Privacy Policy

pdfcosmos (“pdfcosmos”, “we”, “us”, or “our”) provides free, local-first PDF tools that run in your web browser. This Privacy Policy explains how we handle information when you visit our website and use our tools, the choices you have, and the rights you may have under laws such as the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

pdfcosmos is operated by a small, independent team (you can read more on our About page). For the purposes of data-protection law, we act as the “data controller” for the limited personal data described here. The exact rights and protections available to you may depend on where you live.

In short: our tools are built so that your files are processed on your own device and are never uploaded to us. As a result there is very little personal data for this policy to describe, but we set it out in full below so you know exactly where you stand.

pdfcosmos is built to be local-first. When you use a tool labelled “processed in your browser”, your files (PDFs and images) are processed entirely on your own device using WebAssembly. They are never uploaded to, transmitted to, or stored on our servers.

We never see, receive, access, or retain your file contents, file names, or document metadata. You can verify this yourself by opening your browser’s Network tab while using a tool: no file data leaves your device.

This local-first design is the foundation of everything below: because your documents never reach us, we cannot read, copy, share, lose, or be compelled to hand them over.

To keep this policy clear, here is what we mean by some of the terms we use:

One tool, Scan to PDF , asks for your browser’s camera permission so you can photograph document pages. The captured frames are cropped and assembled into a PDF entirely on your device. They are never uploaded, transmitted, or stored by us.

The camera is used only on that one tool, only while you are actively capturing pages, and access is released as soon as you finish. You can decline the permission, revoke it in your browser at any time, and use the “choose photos” option instead. No other tool on pdfcosmos requests the camera, and we do not request any other device permission such as your microphone, location, or contacts.

We deliberately collect as little as possible, and you never need to create an account. The table below lists categories of data a typical website might collect, and what pdfcosmos actually does with each:

When your browser requests a page from pdfcosmos, our hosting/CDN provider processes the standard technical information that every web request includes: for example, your IP address, browser type and version, operating system, the page requested, and the date and time. This happens for any website you visit and is necessary to deliver the page and keep the service secure and reliable.

We do not use these server logs to identify you personally or to build advertising profiles. Separately, and only with your consent, we use Google Analytics to understand how the site is used and show advertising to keep it free. Both are described under “Analytics and advertising” below.

Because your files are processed locally, there is very little data for us to use. We use the limited information described above only to:

• Deliver the website and its tools to your browser and keep them working.
• Maintain the security, integrity, and reliability of the service and prevent abuse or fraud.
• Diagnose technical problems and improve how the site performs.
• Understand, in aggregate, how the site is used so we can improve it (analytics, only with your consent).
• Show advertising that helps keep pdfcosmos free (only with your consent).
• Respond to you if you contact us, and keep a record of that correspondence.
• Comply with our legal obligations and enforce our Terms of Service .

If you are in the European Economic Area (EEA) or the United Kingdom, data-protection law requires us to have a “legal basis” for processing your personal data. Our bases are:

pdfcosmos uses a limited set of cookies and similar technologies. Some are strictly necessary to run the site securely and remember your choices. Others, used only with your consent, are for analytics and advertising. Your theme preference is kept separately in your browser’s local storage, which is not a cookie and never leaves your browser.

In the EEA, UK, and Switzerland we ask for your consent through a cookie banner before any non-essential (analytics or advertising) cookies are set, and you can change your choices at any time. Our Cookies Policy lists the categories we use, their lifetimes, and how to control them.

To keep pdfcosmos free, we use Google Analytics to see how visitors use the site, and we show third-party ads on some pages. Both use cookies, and both are turned on only after you agree. Analytics collects usage data such as your IP address (shortened or anonymised where that option is available), the pages you open, and your device and browser type. We look at this only in totals, to improve the site, and never to identify you personally.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. These advertising cookies let those vendors show you ads and measure how they perform based on your browsing. This is called personalised advertising. Ads appear around the tools, never inside the file-processing area, and advertisers never receive your files.

You can turn off personalised advertising at any time. Use our cookie settings on this site, Google’s Ads Settings (adssettings.google.com), or industry opt-out tools such as YourAdChoices (aboutads.info) and Your Online Choices (youronlinechoices.eu). Our Cookies Policy explains these cookies in more detail.

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law.

• Your files: not retained at all. They are processed in your browser and never reach us.
• Theme preference: stays in your browser’s local storage until you clear it. You can remove it at any time in your browser settings.
• Server logs: retained by our hosting/CDN provider for a limited period under that provider’s own security and reliability policies, then deleted or anonymised.
• Analytics and advertising cookies: stored on your device for the lifetimes listed in our Cookies Policy (typically up to about 13 to 24 months), and analytics records are kept by our analytics provider for a limited, configured period.
• Emails: correspondence you send us is kept for as long as needed to handle your request and for a reasonable period afterwards for our records.

Because our tools run locally, your files are not transferred anywhere. They stay on your device. The limited technical data involved in serving the website may, however, be processed in more than one country: our hosting/CDN provider operates a global network and may deliver pages and store short-lived logs from data centres outside your own country, including outside the EEA or UK. Our analytics and advertising providers may likewise process data in other countries, including the United States.

Where these transfers involve personal data protected by EEA or UK law, they are intended to be covered by appropriate safeguards, such as Standard Contractual Clauses or another lawful transfer mechanism offered by these providers, so your data stays protected wherever it is processed.

Security is built into the design of pdfcosmos. Because your files are processed on your own device and never uploaded, there is no central store of your documents for anyone to breach, and nothing for us to lose or be compelled to disclose. This is the strongest privacy protection we can offer.

The website itself is served over encrypted HTTPS connections, and our hosting/CDN provider applies commercially reasonable technical and organisational measures to protect the limited data it processes. That said, no method of transmission over the internet or electronic storage is completely secure, so while we strive to protect your information, we cannot guarantee absolute security.

We do not sell, rent, or trade personal data, and we cannot disclose your files because we never hold them. We may, however, disclose the limited data we do have in these narrow circumstances:

• Legal requirements: if required by law, regulation, legal process, or an enforceable governmental request, or to protect the rights, property, or safety of pdfcosmos, our users, or the public.
• Business transfers: if pdfcosmos is ever involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and we will honour the commitments in this policy.
• Service providers and partners: our hosting/CDN provider, our analytics provider (Google Analytics), and our advertising partners process limited data to deliver, secure, measure, and fund the site, under contractual data-protection obligations.
• With your consent: in any other case, only at your direction or with your consent.

We keep third parties to a minimum. The site relies on a hosting/CDN provider to store and deliver these pages, on Google Analytics to measure usage, and on advertising partners to show ads. The last two run only after you consent. The open-source engines that power the tools run locally in your browser and send nothing to anyone. You can review each of them on our Credits & licenses page.

Our pages may link to third-party websites we do not control. This policy does not apply to those sites, and we are not responsible for their content or privacy practices, so please review their own policies before providing any information.

You have rights over your personal data, and we will honour them wherever you live. Because we hold so little data, exercising many of these rights will simply confirm that we have nothing about you, but you are always entitled to ask.

Depending on your location (for example under the EU/UK GDPR), you may have the right to:

• Access: ask what personal data we hold about you and receive a copy.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete personal data we hold (“right to be forgotten”), where no legal obligation requires us to keep it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Portability: receive certain data in a portable, machine-readable format.
• Objection: object to processing we carry out on the basis of legitimate interests.
• Withdraw consent: where we rely on consent (such as camera access), withdraw it at any time, without affecting earlier processing.

If you are a California resident, you have the right to know what personal information we collect and how it is used, to access, delete, or correct it, to opt out of the “sale” or “sharing” of personal information, and not to be discriminated against for exercising your rights.

We do not sell your personal information for money. However, the use of advertising cookies for personalised advertising may be considered a “sale” or “share” under California law. You can opt out at any time through our cookie settings, and we honour opt-out preference signals such as Global Privacy Control (GPC). We do not offer financial incentives in exchange for data. To exercise any right, email us at [email protected]. We may need to verify your identity first, you may use an authorised agent, and we will respond within the timeframe the law requires.

If you are in the EEA or the UK and believe we have not handled your personal data lawfully, you have the right to lodge a complaint with your local data-protection supervisory authority. That said, we would appreciate the chance to address your concern first, so please contact us at [email protected].

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not profile you. The tools simply perform the task you ask of them, on your device.

Some browsers can send a “Do Not Track” (DNT) or Global Privacy Control (GPC) signal. There is no common industry standard for DNT. Like most sites, we do not respond to DNT on its own. Where the law requires, though, we treat a GPC signal as a valid request to opt out of the “sale” or “sharing” of personal information for advertising. You can also manage analytics and advertising at any time through our cookie settings.

pdfcosmos is a general-audience service and is not directed at children, and we do not knowingly collect personal information from children (for example, those under 16 in the EEA or under 13 in the United States). If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law. When we do, we will revise the “Last updated” date above, and for significant changes we will make the update clear on this page. If our data practices change (for example, if we work with a new analytics or advertising provider), we will update this policy and our Cookies Policy and, where the law requires, ask for your consent.

If you have any questions about this Privacy Policy, want to exercise your rights, or have a privacy concern, email us at [email protected]. Please don’t send us your PDFs. You never need to, because the tools work entirely in your browser.