Privacy policy

Last updated: September 23, 2026

Introduction

This privacy policy explains how PDF4.dev collects, uses, and protects your personal data when you use the website, dashboard, API, free PDF tools, or any other part of the service.

PDF4.dev is operated by benoitded, based in France. By using PDF4.dev, you agree to the practices described in this policy. If you have questions, contact contact@pdf4.dev.

What data do we collect?

Account data

When you create an account, we store your email address and a hashed password. Passwords are managed by better-auth and are never stored in plain text. We also store your account creation date.

API usage data

Each PDF generation via the API or a connected AI assistant is logged with the following information: template ID or slug, render duration in milliseconds, output file size, status (success or error), error message if applicable, and timestamp. The log also keeps the variable data sent with the request and, when the request sent raw HTML instead of a saved template, that HTML, so you can inspect and reproduce a render. These logs are tied to your account and visible on your dashboard at /dashboard/logs. Dashboard previews are not logged.

API keys

When you create an API key, the full token is shown to you once and never stored. We store only a SHA-256 hash of the key, along with a short prefix (for identification in the dashboard), its permission scope, and creation date. The original key cannot be recovered from the hash.

Template and component data

Templates and components you create are stored in your account. This includes HTML content, sample data, PDF format settings, and metadata (name, slug, timestamps). This data is accessible only to you and persists until you delete it or delete your account.

Free PDF tools

All free tools (compress, merge, split, rotate, reorder, watermark, protect, unlock, image to PDF, PDF to PNG, PDF to JPG, add page numbers, flatten, and reorder pages) run entirely in your browser using client-side JavaScript libraries (pdf-lib, pdfjs-dist). Your files never leave your browser and are never uploaded to our servers.

The only exception is the HTML to PDF tool, which requires server-side rendering. In that case, the HTML you submit is processed by Playwright in an isolated browser context and discarded immediately after the PDF is returned in the response.

Rendering data

When you call the render API or use the dashboard preview, the HTML template and variable data you provide are compiled in memory. The render log described above keeps a copy of the variable data and of any raw HTML sent with an API render. By default the generated PDF is returned in the HTTP response and is not stored on our servers. If you request URL delivery (delivery: "url"), the PDF is stored on our server so the signed URL can serve it, then automatically deleted after 24 hours. See the "How does PDF4.dev handle document data?" section below for details.

How do we use your data?

We use the data we collect for the following purposes:

• Provide, maintain, and operate the PDF4.dev service (account management, template storage, PDF rendering)
• Authenticate your identity and authorize access to your resources
• Log API usage so you can monitor your render history, success rates, and performance on your dashboard
• Enforce usage limits on free PDF tools
• Prevent abuse, fraud, and unauthorized access
• Send transactional emails: password reset links and email verification (via Resend)
• Improve the product based on aggregated, anonymized usage patterns (e.g., which templates are most popular, average render times)
• Respond to support requests and exercise or defend legal claims

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

How long do we retain your data?

Account data

Your email, hashed password, and account settings are retained until you delete your account. You can delete your account at any time from the dashboard settings page (/dashboard/settings). Deletion removes all associated data: templates, components, API keys, and render logs.

API logs

Render logs (template ID, duration, status, file size, timestamp, and the variable data and raw HTML sent with the request) are retained as long as your account exists. They are permanently deleted when you delete your account.

Rendered PDFs

PDFs returned directly in the API response are never stored: they exist only in server memory during the render request and are discarded as soon as the response is sent. PDFs requested with URL delivery are stored on our server for up to 24 hours so the signed URL can serve them, then automatically and permanently deleted.

AI assistant connections

An access token issued to a connected AI assistant expires after one hour. A refresh token expires after 30 days and is replaced each time it is used. The consent record and the client's registration are kept until you delete your account. See "How do AI assistants connect to PDF4.dev?" below.

Free tool files

Files processed by free PDF tools exist only in your browser memory. They are garbage-collected when you close the tab or navigate away. We have no access to these files at any point.

