Privacy Policy

Last updated: June 12, 2026

At DocuPDF, your privacy matters. This policy explains what information we collect, why we collect it, and how we use it when you use our PDF processing service.

By using DocuPDF, you agree to the practices described here.

1. Information We Collect

1.1 Account Information (Email and Password)

When you sign up using email and password, we collect:

  • Your email address
  • Your password (stored as a secure hash, never in plain text)
  • Account creation date
  • Email verification status

1.2 Google Sign-In

If you sign in with Google, we receive a small set of profile data from Google via OAuth 2.0:

  • Email address — used as your account identifier
  • Display name — shown in your profile and dashboard
  • Profile picture — shown in the navigation bar

We do not receive your Google password, and we never request access to Google Drive, Gmail, Calendar, Contacts, or any other Google service. The permission scope is strictly limited to basic profile information.

We store your sign-in method (email or Google) so we can direct you to the right login option next time.

1.3 Usage Data

  • Types of PDF operations you perform (merge, split, compress, OCR, etc.)
  • Timestamps and operation counts
  • Daily and monthly usage totals (used to enforce plan limits)
  • Your current subscription plan and status

1.4 Uploaded Files

  • Files are processed temporarily on our servers and deleted right after the task completes
  • We do not store, read, analyze, or use the contents of your documents for any purpose beyond processing your request

1.5 Security and Log Data

  • IP addresses (used for fraud and brute-force detection)
  • Failed login attempts and account lockout events
  • Security events (retained for up to 90 days)

1.6 Payment Data

Payments are handled by Stripe and/or Razorpay. We never see or store your full card number, CVV, or bank details. We only keep your subscription status and anonymized transaction records provided by the payment processor.

2. How We Use Your Information

We use what we collect to:

  • Run and improve our PDF tools
  • Verify your identity and manage your account
  • Show your name and profile picture in the interface (Google users)
  • Track usage against your plan limits
  • Process payments and subscriptions
  • Send account emails (verification, password reset, welcome, security alerts, ticket updates, and optional marketing/product emails)
  • You can manage which emails you receive from your account settings — transactional emails (verification, password reset) cannot be turned off
  • Detect and prevent fraud and abuse
  • Meet legal requirements
  • Understand aggregate usage trends to make the service better (no individual profiling)

We do not sell your data. We do not use it for advertising.

3. Google Sign-In

When you click "Continue with Google", you're taken to Google's own login screen. Google handles everything there. Once you log in, Google sends us a limited set of profile data (name, email, profile picture) and nothing else.

Our integration:

  • Uses the industry-standard OAuth 2.0 protocol
  • Only requests the minimum needed permissions (profile and email)
  • Does not store Google access or refresh tokens
  • Issues its own DocuPDF session token after you log in

Google's handling of your data is governed by the Google Privacy Policy.

4. Data Retention

  • Uploaded files: Deleted immediately after processing, usually within minutes
  • Account data: Kept while your account is active, plus up to 30 days after deletion
  • Security logs: Kept for 90 days
  • Payment records: Kept as required by tax and financial regulations (typically 7 years)
  • Anonymized analytics: May be kept long-term for service improvement

5. Who We Share Data With

We share data only when necessary, and only with:

  • Payment processors (Stripe, Razorpay) — to handle subscription billing. They have their own privacy policies.
  • Email delivery (Resend) — to send you transactional emails.
  • Security services (IPQualityScore) — to check IP and email reputation during registration and prevent fraud.
  • Law enforcement or government agencies — only when required by law or court order.

All third-party providers are required to protect your data and use it only for the specific purpose we've authorized.

6. Cookies and Tracking

We keep this minimal:

  • Session tokens: Stored in your browser's localStorage to keep you signed in
  • Cloudflare Turnstile: Used to prevent bots during login and signup. Cloudflare may set its own cookies per their privacy policy.
  • No third-party advertising cookies. No cross-site tracking.

7. Security

We take reasonable steps to protect your data, including:

  • bcrypt hashing for all passwords
  • JWT-based authentication with expiration
  • HTTPS encryption for all data in transit
  • Brute-force protection and automatic account lockout
  • IP reputation checks to filter fraudulent sign-ups
  • Security event logging and monitoring

That said, no system is completely secure. We'll do our best to keep your information safe, but we can't guarantee it absolutely.

8. Your Rights

Depending on where you live, you may have the right to:

  • Access: Get a copy of the personal data we hold about you
  • Correction: Ask us to fix inaccurate data
  • Deletion: Request that we delete your account and associated data
  • Portability: Receive your data in a readable format
  • Opt-out: Unsubscribe from non-essential emails

To make a request, email us at privacy@docupdf.app. We'll get back to you within 30 days.

If you signed in with Google, you can revoke DocuPDF's access at any time via Google Account Permissions. Note: revoking access won't automatically delete your DocuPDF account. Contact us separately if you want that done.

9. Children's Privacy

DocuPDF is not intended for anyone under 13 (or under 16 in the EU). We don't knowingly collect information from children. If you think we have, please reach out and we'll address it right away.

10. International Data Transfers

Our servers are in the United States. If you're using DocuPDF from another country, your data may be transferred to and processed in the US or wherever our service providers operate. By using DocuPDF, you agree to this.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When something meaningful changes, we'll update the date at the top and notify you by email if the law requires it. Continuing to use DocuPDF after changes go into effect means you accept the updated policy.

12. Contact Us

Questions about this policy or your data? Get in touch: