Privacy Policy

The short version

Most privacy policies are long and cover every corner case. Here's the quick version of how PDFwarp actually handles your data:

• Files are processed, then deleted. When you use a tool, your file is processed on our servers and deleted as soon as your download completes. We don't keep copies. We don't index contents. We don't train AI on your documents.
• What we keep is limited. Account details (name, email, password hash), subscription status, and usage counts for rate limiting.
• We don't sell data, ever. Not to advertisers, not to data brokers, not to anyone.
• You're in control. You can delete your account at any time, export your data, and decline non-essential cookies.

The full policy below has the specifics.

1. Introduction

PDFwarp ("we", "us", "our") operates the service at pdfwarp.com. This policy explains what personal data we handle, how we use it, what third parties we rely on, and the choices you have. PDFwarp is operated from Alberta, Canada. Our production servers are located in the United States (Railway infrastructure, US East region). By using the service you agree to the practices described here.

2. Information we store

The following information is stored in our database for as long as you have an account (or for the retention period listed in Section 5):

For registered users:

• Email address, first name, last name
• Password stored as a one-way hash — we cannot recover your password, only help you reset it
• Country code (derived at signup)
• Plan status (free or Pro) and daily usage counts for rate limiting
• Stripe customer and subscription IDs (for Pro subscribers)
• IP address at the time of registration and login, retained for abuse prevention

For guest (unregistered) users:

• IP address, used to enforce the daily free-conversion limit and prevent abuse
• Tool used, device type (mobile/tablet/desktop), browser language, and approximate country derived from your IP

3. Information we process but do not store

The following information passes through our systems to complete your requested operation but is not retained afterward:

• Uploaded files. When you use any tool, your file is processed on our servers and deleted as soon as your download completes. If you ask for a "scan to download" QR link, that copy is deleted the moment your phone downloads it (each link works once), or within 11 minutes of the link being created if it is never used. We do not maintain a cloud storage bucket for user files, we do not index or search their contents, and we do not share uploaded documents with third parties — except that AI tools send document content to xAI (see Section 4).
• Document content sent to AI. When you use a Pro AI-powered tool, only what that tool needs is transmitted to our AI processing partner (xAI) for the duration of the request: for most AI tools, the text extracted from your document; for AI Scan to Text, images of your pages (a scan has no text to extract); for AI Write and AI Invoice, no document at all — only the prompt or invoice details you type. xAI does not train on API inputs or outputs without explicit permission. By default xAI may retain API requests for up to 30 days for abuse auditing, then deletes them. We do not log document content on our end. See Section 4 for more on AI processing.

We do not read your files for our own purposes, analyze them for advertising, or use them to train any model.

4. Third-party services

We use the following third parties. Each is listed with what data they receive and why:

• Stripe (payment processing, US) — receives your email address and payment method when you subscribe to Pro. Payment details are handled entirely by Stripe; we never see or store card numbers. Subject to Stripe's Privacy Policy.
• xAI (AI processing, US) — when you use an AI-powered Pro tool, the text extracted from your document is sent to xAI for analysis — except AI Scan to Text, which sends images of your pages, and AI Write and AI Invoice, which send only the prompt or invoice details you type and no document. xAI does not train on API data without explicit permission. By default, API requests and responses may be stored encrypted for up to 30 days for abuse auditing, then deleted. AI features are only on the Pro plan; none of the 19 free tools or the PDF Editor use xAI. Subject to xAI's Privacy Policy.
• Outbound email — sent from our support mailbox (support@pdfwarp.com) over SMTP (Namecheap Private Email). Used for verification emails, password reset links, file-ready notices, and contact form messages.
• Google OAuth (optional sign-in) — if you use "Sign in with Google," Google provides us your email, given name, and family name.
• Google Analytics (tracking ID G-DN9EYS12VF) — collects anonymized page view, device, and navigation data. Only loaded with your consent (Google's consent message where it applies, our cookie banner elsewhere). Subject to Google's Privacy Policy.
• Google AdSense (publisher ID ca-pub-1919249987576262) — serves ads on the site. In regions where the law requires it, Google's certified consent message asks before personalized advertising is used; without consent, ads are limited/non-personalized. AdSense does not receive your uploaded files or their contents.
• ip-api.com (IP geolocation) — receives the IP address of guest users to return the approximate country code for rate-limit enforcement.
• Railway (hosting, US East region) — operates the infrastructure where our application runs.
• Vercel (frontend hosting) — serves the static frontend of pdfwarp.com.

We do not sell your personal data to anyone under any circumstances.

5. Retention periods

• Uploaded files: deleted as soon as your download completes. A "scan to download" QR copy is deleted when your phone downloads it, or within 11 minutes of the link being created if it is never used.
• Document content sent to AI: not retained by us; retention by xAI is governed by their policy (default 30-day abuse-audit window unless Zero Data Retention is enabled on the xAI team).
• Account data: retained while your account is active. Deleted upon request.
• Guest IP records and usage counters: up to 90 days for rate limiting and abuse prevention, then purged.
• Server logs: retained by Railway for up to 7 days. We do not log document content.
• Email delivery logs: retained by our support mailbox / Namecheap Private Email per their policies.

6. International data transfers

PDFwarp is operated from Canada. Our production servers and most of our third-party service providers are located in the United States. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, using PDFwarp means your personal data (account information, IP address, usage patterns, and — for AI features — document content) will be transferred to and processed in the United States. You can use non-AI tools to keep document content out of US-based AI processing.

7. Cookies and browser storage

We use an essential authentication token (stored in your browser's localStorage) to keep you signed in. We also remember whether you accepted or declined our cookie banner.

Consent for advertising cookies is collected through Google's certified consent message in regions where the law requires one (including the EEA, UK, Switzerland, and Canada); until you consent, ads are limited/non-personalized. Google Analytics never loads without your consent — through Google's message where it applies, or our cookie banner elsewhere. You can change your choices at any time on our Cookie Preferences page. Full detail is in our Cookie Policy.

You can also opt out of personalized Google ads at Google Ad Settings and opt out of Google Analytics via the Google Analytics Opt-out Browser Add-on.

8. Your rights

You have the right to access, correct, download, or delete your personal data, subject to applicable law. Depending on your jurisdiction you may also have the right to object to certain processing or lodge a complaint with a data protection authority.

To exercise any of these rights or ask a question about this policy, email us at support@pdfwarp.com. We will respond within 30 days.

9. Children

PDFwarp is not directed to children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, please contact support@pdfwarp.com and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will update the "Last updated" date at the top of this page and, for registered users, notify you by email.

11. Contact

PDFwarp is operated from Alberta, Canada. Privacy questions or requests: support@pdfwarp.com.