Privacy Policy

Last updated 10 October 2026

The short version. 38 of our 60 tools do their work entirely inside your browser — those files are never uploaded, so we never receive them. The remaining 22 can send your file to a processing server, which deletes it when the job ends and stops serving the result after 60 minutes. There are no accounts, no advertising, and no sale or sharing of personal information. Each tool's page says which kind it is before you upload anything.

1. Who we are

pdf.xyz is operated by BENEERA LLC, a limited liability company registered in Wyoming, United States (“we”, “us”).

30 N Gould St # 44190Sheridan, WY 82801United States

For anything in this policy, including requests about your data, write to [email protected]. It is a monitored address, not a formality.

Where this policy uses terms from the UK and EU General Data Protection Regulation, BENEERA LLC is the controller for the limited personal data described below.

2. Your files

This is the part most people are asking about, so it comes first.

Tools that run in your browser (38 of 60). The file is opened and processed by code running on your own device. It is not sent to us, and we could not read it if we wanted to. Closing the tab discards it. Nothing about the file — its contents, its name or its size — reaches our servers. The one exception is analytics, and only if you allow it: Google Analytics is then told which tool you used and a coarse size band of the result, never the file, its name or its exact size (section 4 describes what it receives). Passing a file from one page to a tool keeps it in your browser for a short while: Files you pass to a tool are deleted when that tool opens them. An unopened hand-off expires after 30 minutes and is deleted from this browser the next time a pdf.xyz page opens.

Tools that use a processing server (22 of 60). Some work cannot be done in a browser — optical character recognition, office-format conversion, and anything using an AI model. For these, your file is uploaded over an encrypted connection straight to our storage provider, Cloudflare R2, scanned for malware, processed on our processing server, and then removed on this timetable:

The uploaded file is actively deleted as soon as the job reaches an end — success or failure. If a job hits a temporary error and is retried, the file is kept for that retry rather than re-uploaded. An upload that never reaches a job's end — you closed the tab, or the job was refused or cancelled after the file arrived — has nothing to delete it actively. It is erased instead by a storage rule that runs on a daily cycle and removes uploads after they are 1 day old, so such a file can stay in storage for 1 day or longer.
The result stops being downloadable after 60 minutes. After that the link returns an error and nobody can retrieve it, including us. The stored copy is erased by the same daily storage rule, some time after it is 1 day old — so the bytes outlive the link until then, unreadable but present. We would rather say that than round it to a number that sounds better.
A record of the job — including your file's name — is kept for about 24 hours so the system can report status, avoid duplicating work, and retry safely. It does not contain your document's contents. Like everything our job queue holds, it can also remain in the queue's on-disk journal, on our web server, until that journal is next compacted.
We train no models, on this or anything else. What the AI provider may do with the text it receives is set out in section 3.

Counted here, but browser-first (1 of 22). This group — Compress PDF — runs in your browser first and uploads only when the local attempt cannot finish the job. Because an upload can happen, it is counted with the server tools above rather than with the 38 that never upload. That is why a count of tools with an in-browser mode is larger than the count that never send anything — same catalogue, two different questions.

Every tool page states which of these two applies before you choose a file, and the status page lists the tools that run entirely in your browser.

Every upload is scanned for malware before any processor touches it, and the status page shows whether scanning is running right now. We do not read your documents, and no person at pdf.xyz opens them in the ordinary course of running the service.

One case worth naming. If you use the tools that add or remove a PDF password, the password you type is part of the instructions sent to our server. Our job queue removes it when the job finishes or is cancelled — or, if no server picks it up, when the queue's retention lapses after 24 hours — and the queue's on-disk journal, on our web server, can keep a copy until it is next compacted. While the job runs, our server hands the password to the encryption tool through a temporary file in the job's own folder, which is erased when the job ends. It is never written to a log, an error message or a result. Still: if a password is one you use elsewhere, change it, or use it only for the document.

