Privacy Policy

1. Who we are

GN PDF (operating on gnpdf.com, hereafter "we", "us", "the Service") is a free, browser-based PDF editor and toolkit. We are reachable at [email protected] for any privacy question, data-subject request, complaint or correction.

2. The single most important thing

Your PDF files never leave your browser. Every tool on this site — the editor, the merger, the watermarker, the protector, the redactor, the converters — runs entirely in JavaScript inside your own browser tab. There is no upload. There is no server-side step. We physically do not have access to your file because the network request to send it has never been made.

You can verify this yourself: open your browser's developer tools, switch to the Network tab, drop a PDF onto any GN PDF tool, and watch. There is no POST request sending the file. The only network traffic is fetching our own static assets (HTML, CSS, JS libraries) and any third-party ad scripts (see §5).

3. What data we DO collect

3.1 Server access logs

Like every web server, ours records standard access logs: the page you requested, the timestamp, your IP address (truncated to /24 for IPv4 and /48 for IPv6 within 24 hours), the referring URL, your browser's User-Agent string and the response status code. These logs are retained for 30 days for security and abuse prevention, then deleted. They are never sold, shared, or correlated with any other data.

3.2 Anonymous usage analytics

We use a privacy-respecting analytics setup (no cookies, no fingerprinting) to count: page views per tool, language preference, country (at country level only — not city or finer), and bounce rate. This tells us which tools are useful and which need work. It does NOT see anything you do inside the tools — not the file content, not your edits, not your signature, not your watermark text, not your password.

3.3 Cookies / local storage

GN PDF uses your browser's localStorage (not cookies) to remember three things across visits:

• Your selected language (en / hi / mr / es / ar).
• Your selected theme (light / dark / system).
• Your saved signatures and image library — these stay on your device and are never transmitted to our servers.

You can clear all of this any time via your browser's "Clear site data" option. No GN PDF feature requires you to be logged in, because there is no login.

4. What data we DO NOT collect

• The content of your PDFs. Ever. Under any circumstance.
• Your edits, signatures, text changes, watermarks or passwords.
• Your name, email, phone number or any personally identifying information — unless you voluntarily send us an email via the contact form, in which case we use that email solely to reply to you.
• Your browser history, location, contacts, or any data outside this site.

5. Third-party services we use

5.1 Google AdSense (advertising)

We display advertising via Google AdSense to keep the tools free. AdSense uses cookies and a device identifier to show ads relevant to you. AdSense's data practices are governed by Google's Privacy Policy, not ours. You can opt out of personalised advertising at Google Ad Settings. EU / UK / California users will see a consent banner where required.

5.2 Google Fonts (typography)

Some fonts are loaded from fonts.googleapis.com. The font CSS request includes your IP address; Google's policy applies. To eliminate this, you can self-host these fonts — they are open-source and free to use.

5.3 Open-source JavaScript libraries via CDN

We load pdf.js, pdf-lib, fabric.js, SheetJS, Mammoth, docx.js, PptxGenJS, JSZip, html2canvas and jsPDF from public CDNs (cdnjs, unpkg, jsdelivr). The CDN sees only the file request — never your PDF.

6. Children

GN PDF is not directed at children under 13 (US COPPA) or under 16 (EU GDPR). We do not knowingly collect any personal information from children. If you believe a child has provided information, contact us and we will delete it.

7. Your rights under GDPR / CCPA / IT-Act

Because we do not store your file content or correlated personal data, most "right to access / delete / rectify" requests have no GN PDF data to act on. For the data we do hold (server logs, contact-form emails), you have the right to:

• Request access to your data;
• Request correction or deletion;
• Object to processing;
• Data portability;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email [email protected] with subject "Data request". We respond within 30 days.

8. Data retention

• Server access logs: 30 days, then permanently deleted.
• Anonymous analytics: aggregated indefinitely, never tied to an individual.
• Contact-form emails: retained as long as needed to resolve your query, then archived for 12 months, then deleted.
• localStorage on your device: persists until you clear browser data.

9. International data transfers

Our static hosting is delivered via a global CDN. Server logs may be processed in any region the CDN edge handles your request. Because the data we collect is minimal (no file content), this is a low-risk transfer under GDPR Article 49(1).

10. Security

The site is served over HTTPS only (HSTS enforced). We use modern security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Because we do not store your PDFs, there is no possible data-breach scenario that affects your file content.

11. Changes to this policy

We may update this Policy occasionally to reflect new features or regulations. The "Last updated" date at the top will change. For material changes (e.g., adding a new third-party service), we will display a prominent notice on the home page for 14 days.

12. Contact

Privacy questions, data-subject requests, complaints, or just feedback: [email protected] or our contact form.

This document is provided as plain-language guidance and as a binding privacy commitment. It is not legal advice. If you need a jurisdiction-specific compliance certificate (HIPAA BAA, India DPDP Act 2023 Letter of Assurance, etc.) email us and we will provide one.