Privacy Policy
The short version: the tools work without an account. Files you process are used only to run the job you asked for, nothing is listed or browsed, and every uploaded file is deleted automatically after 2 hours. An account stores only what it needs — username, email, a password hash — and nothing is ever sold, tracked or trained on.
1. Who we are
Free PDF Editor (“we”, “us”) is a brand of QEPL Technologies, New Town Business District, Rajarhat, Kolkata – 700156, West Bengal, India. We run a collection of free online PDF tools — edit, merge, split, compress, convert, sign, fill forms, OCR and more — at this website (the “Service”). This policy explains what we process, why, and the choices you have — whether you use the tools anonymously or hold an account. You can reach us at any time via pdfedit@freepdfeditor.recollem.me.
2. Files you process with the tools
- What we receive. When you choose a file, it is uploaded to our server so the tool can produce the result. Files are stored under an unguessable id — they are never listed, never searchable and never shared with other visitors.
- How we use them. Only to perform the operation you requested (convert, merge, edit, compress…) and to serve the result back to you. We do not open, index, mine or train anything on your documents.
- How long we keep them. Uploaded files and their results are deleted automatically after 2 hours. The PDF editor's “Save” keeps a draft only for your own session; drafts live in your browser's local storage (see §9) and are removed when you finish or when you clear your browser data.
- Attachments. Files you add through the editor's Attachments panel are embedded into the PDF you are editing, and follow the same 2-hour lifetime.
- Custom fonts. A font you upload through the editor is stored on the server so the editor and your exports can use it. Custom fonts are not tied to a document's 2-hour lifetime — contact us via pdfedit@freepdfeditor.recollem.me if you would like one removed.
- Cloud imports. If you pick a file from Dropbox, Google Drive or OneDrive, the connection and permission screens are handled entirely by that provider. We receive only the file you choose, and it is processed like any other upload.
3. Accounts, sign-in and verification
Every tool on the site works without an account. An account keeps your settings and credits together — and, on the Commercial plan, your API keys — and here is exactly how it works:
- Signing up. You pick a username, an email address and a password. Before the account exists we send a 6-digit verification code to that email address and you enter it on the site. Until the code is verified, your details sit in a short-lived “pending” record that is deleted as soon as it is used, and expires automatically within about 10 minutes if it is not (with a limit on attempts and a short cooldown between resends).
- Passwords. We never store your password. Only a modern one-way password hash is kept, and it cannot be turned back into the password.
- Signing in. A successful login sets a session cookie (see §9). You can optionally tick “keep me signed in”, which keeps a persistent sign-in cookie until you log out. Logging out clears the session.
- Changing things. You can update your username, email, avatar and password from your account page. Changing your password requires your current password — so a borrowed browser cannot lock you out of your own account.
- Deleting your account. There is no self-serve delete button yet — contact us via pdfedit@freepdfeditor.recollem.me and we will delete your account, and everything attached to it, for you.
4. What an account stores
- Your details: username, email address, password hash, and the date the account was created.
- Your profile extras: an avatar image if you upload one, and the plan flag that tells the site which features to show you.
- Your avatar is public-ish. Like on most sites, an avatar you upload rides on pages you appear on (for example the header when you are signed in, where anyone viewing that page could load the image by its URL). Upload a picture you are comfortable sharing — and remove it any time from your account page.
- Account details are kept for as long as the account exists. When you ask us to delete the account, the account rows and your avatar are removed.
5. API keys, credits and usage records
- API keys (Commercial plan). API keys are part of the Commercial plan — free accounts don't have them. Keys you create live in our database so the API can recognise you; the key value is kept so you can reveal or copy it from your account page, and revoking one stops it working immediately. We record when a key was created, when it was last used and how many requests it has made.
- Credits. New accounts receive 100 welcome credits, and every charge (an API call, a welcome grant, a credit purchase) is written to a usage record with the action, the amount and the time. Your balance and its full history are visible on your account page.
- These records are part of the account. They exist to operate fair-use limits and show you where your credits went — not for profiling, advertising or anything else.
6. Emails we send
We send transactional email only: the verification code when you sign up, and answers when you write to us. We do not run newsletters, and your address is not added to marketing lists. Delivery is handled by a transactional email provider acting on our instructions.
