Privacy policy

1. Your files

Every tool runs inside your browser. When you choose a file, the browser reads it from your disk into the page’s memory. The transformation happens there, using local JavaScript and WebAssembly. The result is handed back as a download. At no point is the file sent to PocketPDF, to its hosting provider, or to any third party.

This is not a promise about behaviour; it is a description of the code. There is no file-upload endpoint, no storage bucket for documents, and no server-side processing queue. If you want to confirm it, the how it works page shows how to watch the Network tab while processing a file.

The site never modifies your original file. It creates a new output file, and your browser saves that wherever you choose. If a tool fails mid-job, the original remains untouched.

Files can contain personal data — names, addresses, medical records, financial details. Because those files stay on your device, PocketPDF is not a controller or processor of that data. You remain responsible for the file, where you store it, and who you send it to.

2. What is collected

PocketPDF collects no personal data from your files, and builds no individual profile from your use of the tools. Specifically:

• No accounts, names, passwords or profiles.
• No heatmaps, session recording, fingerprinting or A/B testing.
• Aggregate traffic counts through Cloudflare Web Analytics: cookieless, no individual profiles, no cross-site tracking. See section 5.
• No advertising, ad auctions, tracking pixels or social embeds.
• No file contents, file names, page counts or document metadata.
• No sale or sharing of personal data.

The only personal data the site can hold is what you deliberately submit through the feedback form. That is covered in section 6.

3. What your browser stores

Five small values are kept in localStorage on your device. They never leave the browser and are readable only by this site. You can remove them at any time by clearing site data for this domain.

Cache Storage. If your browser supports service workers, the site registers one to make pages work offline. It caches the page shell and assets you have visited — HTML, CSS, JavaScript, fonts and processing libraries. It does not cache the files you process. The cache is local, can be cleared through your browser’s site-data settings, and is replaced when the site is updated.

No session storage or IndexedDB. The tools use neither for your documents. A file lives in the page’s memory only while the tab is open.

4. Cookies

PocketPDF sets no cookies. The Cloudflare Web Analytics beacon is cookieless and does not write to localStorage, so the site does not show a consent banner. If you see a cookie prompt while visiting this site, it is coming from your browser, an extension or a different site — not from PocketPDF.

The site does not use fingerprinting, canvas tracking, tracking pixels or advertising tags. Fonts and processing libraries are served from this domain; they are not fetched from a third-party CDN at runtime.

One exception is stated here rather than buried: the video and audio tools use a 31 MB ffmpeg WebAssembly engine. Cloudflare Pages rejects files over 25 MiB, so on the pages.dev build that single file is loaded from the project's own GitHub Pages mirror, voidhere.github.io. It is a static engine file, requested only when you open a media tool, and it carries no file or message content. GitHub's hosting sees the same kind of request metadata as any static host, described in section 5.

5. What the hosting provider sees

Like any website, the static files have to be delivered by a hosting provider. PocketPDF is served as static files, currently through Cloudflare Pages. The provider may process standard technical data to deliver the page and protect the service:

• IP address, request time, requested URL, referrer, browser user-agent and similar HTTP headers.
• Security and abuse signals at the network edge.

This is ordinary web infrastructure. The site does not read, mine, combine or profile those logs, and they do not contain the contents of your files. The provider’s own privacy terms and retention periods apply to that data. If you want to avoid even that, you can download the static site and run it from a local folder or a local server; the tools work the same way.

Traffic measurement. The site loads Cloudflare Web Analytics, a cookieless measurement script from static.cloudflareinsights.com. It reports aggregate page views, referrer, country, device type and performance timings to Cloudflare. It does not set cookies, does not fingerprint, does not build a profile of you, and never receives file contents or file names. Cloudflare's own privacy terms and retention periods apply to those aggregate reports.

6. Messages, feedback and reviews

The feedback form delivers what you submit to the site owner's inbox through Web3Forms, a form-relay service. It does not open an email app, and nothing is published. Web3Forms processes the message in transit and forwards it by email; its privacy policy applies to that relay.

The message can include: the message type, your name and contact if you provide them, the tool, a rating for reviews, the message, the page address, browser user-agent, viewport, language and the time. It never includes your files. Web3Forms and its infrastructure may see standard request data such as your IP address while relaying the message; that data is not added to the message stored in the inbox.

The message is used only to read and act on feedback, fix bugs and improve tools. It is not used for marketing, sold or shared. It is never stored on the public site. Do not include passwords, keys or sensitive personal data in a message; a description is enough.

Messages stay in the inbox until reviewed, then are deleted once the issue is handled. You can ask for a copy or deletion through the same form using “Correction or data request”; include enough context to identify the message. See section 8.

7. Third parties and external links

PocketPDF does not embed advertising, social widgets, comment systems or third-party CDN scripts. The only third-party runtime requests are the cookieless Cloudflare Web Analytics beacon described in section 5 and the ffmpeg engine mirror described in section 4. The guides may link to external sources such as standards bodies or open-source projects. Those links are ordinary hyperlinks; nothing is requested from the external site until you click one. Once you leave, that site’s privacy policy applies.

The processing engines are open-source libraries served from this domain, with the ffmpeg exception described in section 4. Their licences are credited on the about page.

8. Your rights

Privacy laws such as the GDPR and CCPA give people rights to access, correct, delete, restrict or object to the processing of their personal data, and to complain to a regulator. Because PocketPDF holds no account data and no files, most of these rights are satisfied by the architecture: the data is already only on your device.

For feedback messages, you can ask for a copy or deletion of messages you sent. Use the feedback form and choose “Correction or data request”; include the approximate date, type, tool and any contact details you used. It will be handled within a reasonable period, normally within 30 days.

You can clear the local settings and cache yourself at any time:

• Chrome / Edge: Settings — Privacy and security — Third-party cookies — See all site data and permissions — search www.pocketpdf.site — Delete.
• Firefox: Settings — Privacy & Security — Cookies and Site Data — Manage Data — search the domain — Remove.
• Safari: Settings — Privacy — Manage Website Data — search the domain — Remove.

9. Children

PocketPDF is a general-purpose file utility, not a service directed at children under 13. It has no accounts, no social features, no comments and no data collection. A child can use it the same way an adult can, with the same result: the file stays on the device. Parents and guardians should still supervise what files are opened and downloaded.

10. Security

The site is served over HTTPS and is a static bundle, which removes a whole class of server-side risks: there is no login database to leak and no document store to breach. The security page describes the model, the encryption tools and how to report a vulnerability. No system is perfectly secure; the honest claim is that there is very little here to attack, and the files are not part of it.

11. Changes to this policy

This policy changes only when the architecture or the law requires it. If a future feature genuinely needed a server — nothing on the roadmap does — the change would be described here in plain language, dated, and made visible before the feature was used. The date at the top is the date of the last substantive review.

12. Contact

Questions, corrections or a data request: use the feedback form. A real person reads it. If something here does not match what you observe, that is worth reporting — the policy should describe the site, not the other way around.