What cookies and local storage do we use?

PDF4.dev uses minimal browser storage, limited to what is required for the service to function:

• Session cookie: a single HTTP-only cookie managed by better-auth. It stores your session ID for authentication. It is not used for tracking and expires when you sign out.
• localStorage (tool usage limits): free PDF tools track usage count in your browser's localStorage to enforce the weekly limit (3 uses per week across all tools without an account). This data stays on your device and is never sent to our servers.
• PostHog storage: our product analytics (PostHog) stores a randomly generated identifier in your browser (localStorage and a first-party cookie) to group usage events from the same browser. It contains no personal details.

We do not use advertising cookies or cross-site tracking cookies.

How do AI assistants connect to PDF4.dev?

AI assistants such as Claude and ChatGPT connect to PDF4.dev through its Model Context Protocol (MCP) server at pdf4.dev/api/mcp. You connect one by signing in on pdf4.dev and approving access on a consent screen. The assistant never receives your password. Other MCP clients can instead use an API key you create in the dashboard, which is covered by the API keys section above.

What the consent screen grants

• One organization: access is limited to the organization you pick. If you are removed from that organization, the assistant loses access on its next request.
• A permission level: full access (render PDFs and read, create, edit, and delete templates and components, and read render logs) or render only (render PDFs and see template names and variable names, but not template content). You choose on the consent screen.
• Your identity: the assistant may request your user ID, name, and email address, so it can show which account is connected.

What we store

• The assistant's registration: its client ID, which is the address of a public metadata document the assistant publishes, and the details we read from that document (name and redirect addresses).
• A consent record: your user ID, the assistant, the permissions you approved, and the organization.
• Refresh tokens, stored as hashes. Access tokens are signed and verified on each request.
• Render logs for renders the assistant requests, as described in "API usage data" above.
• While an assistant edits or renders a template, it appears in the editor's list of viewers for about 15 seconds. This is held in memory only.

What the assistant receives

The assistant receives the results of the actions it performs: template and component content, rendered PDFs or their download links, and render logs, within the permission you granted. That data is then processed by the assistant's provider (for example Anthropic for Claude, or OpenAI for ChatGPT) under that provider's own privacy policy. PDF4.dev does not control that processing.

How to disconnect

• Remove the connector in the assistant's settings. The assistant stops using its tokens, and any access token it still holds expires within one hour.
• Email contact@pdf4.dev to have a specific connection revoked on our side.
• Deleting your account deletes every consent record and token along with the rest of your data.

Which third-party services do we use?

We work with a limited number of third-party providers. Each processes only the minimum data required for their specific function:

• Resend (resend.com): sends transactional emails on our behalf (password reset links, email verification). Resend receives the recipient email address and the email content. Privacy policy: resend.com/legal/privacy-policy
• Cloudflare (cloudflare.com): provides DNS, CDN, DDoS protection, and TLS termination. Cloudflare processes request metadata (IP address, headers, URL) as part of proxying traffic. Privacy policy: cloudflare.com/privacypolicy
• Railway (railway.app): hosts the PDF4.dev application and database. All application data (accounts, templates, logs) resides on Railway infrastructure. Privacy policy: railway.app/legal/privacy
• PostHog (posthog.com): product analytics, hosted on PostHog's US cloud. PostHog receives pseudonymous usage events (page interactions, tool usage, exceptions) tied to a random browser identifier, never your files or document content. Privacy policy: posthog.com/privacy

We do not share your data with any other third parties. We do not use data brokers, advertising networks, or data enrichment services.

How does PDF4.dev handle document data?

