Privacy

This one page covers both things we make: the tools on this website, and the PDFiq Android app. They are built differently and collect different amounts, so they are described separately rather than averaged into one comfortable paragraph.

Who we are

pdf-iq.com and the PDFiq Android app are published by BillionEdges. In this policy "we", "us" and "our" mean BillionEdges, and "you" means the person using the site or the app.

You can reach us at support@pdf-iq.com about anything here.

Part one — this website

Your files are not uploaded

Every tool on this site — compress, merge, split, images to PDF, rotate, reorder and OCR — runs inside your browser tab. The code that does the work is downloaded with the page, the same way a stylesheet is, and it then operates on a file your browser holds in memory.

There is no upload step because there is no server to upload to. That means there is also no deletion policy for your documents: we cannot delete what we never received. You can check this yourself — open your browser's developer tools, use a tool, and watch the network panel stay empty. The counter in the footer of every page measures the same thing and is live, not decorative.

What we collect on this site

No account for the tools. None of them asks you to sign in.

An account, only if you sign in for Pro. It is described in full under If you sign in, below.

No cookies. We set none, for any purpose, including analytics. Using any of the seven tools, or reading any page, sets no cookie at all. The one place a cookie can appear is Paddle's checkout, after you press Pay; it is described under If you buy Pro: the checkout.

No analytics and no tracking. There is no analytics SDK, no tag manager, no pixel and no third-party script on any page of this site. Paddle's checkout script runs only at a separate address, checkout.pdf-iq.com, and only after you press Pay. Nothing here reports back what you did.

No third-party requests from the tools. Fonts are served from this domain rather than a font CDN, so loading a page does not tell anyone else that you visited.

Only if you choose it: the form on the firms page sends an email address and a description of what you do, when you fill it in and press the button. It is described in full below. No tool on this site sends anything, ever.

Also only if you choose it: signing in on the account page, which exists only for Pro, hands Google's statement of who you are to the Firebase service our accounts are kept in. It is described in full under If you sign in.

Only if you choose it: the form on the firms page

This applies to the website only. The Android app does nothing of the kind — it has no such form, and nothing in this section is part of the app's Google Play Data Safety declaration.

/for-professionals asks firms what part of working with documents takes longer than it should, and apart from signing in for Pro, it is the only place on this site that receives anything from you. If you use that form we store exactly five things:

• The email address you type — so we can reply
• What you say you do, in your own words — the answer the page exists to collect
• What you say you spend too long on, if you choose to answer that — also in your own words, and left empty if you skip it
• Whether you said you would expect to pay once or yearly, if you answer that — also your own words, and left empty if you skip it
• The date you sent it

That is the whole record. We are handed your IP address on that request, as any server is, and we deliberately do not write it down. No name, no company, no cookie, and nothing that identifies the browser.

It goes to this site's own infrastructure and to nobody else. There is no third-party form service: the content security policy on every page of this site would block one, so this is verifiable rather than merely promised. There is no mailing list. The address is used to contact you about professional access and for nothing else — not newsletters, not product announcements, and it is never sold, rented or shared.

Ask at support@pdf-iq.com and it is deleted. Using any of the seven tools never involves this form, and none of them asks you for anything.

Four things stored in your browser, and up to four more if you sign in

You can clear all of them at any time through your browser's “clear site data” control.

Requests this site makes

OCR needs a language recognition model, which is between 6 MB and 11 MB depending on the language. It is served from this domain, downloaded once, and then cached. That download is a request for a file; it does not carry any part of your document, and no other tool on this site fetches anything at all after the page has loaded.

Signing in for Pro is the other exception, and it happens on the account page and the purchase page only: each contacts identitytoolkit.googleapis.com when you sign in there, and securetoken.googleapis.com when it renews a sign-in that is about to expire (the purchase page does so only to confirm a purchase you have just made). Both are Google's, and both are described under If you sign in.

Server logs

The site is static files served by Cloudflare Pages. Asking for a web page necessarily tells the server who is asking, so — as with every website — the request is recorded, including your IP address, the time, the page requested and your browser's user-agent string. We do not combine those records with anything else, and the tools give us nothing to combine them with: no account, no cookie, no identifier.

Your documents are not in those logs, because your documents are never sent.

If you sign in

An account exists only for Pro. None of the seven tools needs one, and signing in changes nothing about how they work. It is the same account the Android app uses: signing in here or in the app reaches the same record.