What some tools ask you for. 8 of the server and AI tools also take something you type, which travels with the job. Our job queue removes what you type when the job ends — or, if no server ever runs the job, when the queue's retention lapses after 24 hours — and the queue's on-disk journal, on our web server, can keep a copy until it is next compacted. This is all of it:

Request Signatures asks for the name and email address of each signer — up to 10 — and, if you add them, a title, a message for the signers and a label for each field. They are written into the package you download (its manifest), so they last as long as the result does. The tool sends no email to anyone.
Protect PDF and Unlock PDF ask for a password. What happens to it is set out under “One case worth naming” above.
Webpage to PDF asks for the web address of the page you want. Our processing server fetches that page itself, so the site sees a request from our server, not from you. The result's file name is made from the address, so the address also appears in that name, which the job record keeps.
Chat with PDF takes your question and, for a follow-up, the conversation so far. Both are sent to OpenAI with the document's text on every question, and the question is written into the answer you download, so it lasts as long as the result does.
AI Data Extraction takes the instructions, or the names and descriptions of the fields, that you write. They are sent to OpenAI with the document's text, and written into the result you download, so they last as long as it does.
Summarize PDF takes an optional focus you type. It is sent to OpenAI with the document's text, and written into the result you download, so it lasts as long as the result does.
Translate PDF takes optional instructions you type. They are sent to OpenAI with the document's text, and written into the result you download, so they last as long as it does.

3. Tools that use an AI model

Our AI tools — summarising, translating, answering questions about a document, and structured extraction — work from the text of your PDF. Our server extracts that text and sends it to our AI provider, OpenAI, together with anything you typed into the tool (section 2 lists what each one takes), to produce the answer. The PDF file itself is not sent to OpenAI.

Two details we would rather state than have you discover. Only text the PDF already contains as text is sent — we do not run character recognition to manufacture text from a scan, and a scanned document is refused rather than silently half-processed. And for Chat with PDF, each question is a new job: the document's text is sent again every time, together with your question and the conversation so far.

OpenAI may keep what it receives for up to 30 days to monitor for abuse, under its own terms. The settings in our OpenAI account that would let it use this data to improve its models are switched off. We cannot control what a provider does beyond that, so if a document is sensitive enough that this matters, use one of the in-browser tools instead, or do not use the AI tools for it.

4. What else we collect

Beyond file processing, the data we handle is deliberately small.

Ordinary server logs. Every request to this site passes through Cloudflare, in front of our servers, and most also reach our own servers; both record what a web request carries — IP address, time, the page or endpoint requested, browser user-agent. Our storage provider records the same for uploads, which your browser sends to it directly. We use these records to run and secure the service and to detect abuse. How long they are kept depends on Cloudflare's retention and our servers' log settings; this policy does not yet promise a fixed period.
Rate limits. To keep the service available, we count requests per network address in fixed time windows of up to 1 day and refuse them once a limit is reached. The address itself is not stored: it is turned into a salted, one-way hash, which is kept with its counter until the window ends and then expires. Everyone who shares one address, such as an office or a café, shares one count.
A job identifier. Worker tools create a job with a random identifier so your browser can poll for the result. It is not linked to you.
Product analytics — only after you say yes. We use Google Analytics to count visits and see which tools are used, and it is loaded only after you choose “Allow analytics” in the banner. Until then — and always, if you decline — no analytics code loads and nothing is sent to Google.
What Google receives, acting as our processor:
- coarse browser and device information, and an approximate location derived from your IP address;
- the random identifier its cookie holds;
- for each page you view, the page's address without its query string, the page's title, and the address of the previous page, also without its query string;
- the events listed below, each with the fields shown. Every event also carries the address of the page it happened on and, when there is one, of the previous page, both without their query strings;
- measurements Google Analytics makes on its own for each visit: that a visit started, whether it is your first visit, and how long a page was in use. Depending on its “enhanced measurement” setting in our Google Analytics property, it can also record scrolling, clicks on links that lead off this site (with the link's address), site searches and file downloads.
What it never sees. Your documents: file contents never pass through this channel at all, and the events our code sends are stripped of filenames, links and query strings before they are sent.
How long. How long Google keeps this data is set by the retention setting of our Google Analytics property. There is no advertising pixel and no error-tracking SDK, and you can change your decision at any time in the cookies section below.

