PDF Sanctum
HomeMergeOrganizeCompressRebuildRedactConvertWatermarkMetadataCropUnlockEncryptionSignCompareEditExtractFormsSanitizeImagesBatchImpose
Runs locally · nothing uploaded
Home/Privacy

Privacy policy

This one is short because there really is little to say. Nothing server-side receives your document, so the usual question, "what do you do with my file?", is answered by the architecture rather than by policy. What's left are three things your own browser stores locally, named below so you can go look.

The short version

  • No account. There's nothing to sign up for, so there's no identity to attach anything to.
  • No analytics. No page-view counter, no session recording, no tag manager, no advertising pixels.
  • No upload. Your document is read into the page and never sent anywhere. There's no receiving endpoint because there's no backend.
  • Three local storage keys, named below. Everything your device keeps stays on your device.

If you want to check the third claim instead of believing it, the home page counts its own outbound requests to domains other than this one and shows you the running total. It should stay at zero no matter what you run through the tools.

What is stored on your device

Three things, nothing else. Open your browser's developer tools and look under Application (Chrome) or Storage (Firefox, Safari) while you're on any page here:

Theme preference: pdfsanctum:theme in localStorage
The string light or dark, written when you press the moon button. It's a preference, not an identifier.
File hand-off: IndexedDB database pdfsanctum-local, store handoff
If you drop a file on the home page and then continue into a tool, those bytes have to get to the next page somehow, and a web page can't hand its memory to another page. They're placed here for that hand-off, and the tool page deletes the record the moment it takes the file. Anything not collected is treated as expired after ten minutes, and the next read throws it away instead of handing it over. Nothing else is ever written to this database.
Offline copies of the site itself: Cache Storage
The service worker saves this site's own HTML, CSS, and JavaScript so the tools keep working with the network switched off. Your documents are never part of that cache; what gets stored is the same files any visitor downloads.
About that hand-off. It's why this page doesn't claim your file "only ever exists in memory". It's a local copy on your own disk, made by your own browser, with no network involved. Clearing it is deliberate: clearing site data removes all three instantly. On iPhone and iPad, Safari may also clear this storage on its own after a long stretch without you opening the site.

What does cross the network

When you load a page here, your browser fetches the page, its stylesheet, its scripts, and three JavaScript libraries: pdf-lib, pdf.js, and JSZip. They're bundled with the site rather than pulled from a CDN, so all of them come from this domain. None is fetched from someone else's server, which is why nothing here can quietly change underneath you.

Beyond those files, nothing is transmitted: not your document, not a fingerprint, not even an identifier, because there's none to send.

One caveat. Whoever hosts these static files can read the ordinary web-server logs any website produces: IP address, user agent, timestamp, the path requested. That's true of every site on the internet, and this one can't promise it away. It isn't a document risk here for one reason: no request ever carries your document, so there's nothing about it in those logs to begin with.

Cookies and third parties

There are no cookies at all, not even essential ones. The site has nothing to remember between visits that local storage can't handle on its own. There's no advertising, no remarketing, no A/B testing service, and no fonts or font-tracking loaded from another domain.

If you email us

Whatever you write stays in a mailbox only as long as it takes to answer. Don't paste documents, account numbers, or anything else sensitive into an email; the contact page explains what happens to mail that arrives.

Changes to this page

Last updated 2026-09-17. If anything here changes in substance, this date changes with it. There's no fine print waiting behind that sentence: a policy that quietly grew new powers would have to ship new code, and the code this site runs is the code you can watch load.

Questions about any of the above, or about something you think should be stated here and is not: hello@pdfsanctum.com.

How it works

The libraries behind the tools, where each byte goes, and how to check all of this yourself.

Terms of use

What you're responsible for, and the limits to know before you trust an output.

Contact

Email for bugs and questions, and what to include so a report can be reproduced.