A full and transparent explanation of how PDFHarbor handles your data, your files, and your privacy.
🔒 The core promise: Your PDF files never leave your device for the vast majority of our tools. Processing happens entirely in your browser using JavaScript — no server, no upload, no storage.
For the small number of advanced tools that require server-side processing (such as PDF to Word), your file is sent over an encrypted connection, processed, returned to you, and permanently deleted immediately. We retain no copies.
PDFHarbor is a free, browser-based PDF tool suite available at https://www.pdfharbor.net. We provide 44 tools that allow you to merge, split, compress, rotate, convert, annotate, and edit PDF files directly in your web browser — with no account required.
PDFHarbor is an independently operated web application. We are not affiliated with Adobe Systems, Google, or any major PDF software vendor. Our tools are built on open-source libraries including pdf-lib and PDF.js.
For privacy-related enquiries, contact us at: privacy@pdfharbor.net
We collect the minimum data necessary to operate and improve PDFHarbor. The table below summarises everything we collect:
| Data Type | What It Is | Why We Collect It | Stored? |
|---|---|---|---|
| PDF Files | The files you upload to use our tools | To perform the tool operation you requested | No — processed in browser only Server tools: deleted immediately |
| Page views | Which pages and tools you visit | Analytics — understand usage patterns | Yes — anonymised, via Google Analytics |
| Device info | Browser type, OS, screen size | Analytics — ensure compatibility | Yes — anonymised, via Google Analytics |
| Approximate location | Country and city (not precise) | Analytics — understand geographic reach | Yes — anonymised, via Google Analytics |
| Referral source | How you found PDFHarbor (e.g. Google search) | Analytics — understand traffic sources | Yes — anonymised, via Google Analytics |
| Ad interaction data | Which ads are shown/clicked | Advertising revenue — served by Google AdSense | Yes — by Google, under their privacy policy |
We do not collect: names, email addresses, passwords, payment information, IP addresses (beyond what Google Analytics aggregates), or any data that directly identifies you as an individual.
The vast majority of PDFHarbor tools — including Merge, Split, Compress, Rotate, Protect, Watermark, Add Page Numbers, Delete Pages, Reorder Pages, Add Image, Metadata Editor, E-Signature, Text Stamp, Redact, Crop, Flatten, Unlock, Repair, Grayscale, Resize Pages, Header & Footer, Add Blank Pages, Extract Text, Add Hyperlinks, Find & Replace, and PDF Text Box Editor — process your files entirely within your browser.
Here is exactly what happens when you use one of these tools:
FileReader API)At no point does your file travel over the internet, touch our servers, or get stored anywhere. We are technically incapable of accessing your file.
Two live tools currently require server-side processing because they involve complex format conversion that cannot be performed in a browser:
For these tools, the following happens:
Our conversion server is hosted on DigitalOcean in Toronto, Canada, and is operated exclusively by PDFHarbor. No third party has access to files processed through this server.
We use a small number of cookies, all from established providers. We do not use any proprietary tracking cookies.
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
_ga |
Google Analytics | Distinguishes unique users | 2 years |
_gid |
Google Analytics | Distinguishes users within 24 hours | 24 hours |
_gat |
Google Analytics | Throttles request rate | 1 minute |
| AdSense cookies | Google AdSense | Serve relevant advertisements | Varies |
You can manage or delete cookies at any time through your browser settings. Disabling cookies will not affect your ability to use any PDFHarbor tool — cookies are not required for tool functionality.
To opt out of Google Analytics tracking specifically, use the Google Analytics Opt-out Browser Add-on.
We use Google Analytics 4 (GA4) to collect anonymous usage statistics. This helps us understand how PDFHarbor is being used so we can improve it.
Specifically, Google Analytics tells us:
All of this data is anonymised and aggregated. We cannot identify individual users from Google Analytics data. IP addresses are anonymised by Google before they reach our analytics dashboard.
Google Analytics data is processed by Google LLC and subject to Google's Privacy Policy. We have enabled IP anonymisation in our Google Analytics configuration.
PDFHarbor displays advertisements served by Google AdSense. Advertising revenue helps us keep PDFHarbor free for everyone.
Google AdSense may use cookies and your browsing history to serve you personalised advertisements — ads that are relevant to your interests based on sites you've previously visited. This is called "interest-based advertising" or "personalised advertising."
You have control over personalised advertising:
Opting out of personalised ads does not mean you will see no ads — it means the ads shown will not be tailored to your interests.
PDFHarbor does not have access to the data Google uses to target ads, and we do not share any user data with Google for advertising purposes beyond what Google's own scripts collect.
