Privacy Policy | PDF Safe

PDF Safe is built on a zero-server architecture. Privacy isn't a setting you toggle on — it's how the system works at a technical level. Your files can't reach our servers because there simply aren't any servers involved in processing.

1. How PDF Safe Handles Your Files

PDF Safe uses browser-based Web Workers to process your documents. All file operations run inside your browser's memory. We never own, access, or store your files at any point. Your data never touches our infrastructure.

2. Who We Are

PDF Safe is operated by an individual developer based in Istanbul, Turkey. We are not a registered company. For data protection matters, you can reach us at hello@pdf-safe.com. As we process all files locally in your browser, PDF Safe acts as a data controller only for the minimal data described in this policy (cookies and analytics). We do not process any personal data beyond what is necessary for the basic functioning of the service.

3. What We Collect

We collect almost nothing. PDF Safe is serverless by design — your files never leave your browser, and we have no mechanism to view or retain them. Here is everything we collect: • Language preference (stored in a cookie) • Cookie consent choice (stored in a cookie) • Anonymous usage data via Google Analytics (page views, device type, approximate location — only if you consent) That’s it. No names, no emails, no accounts, no file contents, no IP addresses stored on our end.

4. Lawful Basis for Processing

Under the GDPR and similar regulations, we process data on the following lawful bases: • Consent — for cookies (language preference, consent choice) and Google Analytics. You give consent via the cookie banner and can withdraw it anytime by clearing your cookies. • Legitimate interest — for basic service functionality (remembering your language preference). This is strictly limited to what's necessary for the service to work. We do not rely on 'performance of a contract' or 'legal obligation' as a basis, because our service is free and we have no legal obligation to process any data.

5. Google Analytics

We use Google Analytics to understand aggregate usage patterns — like which pages are visited and what devices are used. No file contents are ever sent to Google Analytics. Google Analytics is loaded only after you give consent via the cookie banner. The data collected is anonymous and includes: pages visited, approximate location (city level), device type, and browser type. Google Analytics sets its own cookies, which are listed in the Cookies section above. Google is an independent data controller for the data it collects. You can learn more about how Google processes data at https://policies.google.com/technologies/partner-sites.

6. Cookies

We keep it simple. Here’s what we store in your browser: • A cookie to remember your language for 1 year. • Your yes/no choice about cookies, so the pop-up doesn’t keep showing up. • A couple of flags so the app knows what state you’re in (like “just finished processing”). That’s it. No tracking cookies, no ad cookies, no spyware. If you consent to analytics, Google Analytics sets its own cookies — those are listed in Google’s own documentation. You can clear all cookies anytime in your browser settings. This will reset your language preference and consent choice.

7. Data Retention & Deletion

We don’t keep your files at all. Everything runs in your browser. Close the tab, it’s gone. We don’t have servers to store anything. The only data we retain: • Google Analytics data: anonymous stats retained for 14 months (Google’s standard retention period). • Language cookie: retained for 1 year, or until you clear your cookies. • Consent cookie: retained until you clear your cookies. We do not retain any file contents, personal information, or IP addresses on our servers — because we don’t have any servers that process your files.

8. Your Right to Deletion

Since we don’t store your files or personal data, there is nothing for us to delete on our end. If you have consented to Google Analytics and wish to delete that data, you can: 1. Clear your browser cookies — this will also reset your language preference and consent choice. 2. Delete your Google Analytics data directly from your Google account at myactivity.google.com. Your files are processed entirely in your browser. To delete them, simply close the tab or refresh the page. No action is needed from us.

9. International Data Transfers

PDF Safe processes all files locally in your browser — no file data is transferred across borders. The only data that may be transferred internationally is your anonymous Google Analytics data. Google Analytics may process this data on servers located in the United States and other countries. Google relies on Standard Contractual Clauses (SCCs) approved by the European Commission for such transfers, ensuring an adequate level of data protection. Your language preference and consent choice are stored in your browser as cookies and are not transferred to any server.

10. Your Rights

Under the GDPR, CCPA, KVKK, and similar regulations, you have the following rights regarding your personal data. Since we collect almost no personal data, most of these rights are inherently satisfied by our serverless architecture: • Right to be informed — You're reading it. This policy explains exactly what we collect and why. • Right of access — You can see all the data we have about you by checking your browser's cookies and your Google Analytics data (via myactivity.google.com). • Right to rectification — Clear your cookies and set new preferences. That's all there is to correct. • Right to erasure (right to be forgotten) — Clear your browser cookies. Your Google Analytics data can be deleted via myactivity.google.com. We have nothing else to erase. • Right to restrict processing — Decline analytics cookies in the cookie banner. This restricts processing to the bare minimum (language preference only). • Right to data portability — We don't hold enough data to port. Your cookies are in your browser, and your GA data is in your Google account. • Right to object — You can object to Google Analytics processing by declining cookies in the banner or using a Do Not Track (DNT) browser setting. • Rights related to automated decision-making — We don't profile you or make automated decisions. See the 'Automated Decision-Making' section. To exercise any of these rights, contact us at hello@pdf-safe.com. We will respond within the timeframes required by applicable law (typically 30 days under GDPR).

11. Right to Complain

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority. • EU residents: You may complain to your local data protection authority (DPA). A list of EU DPAs is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. • Turkey (KVKK): You may complain to the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu) at https://www.kvkk.gov.tr. • California (CCPA): You may contact the California Privacy Protection Agency at https://cppa.ca.gov. We encourage you to contact us first at hello@pdf-safe.com so we can resolve any issue directly.

12. Automated Decision-Making

PDF Safe does not engage in automated decision-making or profiling as defined by the GDPR or similar regulations. We do not: • Profile users based on their behavior • Make automated decisions that produce legal effects • Use algorithms to evaluate personal aspects • Serve personalized advertising The only automated process is Google Analytics, which provides us with aggregate, anonymous statistics. This does not constitute automated decision-making about you as an individual.

13. Security

PDF Safe’s architecture ensures your files never leave your browser. All processing happens in your device’s memory using Web Workers and WebAssembly. This means: • No file data is ever transmitted over the network • No file data is stored on any server • No third party can access your file contents • No copies of your files exist outside your browser The security of your local environment — your device, browser version, and network — is in your hands. We recommend: • Keeping your browser up to date • Using a trusted network when processing sensitive documents • Closing the tab after you’re done (this clears all file data from memory)

14. Advertising

PDF Safe is currently ad-free. We may introduce advertising in the future. If we do, this policy will be updated before any ads are shown.

15. Changes to This Policy

If we change this, we’ll update the date at the top. If it’s a big change — like adding ads or new analytics — we’ll let you know on the site before it happens.

16. Contact Us

If you have any questions about this Privacy Policy, your data, or your rights, please contact us: • Email: hello@pdf-safe.com • Location: Istanbul, Turkey We respond to all inquiries within the timeframes required by applicable law (typically 30 days under GDPR). For data protection matters, your first point of contact is the same email address above.