Privacy

Zero retention

Your document and its result are never written to disk or to a database. They exist for the length of the request that converts them and are gone when it answers — there is nothing to delete afterwards, and nothing to hand over.

That is a property of how the service is built rather than a policy someone applies: there is no column anywhere that could hold a document, and the test suite refuses to let one be added.

One cookie, and only if you pay

This site sets exactly one cookie, named dds_unlock. It appears only after a successful payment, and it holds a random value that identifies nobody — it is a receipt your browser presents so the conversion you bought can be unlocked.

It is first-party, HttpOnly (no script can read it), Secure (it never travels in clear), SameSite=Lax, and it expires after 7 days along with the unlock it stands for.

There is no cookie banner because there is nothing to consent to. A strictly-necessary cookie is exempt, and this site sets no other kind: no analytics cookie, no advertising cookie, no preference cookie, not even one remembering your language — the language is in the address, which is why you can share the link.

What the database holds

One database, four small tables, and no document has ever been in any of them:

• A keyed hash of your IP address and how many free conversions it has run today. Kept no more than 48 hours.
• If you paid: a keyed hash of your unlock token, how many pages are left on it, and when it expires. Kept 7 days.
• If you bought a large job processed in the background: a hash of its claim link, a hash of the unlock that paid for it, the provider's job reference and a page count. Kept 24 hours.
• Counters used to check that the service costs less than it earns — a name, a date and a number. This table has no identifier column of any kind. Kept about 13 months.

No email address, no name, no account, no password, no payment card, no document and no text taken from one.

Your IP address

Your IP address is never stored as itself. The free-tier counter uses a keyed hash of it, which cannot be turned back into an address, and that hash is deleted with the counter.

The rate limiter that protects the service against automated abuse does hold addresses in memory for a few seconds at a time. Nothing about it is written to disk, and it forgets everything when the process restarts. Standard technical logs kept by the web server contain no document content and are not used to build a profile of anyone.

Who else sees your document

Converting a document means sending it to a service that can read it. That is the product, and it cannot be done otherwise: a born-digital PDF goes to a document-reading API, and a scan or an image goes to an OCR provider. Both are sent the file, both return text, and neither is told anything about you — no name, no address, no identifier of any kind.

One case works differently, and it is the one to know about. A large scanned job that you have paid for is processed in the background: your document is uploaded to the OCR provider's own file store, and the result is written there too. We do not delete either of them. They stay there under that provider's retention terms rather than ours — this is the single case where a copy of your document exists outside the request that created it, and it is the price of processing a job too large to hold open.

Deleting the result would be worse for you, not better: a delivery lost in transit would then cost you everything you paid for, so the job stays claimable until its link expires.

Every other third party

Named in full, with when each one is contacted at all:

• The OCR provider — only when a scan or an image is converted. Sent the document; told nothing about you.
• The document-reading API — only when a born-digital PDF or a PDF link is converted. Same terms.
• The payment processor — only when you choose to pay, on their own page. They handle the card; this service never sees or stores payment details, and records only that a payment happened and its amount.
• The donation platform — only if you click the support link. None of their code runs on these pages: it is a plain link, and until you follow it they know nothing. Once you do, you are on their site under their policy, which is outside this one.
• An advertising network — only on a deployment configured with a publisher account, which this one is not: no advertising code is loaded at all, so there is currently nothing to describe. Where it is enabled it is a cookieless network, and that is verified before it is switched on.

Nothing else. The typefaces are served from this site's own server rather than from a font CDN, so loading a page reveals your address to nobody but us.

If you write to me

The offer page offers an email address rather than a form, and that is a privacy decision as much as a practical one: a form would have to send your message somewhere, and this service has no mail infrastructure and keeps no record of anyone. Clicking the link opens your own mail client — nothing is submitted here, and this site learns nothing at all unless and until you send a message.

A message you do send arrives in an ordinary mailbox, hosted by an ordinary mail provider, and is read by one person. It never enters the database described above, which is why the list of what that database holds says no email address and no name and still says it truthfully. Ask me to delete a conversation and I will delete it.

Your rights

There is nothing here that identifies you, which means there is nothing to retrieve, correct or delete on request — not as a refusal, but as a description of what was built. A keyed hash of an address, an opaque token you hold and can throw away by clearing one cookie, and counters with no identifier in them: none of it can be matched to a person, by us or by anyone holding a copy of the database.

If you want the unlock cookie gone before it expires, delete it in your browser and nothing of yours remains anywhere.