tool_viewedsent when a tool page opens: toolSlug — which tool; capability — whether the tool runs in your browser, on our processing server, or with AI
tool_completedsent when a tool finishes its work: toolSlug — which tool; capability — whether the tool runs in your browser, on our processing server, or with AI; inputCount — how many files went in, as a band such as “2-5”; outputSize — how large the result was, as a band such as “1-10MB” — never the exact size; duration — how long it took, as a band such as “1-5s”
tool_failedsent when a tool cannot finish: toolSlug — which tool; capability — whether the tool runs in your browser, on our processing server, or with AI; reason — why, as one of a fixed list of reasons — never the error message
workspace_handoff_createdsent when you pass files from the workspace to a tool: toolSlug — which tool; mode — whether one file, a batch or a collection was passed; fileCount — how many files, as a band such as “2-5”
suggestion_openedsent when you open a suggested tool: toolSlug — which tool; source — where the suggestion was shown; rank — its place in the list: 1, 2, 3 or lower; carried — whether your files went with it
worker_status_checkedsent when a page asks whether our processing server is available: mode — how the site is set up to process files; enabled — whether processing is available
worker_operations_checkedsent when the status page reads the processing server's health: mode — how the site is set up to process files; health — the overall health, such as “ok” or “warn”; recommendedAction — the one action the status page recommends; drainable — whether queued jobs can be processed; daemonObserved — whether a processing server was seen running
gated_tool_interestsent when you press “Notify me” on a tool that is not built yet: toolSlug — which tool; capability — whether the tool runs in your browser, on our processing server, or with AI
palette_openedsent when you open the search box that finds tools and guides: trigger — whether you opened it with the keyboard shortcut or the button — never what you typed
upload_attempt_failedsent when sending a file to our processing server does not work on one try: toolSlug — which tool; status — the error number our storage service answered, such as 503, or that there was no answer — never the upload's address; attempt — which try it was: 1, 2 or 3; retrying — whether another try followed; size — how large the file was, as a band such as “1-10MB” — never the exact size; duration — how long the try took, as a band such as “1-5s”

One thing you can choose to send us. Some tools in our catalogue are not built yet. If you press “Notify me” on one, your browser sends us the tool's name, and nothing else, and we add one to a count so we know what to build next. The count holds no identifier, no time, nothing about you or your device; the request itself reaches us like any other, so it appears in the ordinary logs above. It also counts toward the per-address rate limit above. If you have allowed analytics, Google Analytics also counts the press, as the gated_tool_interest event above. Pressing nothing sends nothing.
Page-performance and error reports, only if we switch them on. There is one optional channel for load-speed measurements and crash reports. It is off unless a reporting destination is configured, and when it is off the code that would send anything is not loaded at all. When on, values are stripped before sending — filenames, file links, and query strings are removed rather than trusted to be harmless.
What you send us. If you email us, the message reaches us through Cloudflare Email Routing, which forwards it to our mailbox, and we keep that correspondence so we can reply. This policy does not yet set a period after which it is deleted; you can ask us to delete it at any time (section 10).

There are no accounts. We do not ask who you are, and we hold no profile of you to lose. The only things a tool asks for besides your file are listed in section 2, and they are used only for that job.

5. Cookies and browser storage

We use no advertising cookies and no cross-site trackers, and our own code sets no cookies. Google Analytics sets its measurement cookies (the _ga family) to tell returning browsers apart, and only after you allow analytics in the consent banner. They last for Google's default lifetime, which we do not change, and withdrawing your consent here deletes them. Decline — or never answer — and no analytics cookie is ever set. Cloudflare, which sits in front of the site, may set cookies of its own that it needs to protect the site, for example to tell people from automated traffic; we do not use them for analytics or advertising.

Your consent decision itself is kept in your browser’s local storage, so we ask once instead of on every visit. You can change it here:

You haven't decided yet — until you allow it, no analytics code loads.

A few features keep information in your own browser so they work across pages and reloads. This is everything this site keeps there — clearing this site’s data in your browser removes all of it, along with your analytics decision:

pdfxyz.analytics-consentlocalStorage: Your analytics choice — allowed or declined — so the banner asks only once.; Until you change it here or clear this site's data.
pdfxyz.workspace.v1localStorage: The tools you chose in the workspace and a short log of what you opened there. Never a file, a file name or a file size.; Until you press Clear session in the workspace or clear this site's data.
pdfxyz.recents.v1localStorage: Which tools recently finished a job in this browser, and when, so the home page can offer them again. Never a file, a file name or anything a file holds.; Until you clear this site's data. Only the most recent few are kept.
pdfxyz.options.v1localStorage: The settings you last chose for where page numbers or a header go, a watermark's opacity and angle, and an image resolution — so the next file opens set the same way. Only choices from fixed lists and numbers: never a file, a file name, or any words you typed, such as a watermark's text.; Until you clear this site's data.
pdfxyz.saved-signatureslocalStorage: Signatures you chose to keep with “Save for next time” in Sign PDF, Edit PDF or Annotate PDF: a typed name and its style, or a picture of a signature you drew or picked. It is written only when you tick that box, and it is never uploaded.; Until you delete it in the signature panel or clear this site's data. Only the most recent few are kept.
pdfxyz:comment-authorlocalStorage: The name you typed in “Your name on comments (optional)” in Annotate PDF, Edit PDF or Sign PDF, so the next file's comments carry it as their author too. It is written only when you type a name, and it is never uploaded.; Until you empty that field or clear this site's data.
pdfxyz-handoffIndexedDB: Files you pass from one page to a tool — from the workspace or the home page's drop zone — while they travel, with where they came from.; Files you pass to a tool are deleted when that tool opens them. An unopened hand-off expires after 30 minutes and is deleted from this browser the next time a pdf.xyz page opens.
pdfxyz.handoffsessionStorage: The random key to files on their way to the next page, and which page that is — so the key never has to be in a web address. Never a file, its name or its size.; Until that page opens and reads it, or until this tab closes.
pdfxyz.workerJob.<tool>sessionStorage: The id of a secure-server job that may still be running, so a reload can keep waiting for it. Never the file, its name, your options or a password.; Until the job's result expires, after 60 minutes, or until this tab closes.