PDF4.dev processes documents (HTML templates, variable data, and generated PDFs) with the following safeguards:

• HTML templates and variable data are compiled in server memory using Handlebars. The compiled HTML is loaded into an isolated Playwright (headless Chromium) browser context. The variable data, and any raw HTML, sent with an API or AI assistant render is kept in your render log.
• Each render request uses a fresh browser page that is destroyed after the PDF is generated. No data persists between requests, and no rendered content is accessible to other users or subsequent requests.
• By default the generated PDF is returned directly in the HTTP response as binary data and is not written to disk. With URL delivery, the PDF is stored under a random identifier, served only with a valid signed token, and deleted after 24 hours.
• Templates you save in your account are stored in the SQLite database and are scoped to your user ID. No other user can access your templates.
• For free tools that run client-side, your files are processed entirely in your browser. They are never transmitted to our servers.

How do we protect your data?

We implement multiple layers of security to protect your data:

• Encryption in transit: all traffic between your browser and PDF4.dev is encrypted via HTTPS with HSTS (HTTP Strict Transport Security) headers
• Password hashing: passwords are hashed by better-auth before storage. The original password is never stored or logged.
• API key hashing: API keys are hashed with SHA-256 before storage. Only the first few characters (prefix) are stored in plain text for identification in the dashboard. The full key cannot be recovered.
• Isolated rendering: each PDF render runs in a separate Playwright browser page. The page is destroyed after the render completes, preventing data leakage between requests.
• User-scoped data: all database queries are scoped to the authenticated user's ID. You cannot access another user's templates, components, keys, or logs.
• DDoS protection: Cloudflare provides network-level protection against distributed denial-of-service attacks

Where is your data stored?

PDF4.dev is hosted on Railway with servers in the EU and US. Cloudflare provides global CDN distribution, which means static assets may be served from edge nodes worldwide. Product analytics events are processed on PostHog's US cloud.

If you are located outside the EU or US, your data may be transferred to and processed in these regions. We rely on the standard contractual clauses provided by our infrastructure providers (Railway and Cloudflare) to ensure adequate data protection for international transfers in compliance with GDPR Chapter V.

What are your rights under GDPR?

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access (Article 15): request a copy of the personal data we hold about you
• Right to rectification (Article 16): correct inaccurate or incomplete data
• Right to erasure (Article 17): request deletion of your personal data. You can also delete your account and all associated data directly from the dashboard settings page.
• Right to data portability (Article 20): receive your data in a structured, machine-readable format. You can export individual templates as JSON from the dashboard.
• Right to restrict processing (Article 18): request that we limit how we process your data in certain circumstances
• Right to object (Article 21): object to processing of your personal data for specific purposes
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email contact@pdf4.dev. We will respond within 30 days as required by GDPR. You also have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL (Commission nationale de l'informatique et des libertés).

Do we use analytics?

PDF4.dev uses PostHog for product analytics: pseudonymous usage events (page interactions, tool usage, exceptions) tied to a random browser identifier. We use this data to understand which features are used and to fix errors. We do not use advertising trackers, we do not track you across other websites, and we do not build user profiles for advertising.

Beyond PostHog events, the only usage data we collect is API render logs (described above), which are tied to your account and visible to you on the dashboard. We may review aggregated, anonymized statistics (total renders, average duration) to monitor service health, but we do not analyze individual user behavior.

Children's privacy

PDF4.dev is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child under 16 has created an account or provided personal data to us, please contact contact@pdf4.dev and we will delete the account and associated data promptly.

Links to other websites

PDF4.dev may contain links to external websites (documentation sources, official standards, third-party provider pages). We are not responsible for the privacy practices or content of those websites. We recommend reviewing their privacy policies before providing any personal data.

How will we notify you of changes?

We may update this privacy policy as the product evolves or as legal requirements change. When we make material changes that affect how your data is collected or used, we will notify registered users by email before the changes take effect. Minor clarifications or formatting changes will be made without notification.

The "last updated" date at the top of this page reflects the most recent revision. Previous versions are available upon request.

How can you contact us?

For any questions, concerns, or requests related to this privacy policy or how PDF4.dev handles your data, contact us at:

• Email: contact@pdf4.dev
• Operator: benoitded, based in France

We aim to respond to all privacy-related inquiries within 7 business days and to GDPR requests within 30 calendar days.