Privacy Policy

Last updated: 3 September 2026

PDF Tools is operated by Hugo Software and lives at pdf.bnj.app. This page explains exactly what happens to your data. It is short because very little happens.

Your PDF file never leaves your browser

This is the central fact of this service, and it is a technical fact rather than a promise about our conduct.

Compressing a PDF, converting it to Word, and adding or removing a password all run inside your own browser, using WebAssembly and JavaScript that your browser downloads and executes locally. Your file is read into your browser's memory, worked on there, and handed back to you as a download.

There is no upload endpoint on our servers. Even if we wanted your document, our backend has no route that would accept it. You can verify this yourself: open your browser's developer tools, switch to the Network tab, and process a file. You will see no request carrying your document.

Your file is discarded from memory when you remove it, load another one, or close the tab.

Passwords you type

If you use the "remove password" tool, the password you type is passed directly to the qpdf WebAssembly module running in your browser. It is never transmitted, never logged, and never stored.

What our server does store

Our backend exists for one purpose: checking whether a subscription is active. It stores only a mapping between a licence code (for example BNJ-XXXXXXXX) and a payment-processor customer id.

We do not collect or store: your name, your email address, a password, an account, your IP address in any durable record, or anything at all about your documents. There are no user accounts on this service.

Payments

If you subscribe, payment is handled by Stripe. Stripe receives your payment details directly; we never see or store card numbers. Stripe's processing is governed by its own privacy policy.

After payment you receive a licence code. That code is stored in your own browser's local storage so the site remembers you. You can type it on another device to restore access. Losing the code means losing access — it is the only identifier, by design, because it lets us avoid collecting your email address.

Analytics

We use Umami, which we host ourselves on our own server. It is cookieless, records aggregate page views, sets no cross-site identifiers, and does not fingerprint you.

We do not use Google Analytics, advertising SDKs, crash-reporting SDKs, or social media SDKs. Fonts are served from our own server, not a third-party CDN.

Children

This is a general-purpose document utility. It is not directed at children and we do not knowingly collect data from them.

Your rights

Because we hold no personal data about you beyond a licence-to-customer mapping, there is normally nothing to export or erase. If you have subscribed and want that record deleted, write to us and we will remove it; note that cancelling your subscription is handled through the payment processor's portal.

Changes

If this policy changes materially, the date at the top of this page will change with it.

Contact

Questions about privacy: [email protected]