Private by design.
Our browser PDF and image tools process your files on your device. We do not upload their contents. Selected files and processed results stay in this tab’s memory until you clear them or close the tab, unless you explicitly enable Recent files to keep local output copies. Downloads are saved where your browser normally saves files.
Optional recent files on this device
Recent files are off by default. If enabled, IndexedDB keeps up to 10 processed output copies, 20 MB each and 100 MB total, in this browser profile. Copies expire after seven days and are removed when the list is next opened. This is not a backup; browsers can clear storage sooner.
Clear recent files, remove an individual copy or turn the feature off to delete local copies. People sharing the browser profile can open them. No passwords, job tokens or signed links are stored with these files, and the list is never uploaded or synced. Server results are saved locally only after an explicit download-and-save action.
Removing offline app assets does not clear Recent files. Deleting an account or a server job does not delete independently saved browser copies. Use Recent files or browser site-data settings to clear them.
What this site stores
Theme and motion preferences are stored in your browser. The installable app caches app pages, icons and processing code for offline use. The service worker app cache never contains your selected files or results. Recent files uses separate opt-in local storage. Remove offline app data from the install page or your browser settings.
PDF editors and signatures stay local
Edit PDF, Sign PDF, Redact PDF, Compare PDF, Crop PDF and PDF forms run entirely in browser workers, free and unlimited. Files, page edits, form values, passwords and export results stay in this tab’s memory. No document is uploaded, and no Turnstile or daily quota applies. Your original files remain unchanged. App caches never contain document content.
A signature is stored only when you explicitly choose Save in browser. It stays in local browser storage until you choose Forget saved signature or clear site data; it is never synced or uploaded. These are simple electronic signatures, not certified digital signatures.
True redaction discards original page objects and rebuilds masked pixels, then verifies removed native text is absent. Cropping and whiteout are not redaction and can retain hidden content. Review every exported redaction, especially scanned images, before sharing.
OCR stays on your device
OCR PDF, Image to text and Image to searchable PDF never upload your files or recognized text. Tesseract runs in browser workers, free and unlimited, without Turnstile or a daily limit. Selected language packs show their download size first and come only from this website. The service worker can cache the engine and language packs for offline use. Clear OCR language cache in the OCR workspace to remove them. Original files, corrections and OCR results remain in this tab’s memory and are never added to that cache.
Local image AI
Remove background, Face blur and Upscale run in browser workers, free and unlimited, without uploads, Turnstile or daily limits. The model and runtime download sizes and licenses are shown before download. Public model assets can be cached for offline use. Clear downloaded models in the workspace or remove offline data on the install page. Images and results never enter these caches.
Claude AI needs separate consent
Translation, summaries, document chat, data extraction, smart split and AI handwriting/table OCR use Anthropic’s Claude API only through our backend. Before any upload you must explicitly agree. The browser prepares only the selected page text or scan images; your question, requested fields and recent chat history are also sent. Original PDFs remain local where possible. AI output can be inaccurate.
Our private uploads are deleted after processing; results expire within 1 hour or with Delete now. Anthropic processes the transmitted data under its own API terms and retention policy; our deletion cannot delete data already handled by the provider. Read Anthropic’s API data policy. We do not promise a separately negotiated zero-retention arrangement.
Anonymous AI use shares the heavy-tool allowance: 3 tries per UTC day per IP/device, one 20 MB file and 30 selected pages. Each chat question is a separate try. Token counts, model, job id, price version, credits and cost are recorded for spending control, without document content, filenames, questions or API credentials. These accounting records survive file and job deletion. Detailed trial usage is kept for 35 days by default (configurable up to 90); aggregate daily/monthly spending totals are retained for 400 days. When accounts are enabled, verified users can use purchased credits after their shared free trial; signing in does not reset the anonymous allowance. Actual paid usage and holds are recorded in a durable credit ledger. Larger models remain disabled in the reviewed configuration. Cancellation stops our job, but cannot recall a request already delivered to Anthropic; uncertain usage remains reserved against our spending caps.
Optional accounts and payments
Browser tools never require an account or payment. When account features are enabled, we store your email, Argon2id password hash, verification status, plan, payment references, credit ledger and login/session records in PostgreSQL. Passwords are never stored as plain text. Login sessions use Secure HttpOnly cookies in production, with a maximum seven-day lifetime and a 24-hour idle limit. These strictly necessary cookies are not advertising identifiers.
