Privacy Policy

When you upload a PDF for AI conversion, the file is sent to my server for structural analysis. The file is processed in memory and deleted immediately after conversion completes. No document content is written to disk, logged, cached, or stored in any database.

Documents you create or edit in the browser-based editor are processed client-side. They do not leave your device unless you explicitly upload them for AI conversion.

Exported PDFs with embedded source contain your document data encrypted with AES-256-GCM inside the PDF file itself. This data exists only in the file you download — I do not have a copy.

If you create an account, I store your email address and subscription status. This data is used solely for authentication and billing. I do not sell, share, or provide your email to any third party for any reason.

Payment processing is handled by Stripe. I do not store credit card numbers, CVVs, or full card details on my servers. Stripe’s privacy policy applies to payment data: stripe.com/privacy.

I use Plausible Analytics for website traffic measurement. Plausible is privacy-focused, cookie-free, and GDPR-compliant by design. It collects no personal data, sets no cookies, and does not fingerprint visitors. All data is aggregated — I see page view counts, not individual users.

I do not use Google Analytics, Facebook Pixel, or any other tracking service that profiles visitors.

ReflowPDF uses only essential cookies required for authentication (session cookies). No tracking cookies, no advertising cookies, no third-party cookies. Plausible Analytics is cookieless.

Your documents are not used to train AI models. The AI conversion processes your document and discards it. No document content enters any training pipeline, dataset, or feedback loop.

Uploaded documents: deleted immediately after AI conversion. Account data: retained while your account is active. If you delete your account, all associated data is permanently removed within 30 days. Server logs (IP addresses, request timestamps): retained for 14 days for security monitoring, then deleted.

You can request a copy of all data I hold about you, request deletion of your account and all associated data, or ask questions about how your data is handled. I respond to all requests within 7 days.

If you are in the EU/EEA, you have rights under the General Data Protection Regulation including access, rectification, erasure, portability, and objection. The legal basis for processing account data is contract performance (providing the service). The legal basis for analytics is legitimate interest (understanding aggregate traffic patterns using a privacy-respecting tool).

For privacy questions, data requests, or concerns: privacy@reflowpdf.com