and we record when that happened too. Copies can remain in our backups after that: backups are taken nightly and each is deleted after 14 days, so a copy can outlast primary deletion by a little over two weeks, and never by more than 30 days. Backups are used only to recover the service and to test that recovery works.

Everything else

• Your plan's billing record — Stripe's identifiers for your customer record, your subscription and the checkout of any pass, the plan, its status and a pass's dates — until you delete your account, which also ends a pass that is still running, or until Stripe deletes your customer record at your request, when the identifiers go and a pass you paid for runs to its end. Stripe keeps its own records of your payments, as the seller of record, under its own policy.
• Your account — until you delete it. When you do, your email address, name, password hash, Google link, saved signatures and every session are removed immediately, and your documents are deleted as described above.
• Sign-in sessions, with their IP address and browser description. A session stops working when you sign out, after 14 days without use, or 30 days after you signed in. Its record is deleted 7 days after you sign out or it reaches the 30-day limit, so none is kept more than 37 days after sign-in. Anonymous sessions, with the IP address they started from, are deleted after one day. The counters used to limit sessions per network last about an hour.
• Server logs — 30 days.
• Backups — 14 days, as above. They include account records as well as files, so a deleted account can remain in a backup for the same period.
• Feedback — attachments are deleted after 90 days. The message is kept for as long as it is useful for fixing the problem it describes. If you delete your account, the reply address is removed from feedback sent from it. Email you sent us directly is not linked to your account and is not removed with it; ask, and we will delete it.
• Product events — kept by us and by PostHog without a fixed end date. They identify a workspace, not a person, and once your account is deleted nothing links that workspace to your name or email address.
• Security audit records — records of administrative actions, and of an account being deleted, are kept without a fixed end date so that what happened can be established later. The record of an account deletion contains no email address and no document details.
• Optional analytics — Google Analytics and PostHog keep what they collect in your browser under the retention settings of our accounts with them. The cookies themselves expire as listed in the cookie policy.

Your rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, and ask us to delete it. You can download and delete your documents, see and end your sessions, and delete your whole account yourself, from within the product. For anything else, email [email protected] from the address on your account. We verify that a request comes from the account holder before acting on it, and reply within 30 days.

If you are in the EEA or the UK you also have the right to restrict or object to our processing, including processing based on legitimate interests, to receive your data in a portable form, and to withdraw consent at any time without affecting what happened before.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or the Office of the Information and Privacy Commissioner for British Columbia. In the EEA you can complain to the data protection authority where you live or work, and in the UK to the Information Commissioner's Office.

Cookies

We set cookies to keep you signed in and to keep an anonymous upload yours when the page reloads. Analytics cookies are optional and set only if you accept them. Neither kind is used for advertising. The cookie policy lists each one.

Security

Files are stored privately and are never publicly readable. Download links are short-lived and specific to one file. Passwords are hashed with Argon2id. Our administration console cannot open your documents or show their contents. The people who run our servers can reach stored files directly, and that access is not recorded by the application; we do not look at your documents unless you ask us to while we help you, or the law requires it. More detail is on the security page.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic limits — file size, monthly exports, rate limits — can stop an action, and a person will review one on request.

Children

This service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal information, write to us and we will delete it.

Changes

The version and effective date of this policy are at the top of the page. If we change it in a way that materially affects you, we will tell you before the change takes effect — by email if you have an account — and, where the law requires it, ask you to accept the new version. Older versions are available on request.

Upload limits referenced in this policy: files must be smaller than 5 MiB on the free plan and without an account, and smaller than 25 MiB on a paid plan.