✦ Data Sovereignty & Protection
Privacy Policy.
Last updated September 10, 2026 · PDFPapi is operated by K. M. FISHER SYSTEMS LLC
1. Where your PDFs are processed and stored
PDFPapi's tools and editor run in your browser, so editing happens on your machine. Your PDF is also saved to your PDFPapi library so you can reopen it later or on another device: the file you opened, plus the versions you save while editing, are stored in PDFPapi's private object storage under your account (or, if you are not signed in, under a temporary guest session for that browser). Downloads and exports never require the cloud copy. The exception for paid work is unchanged: a finished output you buy and authorize for download may be stored encrypted for up to 30 days so you can recover or re-download it.
2. Your PDF library
- Signed in: the PDFs you open in the editor and the versions you save are kept in your account until you delete them, so you can reopen them on another device.
- Not signed in: they are kept only for this browser through a temporary guest session, for 24 hours from your last save, and then deleted automatically. Sign in and the library transfers to your account; the same files are never left behind in the guest session.
- We keep the file you opened plus a limited number of saved versions (20 by default) so you can restore an earlier state. Older versions are removed automatically. Limits on document size, document count, and total storage per account are shown in your library.
- For a signed-in document, the Ask Papi conversation is saved with the document so you can resume it later. Attachments are not included in that saved conversation.
- Deleting a document immediately removes access to it, its saved versions and its conversation. The stored bytes and conversation record are then removed by the deletion cleanup.
- Uploads go from your browser directly to storage using a one-time signed link, so PDF bytes never pass through our application servers, and every stored version is verified against a cryptographic hash of the bytes you sent.
3. What we do process
- An anonymous browser identity (a first-party HTTP-only cookie) so a browser that owns an entitlement can be recognized without an account, and so a guest PDF library can belong to that browser.
- Minimal session metadata for that identity (for example that an export was authorized for a document session).
- Billing, payment, and entitlement records needed to provide the service, receipts, and the billing portal.
- The email you provide at checkout, used for Stripe receipts and a single-use recovery email if you need to restore access on a new browser.
- If you create an account, we process your email, password credential hash, email-verification status, and account-session records. If you use Google sign-in, we process the Google provider identifier, email, and verification state. Verification emails use single-use, hash-only token records; we never store your raw password or token.
Optional AI assistant preview
When the AI preview is enabled and you send a request, your prompt, recent conversation, and document text needed for the request are sent through PDFPapi to the selected AI provider. If you attach an image, or Ask Papi needs visual context to inspect a page, that image or rendered page view is sent too. The original PDF file itself is not sent to the provider. You can use the PDF editor without using the assistant.
4. Funnel telemetry
The site records basic first-party funnel events (e.g. landing viewed, offer shown, checkout started), tool and plan choices, and broad traffic-source and device categories. PDF contents, filenames, email addresses, and private links are not included in these events. We do not record editing sessions or use advertising trackers.
We use PostHog in the United States to understand product use. Product identifiers are pseudonymous. Browser requests with Global Privacy Control or Do Not Track enabled are not forwarded to PostHog. Payment events sent to PostHog remain separate aggregate events, without an account or browser identity.
Optional purchase measurement
If you allow optional measurement in Analytics preferences below, we can associate an eligible page visit and broad traffic source with a later purchase in our own reporting. This helps us understand which pages help customers. It is off by default, and editing, accounts and purchases work without it.
This association uses first-party browser and account-session references, not PDF contents, filenames, card details or document text. We do not send the purchase association to PostHog. Browser Do Not Track and Global Privacy Control settings override permission. You can turn it off using Analytics preferences at any time. Your choice applies to this browser. Measurement records follow the 180-day usage-event retention period described below.
5. Payments and email
Payments are processed by Stripe; full card numbers are handled by Stripe, never by us. Recovery email is sent through Resend from no-reply@pdfpapi.com.
6. Retention and choices
Billing/entitlement records are kept as long as needed to provide the service and satisfy legal/accounting obligations. Completed paid outputs you authorize for download are retained encrypted for up to 30 days, then deleted. Cancel your subscription anytime from the billing portal. For access or deletion requests, contact us below.
PDFs in your library are kept until you delete them. Guest documents are deleted about 24 hours after your last save. Older saved versions beyond the retained limit, and deleted document bytes and saved chats, are removed by a scheduled cleanup that also retries any storage deletion that did not complete. If you ask us to delete your account, your library, saved chats and stored bytes are deleted as part of that request.
First-party usage events and email-delivery status records are scheduled for deletion after 180 days. Delivery records help us diagnose failed messages without storing their contents or sign-in links.
7. Contact
Privacy questions or requests: team@pdfpapi.com.