7. Payments
The browser tools are free. API access is part of the Commercial plan: keys come with monthly or yearly plans starting at 10,000 credits a month — see the plans page and the API Terms. When a payment is made, it is handled by a third-party payment provider: your card details go directly to that provider and never touch our servers — we only receive a confirmation that a payment succeeded, plus the plan flag attached to your account.
8. What we do not do
- No selling, renting or trading of personal data — ever.
- No advertising trackers, no cross-site tracking pixels, no third-party analytics profiling on this site.
- No watermarks and no “sign up to download” walls — your result comes straight back to you.
- No human review of documents. Nobody at Free PDF Editor looks inside your files; the only access is automated processing.
- No training of anything on your documents — they exist to run your job and then they are gone.
9. Cookies and local storage
We keep this minimal:
- A session cookie, set after you log in. It holds a signed reference to your login so pages know who you are. It also carries the CSRF token that protects forms. Logging out clears it.
- A persistent sign-in cookie, only if you tick “keep me signed in” at login — so the session survives closing the browser. Logging out ends it.
- Browser local storage — used for your editor draft (so a refresh does not lose your work), your recent colours, small preferences like the language selector, and the last workflow you opened. This stays in your browser; it is not sent to us, and clearing your browser data removes it.
- No third-party cookies. Embedded tools (OCR, previews) run from our own domain, so no other company sets cookies here.
10. Server logs
Like every web service we keep standard, short-lived server logs (IP address, browser type, the pages and API calls requested) to keep the Service safe, debug problems and stop abuse — including rate-limited API calls. Logs are not used to profile you and are rotated regularly.
11. Where your data lives, and who helps us
The Service runs on our own application and our own database — account data is stored in our own database and is not handed to any third-party database service. Files live in our hosting environment for their 2-hour lifetime. The only parties that can touch data as part of running the Service are:
- our hosting provider, which runs the servers;
- a transactional email provider, used only to deliver your verification code and messages you send us;
- your cloud storage provider when you actively choose a file from it;
- a payment provider, when a payment is actually made — commercial keys only; the browser tools never involve payment.
These providers act on our instructions and are not permitted to use your data for their own purposes.
12. Security
Everything that moves between your browser and our servers is encrypted in transit (HTTPS/TLS) — uploads, forms, downloads and API calls all travel sealed, end to end. Credentials are hashed at rest: passwords are stored only as modern one-way hashes, never as readable text. Files are keyed by unguessable identifiers, are never browsed or listed, and are removed after 2 hours. Verification codes expire quickly, allow only a few attempts, and can be resent only after a cooldown; state-changing actions are CSRF-protected; API keys can be revoked in one click and stop working the moment you do. No system is perfect, but we keep the surface deliberately small: the fewer things we store, the fewer things can leak.
13. How long data is kept
- Uploaded files and results: deleted automatically after 2 hours.
- Pending sign-ups: minutes — deleted on verification or expiry, whichever comes first.
- Account data (profile, avatar, keys, credit history): kept while the account exists, removed when you ask us to delete the account.
- Server and API logs: short-lived and rotated.
- Emails we sent you: they live in your inbox, under your control.
14. Your rights
Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you, to restrict or object to certain processing, and to lodge a complaint with your data-protection authority. Because we store so little, most of these are easy: file data is already gone within 2 hours, and account data is removed when you ask. Contact pdfedit@freepdfeditor.recollem.me and we will respond within 30 days.
15. Children
The Service is not directed at children under 13, and accounts are not available to them. We do not knowingly collect personal data from children under 13; if you believe a child has provided us data, contact us and we will delete it.
16. International transfers
Our providers operate data centres in several countries. This means account data and logs may be processed in a country other than yours, including regions used by our hosting, database and email providers. We choose providers that commit to appropriate safeguards for such transfers, and we never move your data anywhere it would lose protection.
17. Changes to this policy
If we change this policy we will update the date at the top of this page. For material changes we will make the change visible on the site. Continuing to use the Service after an update means you accept the new version.
18. Contact
Questions, requests or complaints: pdfedit@freepdfeditor.recollem.me. This policy works alongside our Terms & Conditions and API Terms.
Free PDF Editor — a QEPL Technologies brandNew Town Business District,
Rajarhat, Kolkata – 700156,
West Bengal, India