Privacy Policy
This page answers one question in detail: for each thing you do here, what leaves your browser, who receives it, and how long it survives.
Last updated 2026-09-01
Who is responsible for this data
pdfmd.org is operated by summer, an individual developer and the controller of the data described below. Every privacy request goes to the same address: support@pdfmd.org.
The service has no sales team, no advertising network, and no data broker relationships. Nothing described here is sold, rented, or shared for marketing.
The honest version of the local-first claim
The browser does real work: it reads the PDF, decides whether the file has a usable text layer, renders page previews, and keeps the coordinates that let each Markdown block link back to its source. That is why the tool can show you provenance at all.
It is not a claim that document content never leaves your device. Converting a text PDF uploads it. Recognising a scan or a photo uploads images. A Word .docx is the one path that genuinely stays local from start to finish. This page states which is which rather than blurring the two.
Which path a file takes is also what it costs: the cloud paths are metered in page points and the browser-local one is not, which the pricing page works through with the actual rates.
Everything the service handles
Read this table as the complete inventory. If a category of data is not listed here, it is not collected.
| What | Why it is handled | Where it goes | How long it is kept |
|---|---|---|---|
| Text-PDF file content | To produce Markdown | Cloudflare document conversion | In memory for the request; not stored afterwards |
| Rendered scan pages and confirmed photos | To run OCR | Moondream 3.1 and Llama 4 Scout on Cloudflare Workers AI | In memory for the request; not stored afterwards |
| Word .docx content | To produce Markdown and its audit | Nowhere — conversion runs in your browser | Never uploaded |
| Google name, email address, and avatar URL | To show who is signed in and to answer support mail | An encrypted session cookie on your own device | 30 days, or until you sign out |
| Google account identifier | To attach a point balance to an account | Cloudflare D1 database | Until the account is closed |
| Point ledger: conversion type, page count, point cost, timestamps | To charge correctly and to settle disputes | Cloudflare D1 database | Kept as an append-only audit trail |
| Order and subscription records: product, amount, currency, provider references, status | Accounting, renewals, and refunds | Cloudflare D1 database and Waffo | Retained for accounting purposes |
| Card and payment details | To take payment | Waffo's hosted checkout only | Never received by this service |
| IP address and user agent of a request | Rate limiting and abuse prevention | Cloudflare's edge network | Per Cloudflare's own log retention |
| Page URL and basic analytics events | To see which pages are actually used | Google Analytics 4 | Per the Google Analytics retention setting |
File names are not stored, conversion results are not saved to an account, and there is no conversion history library. If you want to keep a result, download it before you leave the page.
Who else touches the data
Four sub-processors are involved. Each is listed with the single job it does, so you can check the claim rather than take it on trust.
| Sub-processor | What it does here |
|---|---|
| Cloudflare | Hosting and edge delivery, the D1 billing database, document conversion, and the Workers AI models that run OCR |
| Sign-in through Google OAuth; the account email identifies you to support | |
| Waffo | Hosted checkout, payment processing, subscription billing, and refunds |
| Google Analytics | Page-level traffic measurement; it receives URLs, never document content |
Cookies, and only these cookies
There is no consent wall here because there is very little to consent to. Three things set storage:
What you can ask for
Email support@pdfmd.org from the address on your Google account and the request can be verified immediately. A reply is normally sent within 3 business days.
- A copy of your data
- The account record, point balance, ledger entries, and order history, exported as a file.
- Correction
- Anything wrong in the account record can be corrected. Name and email come from Google, so those are changed there.
- Deletion
- The account, the identifier, and the point balance are removed.
- Withdrawal of consent
- Sign out to end the session, and stop analytics with any content blocker or your browser's tracking protection.
Age
The service is not directed at children and is not intended for anyone under 16. No age is collected, so if you believe a child has created an account, write to support@pdfmd.org and it will be removed.
Where processing happens
Cloudflare serves and processes requests from its global edge network, so a conversion can be handled in a different country from the one you are in. Sign-in, payment, and analytics providers operate internationally on the same basis. If your work cannot leave a specific jurisdiction, convert Word files locally and do not send PDFs or photos to the cloud path.
Changes to this policy
The date at the top of this page is the version marker. A change that widens what is collected or adds a sub-processor is announced before it takes effect, not applied quietly.
Privacy questions
Send anything about this policy to support@pdfmd.org with "Privacy" in the subject line. The contact page lists what to include so the first reply can be the useful one.
The other policies
Data handling is one piece. The commercial terms, the refund rules, and the support routes are separate documents.