This policy explains how MyPDF (mypdf.io) collects and uses information when you use the website and API. Last updated August 31, 2026. Contact hello@mypdf.io.
Who we are
MyPDF is the operator of https://mypdf.io and https://www.mypdf.io. If we appoint a legal entity later, that entity will be the controller of personal data described here.
How long we keep your files
Many tools run entirely in your browser (merge, rotate, organize, extract, grayscale, OCR, and self-sign). Those files are not uploaded to finish the job. Convert, compress, protect, unlock, and request-signature jobs upload a file to our servers. Uploaded files and processed results are stored only long enough to finish the job and let you download it. We delete them automatically after 60 minutes. Signature request files stay available until the signing link expires (7 days by default) and are then deleted. We do not use your documents for advertising or model training.
Account and usage data
If you create an account we store your email address, optional name, a password hash (or a Google or Microsoft account link if you use social sign-in), plan and Stripe customer identifiers, daily job counts, credit balance, API key hashes and prefixes (never the full key after creation), webhook endpoint URLs, team membership, and metadata for signature requests such as file name and signer email. We also store an anonymous cookie so guests share the same daily job limit across visits.
Payments
Paid plans, credit packs, and day passes are processed by Stripe. We do not store full card numbers. Stripe's privacy policy applies to the payment data they collect.
If email is configured we send transactional mail only: password resets, team invites, signature invites, and a notice when someone signs a document you sent. We do not sell email lists.
Cookies and similar technology
We use a session cookie for signed-in users and a small anonymous identifier for guest quotas. If you enable Google Analytics or AdSense, those services may set their own cookies. Analytics then records page views and funnel events (first job, later jobs, paywall, signup, checkout, and API key creation). Those events do not include email addresses, file names, or document contents. Ads are shown only to free users on marketing pages, not on upload screens.
Processors we may use
- Hosting and database providers that run MyPDF
- Stripe for subscriptions, credit packs, and day passes
- Google, if you use Google Sign-In, Analytics, or AdSense
- Microsoft, if you use Microsoft Sign-In
- Amazon SES (or another email provider), if we send email
Your rights
You can update your account, cancel a subscription in the Stripe customer portal, revoke API keys, and delete webhook endpoints from your account page. To request a copy or deletion of account data, email hello@mypdf.io from the address on the account. We will delete or anonymize what we no longer need to keep for billing, security, or law.
International users
The service may be hosted outside your country. By using MyPDF you understand that account and file data can be processed where our servers and processors operate.
Children
The service is not directed at children under 16. Do not create an account if you are under that age.
Changes
We will update this page when our practices change. The date at the top is the latest revision. Related pages: Terms of Use, Security & Compliance, Contact.