Privacy Policy
Last updated: May 2026
PDFKit provides free, AI-powered PDF tools. We built this privacy policy to be short and readable. No legalese walls, just plain English about what happens with your data.
What we collect
- Files you upload. Your PDFs are sent to our servers for processing. They are automatically and permanently deleted after 1 hour.
- IP address hash. We store a one-way hash of your IP address to enforce rate limits (10 jobs per hour, 30 per day). We never store your raw IP address.
- Optional email. If you provide an email (for example, to receive a download link), we store it only for that purpose and delete it within 24 hours.
- Basic analytics. We use Plausible Analytics, which is cookieless and collects no personal data. Page views are counted without tracking individual users.
How your files are processed
When you upload a PDF, it is sent to our processing servers hosted on Railway. Depending on the tool, your file content may be sent to Anthropic's Claude API for AI processing (redaction, markdown conversion, table extraction).
Files are stored temporarily in S3-compatible buckets on Railway. After processing is complete, files remain available for download for up to 1 hour, then they are permanently deleted. There is no recovery after deletion.
What we do NOT do
- We never use your documents to train AI models. Files sent to Anthropic's API are processed under their zero data retention policy and are not used for model training.
- We never share your files with third parties. No advertiser, partner, or other service can access your uploaded documents.
- We never retain files beyond 1 hour. Deletion is automatic and permanent.
- We never run third-party analytics that read your content. Plausible is the only analytics tool we use, and it cannot see what you upload.
- Ads on PDFKit (if any) do not have access to your file contents.
Third-party services
| Service | Purpose | Data shared |
|---|---|---|
| Anthropic (Claude API) | AI processing of PDFs | File content (text), under zero retention |
| Railway | Hosting and file storage | Uploaded files (deleted after 1 hour) |
| Plausible Analytics | Privacy-friendly analytics | Page views only (no cookies, no personal data) |
Cookies
PDFKit uses only essential cookies required for the site to function (for example, CSRF protection). We do not use tracking cookies. Plausible Analytics is fully cookieless. For visitors in the EU, we show a GDPR cookie banner, but in practice there is nothing to opt out of since we do not set non-essential cookies.
Your rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access any personal data we hold about you.
- Deletion of your data. Since files auto-delete in 1 hour and we only store IP hashes, there is usually nothing left to delete.
- Portability of your data in a machine-readable format.
- Object to any processing of your data.
To exercise any of these rights, email us at privacy@pdfkit.io.
Children
PDFKit is not directed at children under 13. We do not knowingly collect data from children.
Changes to this policy
If we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.
Contact
Questions about this policy? Reach us at privacy@pdfkit.io.