PDFHarbor relies on several trusted third-party services to operate. Each is listed below with a link to their privacy policy:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Google Analytics 4 | Website analytics | Anonymised usage data | View |
| Google AdSense | Advertising | Cookie data for ad targeting | View |
| Google Fonts | Web fonts (Plus Jakarta Sans, Inter) | Your IP address (to serve fonts) | View |
| Cloudflare CDN | Serves PDF.js library files | Your IP address (to serve files) | View |
| unpkg CDN | Serves pdf-lib library files | Your IP address (to serve files) | View |
| Microsoft Azure | Website hosting (Static Web Apps) | Standard web server logs | View |
| DigitalOcean | Conversion server hosting (Toronto, CA) | Files sent to server-side tools only | View |
| Stirling PDF | Open-source PDF conversion engine | Files sent to server-side tools only — deleted immediately | GitHub |
PDFHarbor does not sell, rent, trade, or otherwise transfer your personal data to third parties for commercial purposes.
We may share anonymised, aggregated analytics data (e.g. "PDFHarbor had 10,000 visitors in May") publicly or with partners, but this data cannot be used to identify any individual user.
We would only disclose data to authorities if required by a valid legal obligation — and since we do not store personal data or file contents, there is very little we could disclose even if required to.
Browser-based tools: zero retention — files exist only in your browser's memory during your session and are gone the moment you close or refresh the tab.
Server-side tools: files are retained on our server for less than 60 seconds — only for the duration of the conversion process. They are then permanently deleted. Our server has no scheduled backups that would capture these files.
Google Analytics data is retained for 14 months by default, after which it is automatically and permanently deleted by Google.
Microsoft Azure and our DigitalOcean server may retain standard web server access logs (containing IP addresses and request timestamps) for up to 30 days for security and debugging purposes. These logs are not used for tracking or marketing.
We take the security of our platform and your data seriously. The following measures are in place:
X-Content-Type-Options, X-Frame-Options, and Referrer-Policy to protect against common web attacks.No system is 100% secure. While we take all reasonable precautions, we cannot guarantee the absolute security of data transmitted over the internet.
Depending on your location, you may have rights regarding your personal data. Since PDFHarbor does not collect or store personal data in the traditional sense, most of these rights are automatically satisfied by our architecture. Nevertheless, here is how each right applies:
| Right | How It Applies to PDFHarbor |
|---|---|
| Right to access | We hold no personal data about you beyond anonymised analytics. You can view your own Google Analytics data by contacting Google. |
| Right to erasure | Your files are never stored. Analytics data is anonymised and cannot be attributed to you individually. |
| Right to object | You can opt out of Google Analytics using the opt-out add-on. You can opt out of personalised ads via Google Ad Settings. |
| Right to portability | Not applicable — we hold no personal data to export. |
| Right to rectification | Not applicable — we hold no personal data to correct. |
| Right to restrict processing | Contact us at privacy@pdfharbor.net and we will disable analytics tracking for your session where technically possible. |
To exercise any of your rights, contact us at privacy@pdfharbor.net. We will respond within 5 business days.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent legislation applies to your data.
We process data under the following legal bases:
Google Analytics and Google AdSense may transfer data to the United States. Google participates in the EU-US Data Privacy Framework, providing appropriate safeguards for such transfers.
Our conversion server is located in Toronto, Canada, which the European Commission has deemed to have an adequate level of data protection for personal data transfers.
PDFHarbor is a small independent project and does not have a designated Data Protection Officer. For all GDPR enquiries, contact: privacy@pdfharbor.net
If you believe your GDPR rights have been violated, you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities can be found at edpb.europa.eu.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding your personal information.
No. PDFHarbor does not sell personal information. We do not receive money in exchange for your personal data. Google AdSense may use data for targeted advertising, which under CCPA may constitute a "sale" — you can opt out of this via Google Ad Settings.
To submit a CCPA request, email privacy@pdfharbor.net with the subject line "CCPA Request". We will respond within 45 days.
PDFHarbor is not directed at children under the age of 13 (or under 16 for users in the EEA). We do not knowingly collect personal information from children.
If you are a parent or guardian and believe your child has provided personal information to PDFHarbor, please contact us at privacy@pdfharbor.net and we will take immediate steps to delete any such information.
Since PDFHarbor requires no account creation and collects no personal information from users, the risk of inadvertent data collection from children is minimal. However, we take this obligation seriously.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of PDFHarbor after any changes constitutes your acceptance of the updated Privacy Policy.
Previous versions of this policy are available on request by emailing privacy@pdfharbor.net.
If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please reach out:
For GDPR or CCPA requests, please include "GDPR Request" or "CCPA Request" in your subject line so we can prioritise your enquiry appropriately.