What happens. The account page, or the purchase page if you sign in from there, sends you to Google's own sign-in page and asks Google for openid email only: your email address and a Google account identifier, not your name or photo. Google sends you back with a signed statement of those two things. The page hands that statement to identitytoolkit.googleapis.com — Firebase Authentication, the Google service our accounts are kept in — which returns a sign-in for this browser. None of this goes to pdf-iq's own servers.

What Firebase keeps: an account record with your email address, your Google account identifier, and when the account was created and last signed in.

What this browser keeps, in its local storage under pdfiq.session: uid, email, idToken, idTokenExpiresAt, refreshToken. In that order: the account identifier, your email address, a proof of sign-in that lasts about an hour, when that proof expires, and the refresh token that renews it. When the proof is within five minutes of expiring, the account page (or the purchase page, while confirming a purchase) renews it at securetoken.googleapis.com, sending the refresh token.

While you are away at Google's sign-in page it also keeps state, nonce, startedAt under pdfiq.signin, in session storage: two random values that let the page check that Google's answer belongs to a sign-in it started, and the time it started. The two random values travel to Google in the sign-in link. All three are deleted when you come back, or when the tab is closed.

The refresh token can be read by any script that runs on pdf-iq.com. Whoever holds it can act as your pdf-iq account. It does not expire on its own; it stops working if the account is switched off or deleted. That is why this site allows scripts from its own address and nowhere else — the script-src 'self' rule in its content security policy — and loads no third-party script on any page: the only code that can read it is this site's own. If that ever changed, this storage would have to change with it. None of this uses a cookie. Paddle's checkout, which does run a third-party script, is kept at a separate address for exactly this reason: nothing running there can read what this site stores.

Signing out, on the account page, deletes the sign-in from this browser. It does not sign you out of the Android app or of Google. To end every sign-in on every device, write to support@pdf-iq.com and we will switch the account off; to remove it entirely, see Deleting your account.

If you buy Pro: the checkout

Nothing is loaded or set before you press Pay. The purchase page is an ordinary page of this site until then: it makes no request to anyone else, sets no cookie, and the counter at its foot reads zero third-party requests, as on every other page.

Pressing Pay opens Paddle's checkout, at a separate address. Paddle is the merchant of record for Pro: they take the payment and handle any tax, and your card details go to Paddle, never to us. The checkout runs at checkout.pdf-iq.com, which the purchase page places over itself. It is a different address from this site on purpose. Your browser keeps each address's storage apart, so nothing running there, Paddle's script included, can read the sign-in this site stores. The purchase page hands it two things only, your account identifier and email address, so that the purchase is recorded against your account. The checkout address stores nothing itself. Paddle's script loads there from cdn.paddle.com, and Paddle's checkout opens in a frame from buy.paddle.com.

What Paddle's checkout loads is Paddle's decision, not ours. Our security policies decide what the purchase page and the checkout address may load. Once Paddle's checkout frame is open, what it loads is governed by Paddle. We measured it and set out what we found, but we do not control it, and it can change without any change here. The counter at the foot of the purchase page counts the checkout address and the report described below; it cannot see anything inside Paddle's frame.

Measured on Paddle's test checkout on 13 September 2026, both opening the checkout and completing a test payment. That is what this section describes. The live checkout is measured on the first real purchase, and this section is corrected to match what that measurement shows.

Paying sets no cookie beyond the two above.

13months

The longest-lived thing a purchase leaves in your browser, and it is not ours: Stripe's m cookie, set by the checkout frame, which Stripe describes as the address its script sends fraud-prevention signals to. Everything else the checkout sets is the 30-minute __cf_bm, or nothing at all. We measured what is set; what any of it is later used for is Stripe's and Paddle's to answer, and their notices are linked below.

A report about Paddle's frame. Paddle's checkout frame carries a policy that expects only the checkout address above it. The purchase page is above that as well, so when the checkout opens your browser sends a short report to Sentry, the address Paddle's policy names. We read what it contains: it names Paddle's own checkout frame, not the page you were on. Your browser sends it on Paddle's behalf, which is why the counter shows it as a third-party request but cannot count its bytes.

These cookies are set only because you asked to pay, and they are needed for that payment to go through. That is why there is no cookie banner: declining them would mean not paying, and not pressing Pay sets none.

Paddle's privacy notice is addressed to people who buy from Paddle and sets out how Paddle handles their personal data. It does not list the services its checkout loads.

