CompressPdfs Online

Privacy Policy

Last updated: 20 September 2026. This policy describes CompressPdfs Online, the PDF and image tools published on localhost. It covers what happens to the files you upload, what we log, the cookies we set, and the third-party services your browser contacts on our pages.

Files you upload

PDFs and images you submit for compression, conversion, merging, page editing, signing, locking, or unlocking are written to a private directory on the server that sits outside the public web root, under random names. They cannot be reached by guessing a URL. They are read once to produce your result.

A scheduled cleanup job deletes both the source file and the result after approximately one hour. Download links are signed with an HMAC token that expires, so a link you shared by mistake stops working. We do not read your documents, index their contents, sell them, share them with advertisers or data brokers, or use them to train machine-learning models.

If you supply a password to unlock a PDF, it is used only for that single request and is not written to our logs or stored with the file.

Tools that run in your browser

The HEIC converters (HEIC to JPG and its PNG/WebP variants) decode your photo entirely in the browser tab — the image bytes never reach our server. To do that, the page loads the open-source heic2any script from the jsDelivr CDN (cdn.jsdelivr.net). jsDelivr sees the normal request metadata any file download involves, such as your IP address and browser user-agent. It does not receive your photo.

When you pick a PDF (or a HEIC photo) on any tool, the page also draws a local preview in your browser before you run the job. PDF page previews use the open-source pdf.js library from the same jsDelivr CDN. The file stays on your device for that preview; the CDN only serves the script.

Third parties your browser contacts

We want to be precise here rather than claim “no third parties”:

  • Google Fonts — every page loads webfonts from fonts.googleapis.com and fonts.gstatic.com. Google receives your IP address and user-agent as part of serving those font files. See Google’s own privacy documentation for how it handles that request data.
  • jsDelivr — a CDN used for the browser-side HEIC decoder, PDF page previews (pdf.js), and the Markdown editor inside our private admin area.
  • Hosting — the site runs on a commercial hosting provider whose servers process requests and keep standard web-server logs on our behalf.

We do not embed social widgets, comment systems, or chat popups. Optional Google tags are listed under Advertising and analytics below and stay off until you consent.

Advertising and analytics

We run a first-party usage log so we can see which tools people use and from which countries. That log stores a hashed visitor id (rotated daily), a 30-minute session hash, page path, device/browser family, referrer host, and optional country/region from the hosting edge. It does not store your IP address, your file contents, or passwords. You can stop it with the browser Do Not Track setting. Raw event rows are deleted after a retention window set in the admin (default 180 days).

Google Analytics 4, Google Tag Manager, and Google AdSense are off unless we paste those IDs into the admin settings. When they are on, they load only after you click “Accept ads & analytics” on the consent bar. Until then, Google Consent Mode defaults those tags to denied. ads.txt, if published, only lists the publisher IDs we actually use.

If you refuse optional tags, the tools still work. Essential cookies (CSRF session, and the short first-party session hash when analytics is enabled) remain.

What we log

To keep the tools working and to limit abuse, we may record: technical error messages and truncated command output, approximate input and output file sizes, timestamps, and per-visitor rate-limit counters. Rate-limit counters are stored in a file whose name is a hash of the request type and your IP address, and they reset on a rolling window. We do not log the contents of your PDFs or images.

Messages sent through the contact form are emailed to us with the name, email address, message, and originating IP address you submitted; a short line with the timestamp, name, and email is also appended to a server log so we can spot spam. Delete requests for that data are honoured — see below.

Cookies and local storage

We set a PHP session cookie for CSRF protection on upload and contact forms, and for the private admin login. It is HttpOnly, SameSite=Lax, and marked Secure over HTTPS.

When first-party analytics is enabled, we also set cp_sid — a 30-minute HttpOnly session hash used only to group page views. It is not an advertising identifier.

If you accept optional Google tags, we set cp_consent=granted (or denied if you choose essential only) so the banner does not reappear. Google may then set its own cookies as described in Google’s policies.

Your browser’s local storage holds a single key, cp-theme, remembering light or dark mode. It stays on your device and is never sent to us.

Rate limiting and fair use

Tool requests and contact messages are rate-limited per IP address (by default 20 tool jobs and 8 contact messages per hour) so one visitor cannot exhaust the server. Exceeding a limit returns an error message; it does not create a profile of you.

Legal bases and your rights

Processing an upload is necessary to deliver the tool you asked for. Logging and rate limiting rest on our legitimate interest in keeping a free service available and free of abuse. You can stop using the service at any time; files already uploaded still expire on the deletion schedule. To ask what contact data we hold, to correct it, or to have it deleted, email hi@compresspdfs.online.

Children

The tools are not directed at children under 13. Do not upload identity documents belonging to a minor unless you are a parent or guardian filing a lawful application on their behalf.

Changes to this policy

If we add a third-party service, an advertising partner, or analytics, we will update this page and change the date at the top. Material changes will be reflected here before the new service is loaded on the site.

Contact

Use the contact form or email hi@compresspdfs.online. We aim to reply within 2–3 working days.