Your profile stores your full name and optional mobile number, country and company, encrypted at rest. You can update these details, include them in your account export, or remove them by deleting your account.
Before a purchase, your entered age is checked on your device and is not sent to PixnPDF or Stripe. We retain only your adult eligibility, legal-capacity and purchase declarations, policy version, purchase reference and time. We do not collect a birth date, identity document or biometric through this check. A session-only device flag may prevent immediate retries after an ineligible entry.
Withdrawal declarations and receipt references are included in your account history and export. We queue an encrypted email acknowledgment; delivery and any refund or settlement are separate processes. Necessary declaration and purchase records follow our financial-record retention rules.
Optional two-step login stores an encrypted authenticator seed and hashed one-use recovery codes. Optional Google sign-in verifies your identity with Google; existing accounts must explicitly link it. Resend delivers verification, magic links, resets and payment notices. Pending email bodies and links are encrypted, removed after delivery and expire within 24 hours. Disable tracking in the sending provider before activation.
Payment takes place on Stripe-hosted Checkout or Customer Portal. PixnPDF never receives card numbers. We retain payment/invoice references and amounts, not card details. Stripe, Resend and Google process service data under their own policies; deleting local data cannot recall provider records or legally retained invoices.
You can download account data and request email-confirmed deletion from your account. Deletion removes your email, password hash, Google identity, authenticator data and sessions. Active subscriptions must be cancelled and pending AI usage reconciled first. Pseudonymous payment and credit records remain for accounting; the retention policy and backups require owner/legal review before activation. Account pages never store your documents.
No advertising trackers
Your browser contacts this site to load app code and assets. Optional Google Analytics loads only after you allow it in Cookies settings. It measures public-page visits and basic browser data, without document contents, filenames, form values, URL queries, fragments or account information. Advertising features are off. Google receives your IP address to deliver requests. You can withdraw consent in Cookies settings. Hosting infrastructure may keep normal request logs; credentials, document bodies, email links and card data must never be included in application logs.
Server tools
Compress, Repair, Protect, Unlock and Sanitize PDF run locally by default, without an upload, Turnstile challenge or daily quota. Their optional “Use server for hard files” mode uses a free server try and asks for consent before upload. Office and other server conversions also require consent. Uploaded files are deleted within 1 hour. Inputs are deleted as soon as processing ends; outputs are deleted after 60 minutes or immediately with Delete now. Files transfer directly to private storage using short-lived signed links. Job access tokens and passwords stay in memory, never browser storage. Closing your tab loses access; automatic deletion still applies.
We remember your upload consent and a random trial device identifier in localStorage alongside theme and motion preferences. Logs contain job ids, tool ids, sizes, durations and error codes, without filenames, passwords or file content. The service worker never caches server API responses, signed links or user files.
Server trial and abuse prevention
Browser-only tools have unlimited free use and no daily usage quota. Anonymous server allowances are separate by processing group: optional light PDF tools allow 10 jobs per UTC day, one file up to 50 MB and 100 pages; conversions allow 5 jobs, two files up to 25 MB each and 50 pages total; AI and other heavy tools allow 3 jobs, one 20 MB file and 30 pages. Jobs within each group share its allowance. The current API-configured limits are shown before upload and are checked against both your IP address and a random device identifier. We store keyed hashes for quota enforcement in Redis until shortly after the daily reset, rather than keeping a long-term device history.
Cloudflare Turnstile checks server job submissions to limit abuse. Its widget contacts Cloudflare and its verification service receives the challenge token and connection information; your document contents are not sent to Turnstile. No challenge or trial quota is applied to browser-only processing. Optional Free-account and Premium limits come from verified server-side entitlements. Availability depends on deployment flags.
Unfinished tools
Tools marked Coming soon are unavailable. This notice describes the current release; final legal policies will be reviewed before launch in Phase 9.
Last updated: 2 November 2026
The sections below are provided in English. If a translation is shown, the English text governs.
Who is responsible for your data
Wynra Consultants FZC LLC, United Arab Emirates (a Wynxo product), is the controller of personal data described in this policy. Contact us at support@pixnpdf.com for any privacy question or request.
What we collect, and why
Files you open in browser tools: processed on your device and not uploaded to us. We do not see or keep them.
Files you choose to send to our servers (optional server mode, Office conversions, AI features): the file or extracted content, your settings and a job identifier, used only to run the job you requested.