If you buy Pro: the purchase record

When Paddle tells this site a payment went through, we record the purchase, so that Pro follows your account to any browser you sign in on. The record holds Paddle's reference for the transaction, your account identifier, the email address you were signed in with, whether the purchase stands or was refunded, and when that last changed. It holds no card details, no amount, no billing address and no IP address.

It is kept in a Cloudflare database. We asked Cloudflare to place it in Asia-Pacific, which Cloudflare describes as a location hint for where the database runs (Cloudflare's description).

The record outlives your account, on purpose. Deleting your account does not take Pro away, and this record is how that promise is kept: sign in again with the same Google account and Pro is found again. That means deleting the record is the one thing that does take Pro away. You can ask us to delete it, and we will. Before we do, we will tell you that Pro will end on every device you use it on, and that deleting the record is not a refund. Refunds are covered on the refunds page.

Part two — the PDFiq Android app

What happens entirely on your device

These run locally. The files involved never leave your phone and we cannot see them:

• Creating a PDF from photos or camera images
• Compressing a PDF
• Rotating, deleting, reordering and extracting pages
• Merging and splitting PDFs
• Reading the text off a scanned document (OCR)
• Viewing, saving and sharing the results

These work with no internet connection and without an account, and they are unlimited and not metered.

Reading a scan uses a text recogniser that Google Play Services fetches to your device once. Your document is never sent anywhere, and after that first fetch it works with no connection, like everything else in this list. The recogniser does report its own usage to Google — see Diagnostics and analytics below.

The app does not request storage permission — it uses Android's own photo and document pickers, so you choose exactly which files it can see. It also does not request camera permission: taking a photograph hands the job to your existing camera app, which returns the picture, and that needs no permission of its own.

Summarise — the one feature that sends data off your device

When you use Summarise, this is what happens, in order:

1. The text is extracted from your PDF on your phone.
2. That extracted text — not the file, not the images, not the original formatting — is sent over an encrypted connection to our server.
3. Our server forwards the text to our AI provider, which generates the summary.
4. The summary is returned to your phone and displayed.

We do not store the text, the summary, or any part of your document. The text exists only for the duration of the request and is discarded once the summary is returned. It is not written to a database and is not retained in our systems.

Our AI provider is Google (Gemini API). At the time of writing, data submitted through the paid Gemini API is not used to train their models. We may change or add providers, and will update this policy if we do.

You are shown a disclosure explaining this before your first summary, and it stays available in the app's Settings. Our own advice, stated in the app: don't send anything you wouldn't email.

Summarise is the only feature that requires an account, because it costs us money to run and we need to count usage fairly.

Account information

If you sign in to use Summarise, we receive your email address and a Google account identifier through Google Sign-In. We do not receive your contacts, your Google Drive, your photos, or your Google profile beyond this. We do not build a marketing list and we do not send marketing email.

Usage counters

To apply the monthly summary allowance we store a small record against your account, in Google Firestore:

• Account identifier — to attach your counters to you
• Number of summaries used this month — to enforce the monthly allowance
• Current period and reset date — to know when the allowance renews
• Recent request timestamps — to apply an hourly rate limit and prevent abuse

That is the entirety of what we hold about you on our servers. There is no document, no text, no summary and no file name in that record.

Diagnostics and analytics

Three things in the app send anything to anyone, and none of them sends your document. This is each one, when it sends, and what is in it.

146–155bytes

The size of a single ML Kit usage report, measured — far too small to carry a page. What was legible in them was the package name, the ML Kit version, the locale and an identifier. We did not decode them field by field, and that is the limit of what we checked. Google’s own statement is that “for the collected data listed on this page, ML Kit does not transfer this data to third-parties”. They are used for measuring, debugging and improving those features, and detecting misuse.

Every number in the analytics is a band rather than an exact value, and that is true of every tool, not only Read a scan. The events themselves are things like “a PDF was created”, “an operation failed”, “the free allowance ran out” and “the Pro screen was opened”. The bands are:

• Pages and operations — one, up to five, up to twenty, up to fifty, and so on.
• Read a scan — finer steps, because whether to ever cap it depends on them: none, up to three, up to five, up to ten, and so on. The highest band you reach in a month is kept against that identifier.
• How long you have had the app — the same day, up to three days, up to a week, and so on. Recorded when you reach a limit.
• Where pages came from — scanned, photographed, from the gallery, or shared in, with the count as a range.

