Privacy

Core PDF work

For the current core tools, supported PDFs, PNGs, and JPGs are opened with browser file APIs. Import, preview, reorder, rotate, delete, visual overlays, local compression attempts, metadata cleanup at export, and PDF export run in the browser session.

PrivateLocalPDF does not require a PrivateLocalPDF account for free basics and does not add a watermark to basic local exports.

What can leave the browser

• Stripe Checkout receives Local License plan data, amount, currency, one-time cadence, entry point, surface, and timestamp. It should not receive PDF bytes, filenames, thumbnails, page text, hashes, exact document type, or PDF metadata values.
• License restore sends the license key and provider metadata to the configured validator. It should not send PDF bytes or document-derived details.
• Normal web hosting receives requests for public site assets and routes.
• Support requests should avoid PDF files, filenames, document text, personal identifiers, screenshots of document pages, and other sensitive document contents.

PostHog analytics

PostHog product analytics are disabled unless the launch build is explicitly configured with the PostHog enable flag and key. When enabled, the launch app sends only the fixed anonymous app_loaded event through a direct capture endpoint instead of attaching a broad autocapture library.

The analytics client uses an anonymous session id, disables person profiles, and does not use session recording or autocapture. The launch app_loaded payload is limited to analytics enabled state, schema version, product, surface, and person-profile suppression.

• Do not send filenames, paths, document text, OCR output, thumbnails, page images, PDF metadata values, hashes, page counts, file counts, selected-page scope, output-size buckets, compression settings, edit actions, workflow result metadata, exact document categories, raw exceptions, or stack traces.
• QA-only zero-upload checks should use synthetic fixtures and stay separate from real user product analytics.

Browser storage

The workspace may hold document data in memory, object URLs, and browser-managed storage during the active session. Local License restore can cache license metadata in browser local storage so the paid tier can be restored in that browser.

Clearing site data, using private browsing, or changing browsers can remove local state and may require re-importing files or restoring the license key.

Important limits

Browser-local processing is not the same as a certified secure environment, regulatory compliance, anonymity, or redaction. Metadata cleanup and overlay flattening do not remove hidden text, comments, layers, attachments, form data, or visible content unless the product explicitly shows a reviewed capability for that case.