Get started

Privacy policy

Last updated: March 18, 2026

Introduction

This privacy policy explains how PDF4.dev collects, uses, and protects your personal data when you use the website, dashboard, API, free PDF tools, or any other part of the service.

PDF4.dev is operated by benoitded, based in France. By using PDF4.dev, you agree to the practices described in this policy. If you have questions, contact [email protected].

What data do we collect?

Account data

When you create an account, we store your email address and a hashed password. Passwords are managed by better-auth and are never stored in plain text. We also store your account creation date.

API usage data

Each PDF generation via the API is logged with the following information: template ID or slug, render duration in milliseconds, output file size, status (success or error), error message if applicable, and timestamp. These logs are tied to your account and visible on your dashboard at /dashboard/logs.

API keys

When you create an API key, the full token is shown to you once and never stored. We store only a SHA-256 hash of the key, along with a short prefix (for identification in the dashboard), its permission scope, and creation date. The original key cannot be recovered from the hash.

Template and component data

Templates and components you create are stored in your account. This includes HTML content, sample data, PDF format settings, and metadata (name, slug, timestamps). This data is accessible only to you and persists until you delete it or delete your account.

Free PDF tools

All free tools (compress, merge, split, rotate, reorder, watermark, protect, unlock, image to PDF, PDF to PNG, PDF to JPG, add page numbers, flatten, and reorder pages) run entirely in your browser using client-side JavaScript libraries (pdf-lib, pdfjs-dist). Your files never leave your browser and are never uploaded to our servers.

The only exception is the HTML to PDF tool, which requires server-side rendering. In that case, the HTML you submit is processed by Playwright in an isolated browser context and discarded immediately after the PDF is returned in the response.

Rendering data

When you call the render API or use the dashboard preview, the HTML template and variable data you provide are processed in memory and never written to disk. The generated PDF is returned in the HTTP response and is not stored on our servers. See the "How does PDF4.dev handle document data?" section below for details.

How do we use your data?

We use the data we collect for the following purposes:

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

How long do we retain your data?

Account data

Your email, hashed password, and account settings are retained until you delete your account. You can delete your account at any time from the dashboard settings page (/dashboard/settings). Deletion removes all associated data: templates, components, API keys, and render logs.

API logs

Render logs (template ID, duration, status, file size, timestamp) are retained as long as your account exists. They are permanently deleted when you delete your account.

Rendered PDFs

Rendered PDFs are never stored. They exist only in server memory during the render request and are discarded as soon as the response is sent. No copy is kept on disk or in any cache.

Free tool files

Files processed by free PDF tools exist only in your browser memory. They are garbage-collected when you close the tab or navigate away. We have no access to these files at any point.

What cookies and local storage do we use?

PDF4.dev uses minimal browser storage, limited to what is required for the service to function:

We do not use advertising cookies, third-party tracking cookies, or any analytics scripts that set cookies.

Which third-party services do we use?

We work with a limited number of third-party providers. Each processes only the minimum data required for their specific function:

We do not share your data with any other third parties. We do not use data brokers, advertising networks, or data enrichment services.

How does PDF4.dev handle document data?

PDF4.dev processes documents (HTML templates, variable data, and generated PDFs) with the following safeguards:

How do we protect your data?

We implement multiple layers of security to protect your data:

Where is your data stored?

PDF4.dev is hosted on Railway with servers in the EU and US. Cloudflare provides global CDN distribution, which means static assets may be served from edge nodes worldwide.

If you are located outside the EU or US, your data may be transferred to and processed in these regions. We rely on the standard contractual clauses provided by our infrastructure providers (Railway and Cloudflare) to ensure adequate data protection for international transfers in compliance with GDPR Chapter V.

What are your rights under GDPR?

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

To exercise any of these rights, email [email protected]. We will respond within 30 days as required by GDPR. You also have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL (Commission nationale de l'informatique et des libertés).

Do we use analytics?

PDF4.dev does not use any third-party analytics tools (no Google Analytics, no Plausible, no Mixpanel, no tracking pixels). We do not track your browsing behavior across pages, and we do not build user profiles for advertising.

The only usage data we collect is API render logs (described above), which are tied to your account and visible to you on the dashboard. We may review aggregated, anonymized statistics (total renders, average duration) to monitor service health, but we do not analyze individual user behavior.

Children's privacy

PDF4.dev is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe a child under 16 has created an account or provided personal data to us, please contact [email protected] and we will delete the account and associated data promptly.

Links to other websites

PDF4.dev may contain links to external websites (documentation sources, official standards, third-party provider pages). We are not responsible for the privacy practices or content of those websites. We recommend reviewing their privacy policies before providing any personal data.

How will we notify you of changes?

We may update this privacy policy as the product evolves or as legal requirements change. When we make material changes that affect how your data is collected or used, we will notify registered users by email before the changes take effect. Minor clarifications or formatting changes will be made without notification.

The "last updated" date at the top of this page reflects the most recent revision. Previous versions are available upon request.

How can you contact us?

For any questions, concerns, or requests related to this privacy policy or how PDF4.dev handles your data, contact us at:

We aim to respond to all privacy-related inquiries within 7 business days and to GDPR requests within 30 calendar days.