When something fails, what is recorded is the kind of failure, never the file. That list is fixed, and every entry on it describes the shape of a document or the state of the service: corrupt, password-protected, an unsupported type, no text layer, too large, too complex; storage full, a network failure, a rate limit.

None of the three can be switched off. Crashlytics and Analytics both start when the app starts; neither is switched on by using a particular feature, and there is no setting in PDFiq that turns either off — opening the app is by itself enough to record a session, even if you close it again without touching a tool. There is no setting in PDFiq or in ML Kit that turns its reports off either. If you would rather none of them ran, the only way is not to install the app.

This is declared to Google Play on our Data Safety form as collecting app interactions, crash logs, diagnostics and device identifiers. It is stated here in the same terms.

The app contains no advertising SDK. We do not sell, rent or share your personal information with data brokers, advertisers, or any third party for their own marketing purposes.

Purchases and app integrity

PDFiq Pro is sold on pdf-iq.com: a one-time purchase, not a subscription, sold through Paddle, who act as the merchant of record and handle payment and any tax due. We never see or handle your card details or billing address. When a purchase goes through, we record Paddle's reference for it against your account, with the email address you were signed in with; what that record holds, and how long it is kept, is set out under If you buy Pro: the purchase record. Purchases are not made inside the Android app.

We use Firebase App Check with Google Play Integrity to confirm that requests to our servers come from a genuine installation of PDFiq rather than an automated script. This protects our AI costs and does not involve your documents.

What the app never collects

• Your PDFs or images — they are never uploaded
• The text of your documents, beyond the single Summarise request described above
• Your summaries
• File names or document metadata
• Your contacts, calendar, location, microphone or camera roll
• Payment details

Who your data is shared with

Nothing from this website is shared with anyone for their own purposes. What it collects — the form on the firms page, if you use it, a Pro purchase record, if you buy Pro, and the server logs described above — stays with this site and Cloudflare, which hosts it. Signing in for Pro uses Google Firebase, the same as the app; see If you sign in. The app uses a small number of providers, each for a specific purpose:

We may also disclose information where we are legally required to, or where it is necessary to protect our rights or the safety of others.

Where your data is processed

Our servers and database are hosted on Google Cloud infrastructure in India (the asia-south1 region). Our AI provider and analytics services may process data in other countries, including the United States. By using Summarise you consent to your extracted text being processed in these locations.

How long we keep things

Deleting your account and data

If you have signed in — for Summarise in the app, or for Pro on this website, you can delete your account and everything associated with it at any time.

• In the app: Settings → Delete account.
• By email: write to support@pdf-iq.com from the address you signed in with, and we will delete your account within 30 days.

Deleting your account removes your account record and usage counters from our servers. It does not affect any PDF you have already saved — those files are yours and are not ours to delete. A one-time Pro purchase is not affected either: it is not a subscription, so there is nothing to cancel, and deleting your account does not refund or revoke it.

The Pro purchase record is the exception, and it is deliberate. It is not deleted with your account, because it is what keeps Pro yours afterwards. Deleting it is a separate request, and it ends Pro on every device. It is described under the purchase record.

If you have never signed in, in the app or on this website, we hold nothing about you and there is nothing to delete.

Your rights

Depending on where you live, you may have rights to access, correct, export, restrict or delete the personal information we hold about you, and to object to certain processing. Because we hold so little — an email address and a set of counters, and a purchase record if you bought Pro — most such requests are straightforward.

Write to support@pdf-iq.com and we will respond within 30 days. We will not charge you for exercising these rights and will not treat you differently for doing so.

Children

Neither the site nor the app is directed at children, and neither is designed for use by anyone under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Security

All communication between the app and our servers uses encrypted connections (TLS), as does this website. Our AI provider keys are held on our servers and are never included in the app. Requests to our servers require both a valid sign-in and proof that the request came from a genuine installation of PDFiq.

No system is perfectly secure and we cannot guarantee absolute security. What we can tell you is that the most sensitive thing you could give us — your documents — is something we deliberately never hold.

Changes to this policy

When this policy changes, the effective date above changes with it. Continued use after a change means you accept the revised policy.

Contact

Questions, concerns or requests about your data: support@pdf-iq.com

PDFiq and pdf-iq.com are published by BillionEdges. Last updated 13 September 2026.