Privacy Policy
Last updated 29 September 2026
PDFolio is designed to process your documents locally in your browser wherever possible. This policy explains precisely what data is processed, where, and by whom — honestly, based on the real architecture of the application.
1. Your files and local-first processing
The vast majority of PDFolio tools — merging, splitting, rotating, compressing, encrypting, redacting, filling forms, editing text, adding signatures, converting between formats, running OCR, and more — run entirely within your browser using PDF.js, pdf-lib, and WebAssembly libraries. Your files are loaded into browser memory, processed there, and the result is saved directly to your downloads. No file content is transmitted to a PDFolio server for these tools.
A small number of tools use on-device machine-learning models (text-to-speech, handwriting generation, speech-to-text). Those models are downloaded to your browser the first time you use the tool, cached by the browser, and then run locally. Your document text is not included in that model download.
2. AI features — server-side processing
The Chat with PDF, AI Summarizer, and Translate PDF tools send a text extract of your document pages to a PDFolio server-side API endpoint (/api/ai), which in turn forwards the text to a third-party AI provider (currently Google Gemini or OpenAI, depending on configuration). The provider processes the text and returns a response. The extracted text is not stored by PDFolio after the request completes.
What is sent to the AI provider: a plain-text extract of the document pages you are currently viewing (up to 32 000 characters). Binary file data, images, and metadata fields such as file name, author, or creation date are not forwarded.
AI provider data practices: When you use an AI feature, your extracted text is subject to the privacy policy of the active AI provider — Google's Privacy Policy or OpenAI's Privacy Policy. We recommend not using the AI tools for highly sensitive documents (legal, medical, financial, personal identification).
3. Analytics
PDFolio uses Vercel Analytics, which records page views and navigation events in an aggregated, privacy-preserving way. Vercel Analytics does not use cookies, does not fingerprint individual users, and does not collect personally identifiable information. Document contents are never sent to analytics.
4. Browser storage
Some tools save state between visits — workflow history, preferences, and recently used tool settings — in your browser's IndexedDB and localStorage. This data never leaves your device unless you explicitly export it. You can clear it at any time via your browser's site data settings.
Temporary processing artefacts (such as intermediate PDF pages) are stored in browser memory or the Cache API and expire automatically. PDFolio does not retain a copy of these files.
5. Cookies
PDFolio does not use tracking cookies or advertising cookies. The only browser storage used is IndexedDB and localStorage (described above) for application state, and the browser's Cache API for service-worker asset caching. No third-party advertising network is involved.
6. Optional cloud integrations
PDFolio includes optional, disabled-by-default integrations with Google Drive, Microsoft OneDrive, and Dropbox. If you connect a cloud account, an OAuth token is stored in your browser for that session. Files you choose to import from or export to a cloud provider are transmitted directly between your browser and that provider's API; they do not pass through PDFolio servers. These integrations are subject to each provider's own privacy policies.
7. Data retention and deletion
PDFolio does not maintain a user account system and does not store your documents on its servers. There is therefore no user-account deletion process. All data stored locally can be deleted by clearing your browser's site data for pdfolio.in (or whichever domain you are using).
Server-side access logs (IP address, request path, timestamp) may be retained by the hosting provider (Vercel) for up to 30 days in accordance with their standard log-retention policy.
8. Security
The application is served over HTTPS. API requests to AI providers are made server-side so that provider API keys are never exposed to the browser. File uploads to the local processing pipeline are validated for MIME type and size before processing. We apply server-side rate limiting to public API endpoints to protect against abuse.
9. Children's privacy
PDFolio is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has provided information through an AI feature, please contact us so we can address it.
10. Your rights
Because PDFolio does not store personal data about individual users on its servers, there is no personal data to access, correct, or delete through us. For data held by third-party providers (Google, OpenAI, Vercel), please contact those providers directly using the links in the relevant sections above.
11. Changes to this policy
We may update this policy when the application architecture or third-party providers change. The date at the top of this page reflects the most recent revision. Continued use of PDFolio after a change constitutes acceptance of the revised policy.
12. Contact
Privacy questions or concerns can be directed to rshyamcse@gmail.com.