6. Why we are allowed to do this

Under UK and EU data protection law, each use of data above rests on one of these lawful bases:

Performance of a contract — processing the files you give a tool, and what you type into it (a password, a web address, a question, signers' names and email addresses), because that is the service you asked for.
Legitimate interests — the server logs and rate limits that keep the service available, secure and free of abuse; page-performance and error reports, if switched on; the “Notify me” count; replying to email you send us; and, for the people named as signers in a signature request, preparing the request you asked for. We have considered your rights in reaching that balance: the logs hold IP addresses, the rate limiter keeps only a salted hash of one, and none of these signals holds document contents.
Consent — Google Analytics runs only after you opt in, and you can withdraw that consent at any time in the cookies section above; withdrawing is as easy as giving it.
Legal obligation — answering a request to exercise your rights, and disclosing information where the law requires it.

No law or contract requires you to give us personal data. A tool needs only what it works on — a file, and for some tools a password, a web address or signers' details; without them that tool cannot run, and nothing else changes.

We make no decisions about you by automated means, including profiling, that have legal or similarly significant effects on you.

8. Where data goes

BENEERA LLC is established in the United States, as are most of the companies in section 7, and our web server is in the United States. If you are in the UK or the EEA, using this service means your data is processed outside your country — that is not a corner case here, it is the normal path.

Where personal data leaves the UK or EEA, we rely on the safeguards our providers offer, typically the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. You can ask us at [email protected] which safeguard covers a given company, and for a copy of it. The practical reduction in exposure is the same one that runs through this whole policy: for most of our tools nothing is transferred at all, because the file never leaves your device.

9. Security

Traffic between your browser and this site is encrypted in transit. Uploaded files are held by our storage provider, Cloudflare R2, and are scanned for malware before any processor touches them; the status page shows whether scanning is running right now. The site sends a Content Security Policy that limits where scripts, styles, connections and frames may come from — though it does allow inline scripts, which the site's framework uses — along with related protections against common web attacks. We remove uploads and results on the timetable in section 2 rather than keeping them.

No service can promise perfect security, and we do not. What we can say is that the largest single reduction in risk is the design itself: for the majority of our tools there is nothing on our servers to breach, because the file never left your device.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, and — in California — to know what is collected and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of.

To exercise any right, email [email protected]. We will not treat you differently for asking.

Please be aware of a practical limit. We hold no accounts, and nothing about a document you processed outlives the timetable in section 2: the upload is deleted when its job ends (or by the daily storage rule if it never ran), the result stops being downloadable after 60 minutes and its stored copy follows by the same rule, and the job record — the filename included — expires after about 24 hours, though the queue's on-disk journal, on our web server, can keep a copy until it is next compacted. So a request about a document you processed is usually a request about data that no longer exists. We are also often unable to connect a request to a specific past request without information that would identify you more than we currently do — we will not create a record of you in order to answer.

If you are in the UK or EEA and you think we have handled your data badly, you may complain to your national supervisory authority. In the UK that is the Information Commissioner's Office.

11. Children

This service is not directed to children under 13, the minimum age in our terms, and we do not knowingly collect personal information from them. Some countries set a higher age — up to 16 — below which a parent must agree before you can consent to things like analytics. If that applies to you, decline analytics when the site asks (“No thanks”), or ask a parent first. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this policy

If we change how we handle data, we will update this page and the “last updated” date above. Where a change materially reduces the protections described here, we will say so prominently rather than quietly editing the text.

13. Contact

[email protected]