Privacy

The short version. Fifteen of the thirty-eight tools do their work inside your browser tab, and the file never leaves your machine — we could not read it if we wanted to. Twenty-two more send the file to a server: PDF to Word, PDF to Excel, PDF to PowerPoint, Word to PDF, Excel to PDF, PowerPoint to PDF, PDF to RTF, RTF to PDF, PDF to iWork, iWork to PDF, HTML to PDF, EPUB to PDF, CAD to PDF, PDF to PDF/A, Excel Split, Excel Merge, Shrink Excel, Shrink Word, OCR PDF, Resize PDF, Redact PDF, and the editor when you download, which sends the original file and your edits so the PDF can be rebuilt in its own fonts. The server's copy is deleted as soon as the result is on its way back to you; the only copy that lasts is one you are signed in and ask to keep, which stays in your account for 30 days. Using these tools needs no account; downloading a result from any of them, the editor included, needs a free one. eSign, the last one, sends a PDF for other people to sign: it needs an account, and it keeps the file, and a record of who signed it, in that account. The table below sets out all thirty-eight.

Where each tool works

Your documents

The tools that run in your browser

Merging, splitting, extracting, deleting, organising, rotating and cropping pages, compressing, protecting, removing passwords, watermarking, numbering pages, comparing two PDFs, and converting images to a PDF or pages to images all happen in JavaScript, in the tab. The file is read into memory on your own machine and the result is written back out there. Nothing is transmitted to us, so there is nothing for us to keep, lose or hand over. Close the tab and the document is gone. The editor works the same way while you edit; its download is the exception described in the short version above.

The tools that use a server

Converting between PDF and Word, Excel, PowerPoint, RTF or iWork (Numbers), rendering HTML, converting EPUB books and CAD drawings, splitting, merging and shrinking Excel and Word files, producing PDF/A, reading the text off a scan, resizing pages and rebuilding an edited document all need software that cannot run in a browser, so these tools upload. The file travels over an encrypted connection, is written to a temporary directory on the server, processed, and that directory is deleted as soon as the response has been sent. We do not keep the file you uploaded. For HTML to PDF in website mode, the address you type is what is sent: our server loads that page in a browser and renders it.

The result of a conversion (PDF to Word, PDF to Excel, PDF to PowerPoint, Word to PDF, Excel to PDF, PowerPoint to PDF, PDF to RTF, RTF to PDF, PDF to iWork, iWork to PDF, HTML to PDF, EPUB to PDF, CAD to PDF, PDF to PDF/A, Excel Split, Excel Merge, Shrink Excel, Shrink Word and OCR PDF) is kept only if you are signed in and saving is on — it is on by default for signed-in accounts, and you can turn it off in your settings. If a result is saved, we also record the original file's filename and size alongside it, so the saved file is identifiable in your list. Signed out, nothing is saved at all. Resize PDF and the editor's download are never saved this way.

eSign: sending a PDF for signature

A signature request needs the document for as long as it is open, and a record of what happened to it afterwards, so this tool keeps both. The PDF you send is uploaded to your account, and the request keeps its own copy of it so the record does not depend on you keeping the file. When everyone has signed, the signed PDF is added to your files.

For each person you ask to sign we store the name and email address you give us, the picture of their signature, the name they type, and, when they open, sign or decline, the time, IP address and browser identification string. Those details are written into the request's audit trail and printed on the certificate page of the signed PDF, which is the point of it: the record is evidence of who signed and when. We email a signer only about that request — the invitation, a reminder you send, and the finished copy.

Requests and their audit trails are kept for as long as your account is. Deleting your account withdraws any request still open, tells the people still waiting, and removes the requests with it.

Files and drafts you choose to keep

With an account you can keep results and save what you are working on as a draft from the editor. Saved files are stored as the actual bytes. Drafts are a compressed copy of the document you have open. Both are deleted automatically 30 days after they were uploaded — a draft 30 days after it was first saved, however recently you edited it. This runs once a day, and no reminder is sent before a file or draft goes, so download anything you want to keep. You can delete a file sooner yourself; a deleted file is purged within about a day.

Your account

If you create one, we store:

• Your email address and the name you give.
• Your password as an Argon2id hash. We never store the password itself and cannot recover it.
• If you sign in with Google: the identifier Google gives us for your account, your email address, your name and your profile picture URL. We ask Google for nothing beyond that, and we do not store any Google access token.
• A profile picture, if you upload one.
• Counters for how much storage your saved files and drafts are using.

You can delete your account from your settings. Your saved files and drafts are removed with it.

A note about profile pictures

An uploaded picture is stored as you supplied it and is served to anyone who has its address. We do not currently strip embedded metadata, so if the image is a photograph straight off a phone or camera it may still carry the location and time it was taken. If that matters to you, upload a picture that has been through an editor first.

Sessions, addresses and logs

Staying signed in uses a cookie that holds a random token — not your identity, and not anything readable. Against each active session we record the IP address and browser identification string it was created from, so that a stolen session can be recognised. Those records expire 30 days after the session was issued.

To stop automated abuse we count requests against an IP address for the length of the rate-limiting window, at most about an hour, after which the record deletes itself.

Ordinary server logs record events such as a sign-in or a completed conversion, and those lines can contain an IP address, an email address, an uploaded file's name or a website address you asked HTML to PDF to load. They exist so that faults and attacks can be investigated.

Cookies and analytics

cherrypdf sets two cookies, and only once you sign in: one holding your session token and one carrying a value that protects against cross-site request forgery. There are no advertising cookies and nothing is sold to anyone.

We use Google Analytics, loaded through Google Tag Manager, to count page views and see which tools get used. It tells us that a page was viewed; it is not given your documents, and it cannot be, because for fifteen of the thirty-eight tools they never leave your machine, and the ones that do upload never pass them to it.

Your theme choice is stored in your own browser and never sent to us. A copy you choose to keep goes to your account once you are signed in; it waits in this browser only if the service cannot be reached at the time, until it can be uploaded. A result you try to download while signed out is held in this browser until you sign in — for up to 24 hours, and cleared when you sign out — and is not sent to us either.

Email

We send email only for account matters — confirming an address, resetting a password, and telling you when your address has been changed — and for the signature requests and share links you send: to the people you address them to, and to you as they are opened and signed. Each carries a short code and no tracking of any kind — no pixels, no remote images, no click tracking. We do not send marketing email.

Who else sees anything

cherrypdf runs on hosting and storage providers, and uses a mail provider to deliver the account emails above. They process data on our behalf and for no purpose of their own. Beyond Google Analytics, described above, nothing is shared with third parties, and nothing is ever sold.

How long things are kept

Your rights

You can see and change what is on your account, download the files you have saved, and delete the account outright, all from your settings. If you want a copy of what is held about you, or want it erased, ask and we will do it.

Children

cherrypdf is not directed at children under 13, and we do not knowingly hold an account for one.

Changes

If this policy changes in a way that affects what happens to your documents, the date at the top changes with it.