Account data (only if accounts are enabled): email address, password hash, verification status, plan, payment and credit records, sign-in and session records, and security settings you turn on.
Your profile stores your full name and optional mobile number, country and company, encrypted at rest. You can update these details, include them in your account export, or remove them by deleting your account.
Payment data: handled by our payment provider; we keep references, amounts, dates and status, not card numbers.
Usage and security data: IP address, a random device identifier, keyed hashes for allowance enforcement, job ids, tool ids, sizes, durations, error codes, and basic server request logs, used to run the Service, prevent abuse and fix problems.
Messages you send us: your email address and the contents of what you write, used to answer you and keep a record of the request.
On-device storage: theme and motion preferences, consent choices, optional recent files and signatures you choose to save, and offline app files, all kept in your browser.
Our purposes and legal bases
We use personal data to provide and secure the Service and carry out your requests (performance of our agreement with you); to prevent abuse and fraud, keep records and improve reliability (our legitimate interests); to meet legal, tax and accounting obligations (legal obligation); and where you have given consent, for example before any upload or AI processing, which you can withdraw at any time without affecting earlier processing.
We do not sell personal data, we do not share it for cross-context advertising, and we do not use your files to train AI models.
Who we share data with
We share data only with service providers that help us run the Service, under their own terms and our instructions, and only what they need. These may include payment processing (Stripe), email delivery (Resend), optional sign-in (Google), bot protection (Cloudflare Turnstile), AI processing (Anthropic, only for AI features you consent to), and hosting and storage providers.
We may also disclose data where the law requires it, to respond to valid legal requests, to protect the rights, safety or security of users, the public or us, or in connection with a merger, sale or reorganisation of our business, with notice where required.
International transfers
We and our providers may process data in countries other than where you live, including countries whose data-protection laws differ from yours. Where the law requires, we use appropriate safeguards for such transfers, such as contractual protections or recognised transfer mechanisms.
How long we keep data
Files sent to our servers are deleted after processing; inputs are deleted when the job ends and results within the time stated in the tool (at most 1 hour) or earlier with Delete now. Trial usage detail is kept for 35 days by default and aggregate spending totals for 400 days. Account data is kept while your account exists. After deletion we keep pseudonymous payment, credit and accounting records and other data we must keep by law, for as long as the law or a legitimate need requires. Backups are overwritten on a rolling schedule. On-device data stays until you clear it.
Your rights and choices
Depending on where you live (for example under the UAE Federal Personal Data Protection Law, the EU or UK GDPR, or US state privacy laws), you may have the right to ask to access, correct, delete, restrict or object to our use of your personal data, to receive a copy of your data in a portable format, to withdraw consent, and not to be subject to certain automated decisions. You will not be treated unfairly for using these rights.
You can download your account data and request deletion from your account page, or email support@pixnpdf.com. We may need to verify your identity first and we will respond within the time the law requires. You can also complain to your local data-protection authority; we would appreciate the chance to resolve your concern first. We cannot delete data that providers already hold under their own policies or records we must keep by law.
Cookies and similar technologies
Essential storage includes sign-in session cookies when accounts are enabled and browser storage for your preferences, consent choices, a random trial device identifier, offline app files and optional recent files. Optional Google Analytics loads only after consent in Cookies settings. It uses analytics cookies for up to 30 days and receives public-page addresses, basic browser data and your IP address for request delivery. Document contents, filenames, form values, URL queries, fragments and account information are excluded; advertising features are off. Google may process this data internationally under its privacy policy. Withdraw consent in Cookies settings to stop collection and remove analytics cookies. Clearing all site data in your browser also removes essential storage; some features will then reset or stop working.
Security
We use technical and organisational measures to protect personal data, including encryption in transit, short-lived signed links, hashed passwords, limited retention and access controls. No system is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep your devices up to date. Tell us at support@pixnpdf.com if you believe your account or data has been affected.
Children
The Service is not directed at children under 13 (or the higher age set by local law), and we do not knowingly collect their personal data. Accounts and purchases are for adults. If you believe a child has given us personal data, contact us and we will delete it.
Changes and contact
We may update this policy, and the date at the top shows when it was last changed. For significant changes we will give notice where reasonable. Questions or requests: support@pixnpdf.com.
Operated by Wynra Consultants FZC LLC, UAE. PixnPDF is a Wynxo product.