Privacy Policy
The short version: PDF Toolbox has no accounts, no upload endpoints, and no database. Live tools process your files entirely inside your browser and transmit nothing. The only optional data collection is Google Analytics, which loads solely if you explicitly accept it in the consent banner — and in the current build it is an unconfigured placeholder that does not load at all.
1. Who is responsible
PDF Toolbox is operated by the independent team described on the About page. For any privacy question or request, contact us at hello@pdf-toolbox.example or via the contact page.
2. Your documents never leave your device
Every live tool on this site (merging, splitting, compressing, rotating, signing, image conversion, and the rest) is implemented in JavaScript that runs in your browser. When you pick a file, it is opened by your browser from your own disk, transformed in your device's memory, and the result is offered back to you as a download. There is no server-side processing and no upload: this site is plain static files, and the tools work even offline or when opened from a local folder. We cannot see, store, scan, or log your documents, because they are never sent to us.
3. Server logs
We keep no logs of your documents — see above, they never reach a server. If you use the site over the web (rather than from a saved local copy), the static hosting provider that serves the HTML, CSS, and JavaScript files may keep standard technical request logs (requested page URL, timestamp, IP address, browser user-agent) for security and operations, as virtually all web hosting does. Those logs concern page requests only; your files are not part of any request.
4. Analytics — off by default, consent required
The site contains an integration for Google Analytics 4 with these properties, all of which you can verify in the site's public JavaScript (js/main.js):
- It loads only after you click “Accept analytics” in the consent banner. If you decline, or simply never answer, no analytics code is fetched and no analytics cookies are set.
- In the current build the measurement ID is the placeholder
G-XXXXXXXXXX, so the analytics loader is a no-op: nothing loads even after acceptance until a real ID is configured. - It never loads when the site is opened from a local folder (
file://). - When active, it is configured with IP anonymization (
anonymize_ip).
If and when analytics are active, Google LLC would process pseudonymous usage data (pages viewed, approximate location derived from a truncated IP, device and browser type) on our behalf to show us aggregate statistics. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time as described in section 6.
5. What is stored in your browser
The site stores exactly one value itself: your cookie choice, kept in your browser's localStorage under the key pdftoolbox-consent (value accepted or declined). It exists so the banner does not reappear on every page. It is not a tracking identifier, is never transmitted to us, and never expires on its own — it stays until you clear it or reset your choice. Google Analytics cookies (such as _ga) would additionally be set only under the conditions in section 4. Full details are on the Cookies & GDPR page.
6. Withdrawing consent
Click “Change cookie choice” in the footer of any page. This deletes the stored choice and re-opens the consent banner so you can decide again. You can also clear this site's data in your browser settings, which removes both the stored choice and any analytics cookies.
7. Ads and affiliate links
Some pages mark out advertising slots and affiliate links. In the current build these are non-live placeholders: no ad network code runs, no ad cookies are set, and the affiliate links do not point to live tracking programs. If that ever changes, this policy and the consent banner will be updated first, and any ad-related processing will likewise be gated on consent.
8. Contact and newsletter forms
The contact form and newsletter signup have no backend. Submitting them opens a pre-filled draft in your own email app; nothing is transmitted or stored by this website. If you send us that email, we receive what any email recipient receives — your address and your message — and we use it only to reply or, for the newsletter, to send you the issues you asked for. We do not add contact-form senders to any mailing list, and we do not share addresses with anyone.
9. Your rights under the GDPR
If you are in the EU/EEA or UK, you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), plus the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal, and the right to lodge a complaint with your supervisory authority. In practice, the personal data we could ever hold about you is limited to email you have sent us — ask and we will show you what we have or delete it.
10. Changes to this policy
If the site's behavior changes in a way that affects your privacy — for example, activating analytics with a real measurement ID or turning on ads — we will update this policy and the “Last updated” date above before the change goes live. The current version always lives at this address.