Privacy Policy
本地阅读不会上传 PDF；生成分享链接才会上传。持有链接的人可以读取并保存文件。你可通过账户或删除凭证删除云端文件，也可联系支持处理个人信息请求。
1. Local reading and cloud sharing
Selecting a PDF for local reading processes the file in your browser and does not itself upload it. Your browser still requests the website and PDF reading resources from our hosting provider.
When you generate a share, we upload the original PDF and process its contents, filename, size, upload time, document identifier, storage reference, expiry where applicable, and a deletion-credential hash. A signed-in upload is also associated with your account.
2. Who can access a share
Anyone with an active link can retrieve its PDF, see its filename, forward the link and keep a copy. Recipients do not have to sign in. A share link is not a recipient-specific access control. Deletion or expiry stops future access through PDF2WEB; it does not remove copies already saved by recipients.
3. Account and authentication information
Email sign-in sends a six-digit verification code through Resend. A code is valid for 10 minutes and is consumed on successful use. Verifying a new email creates a PDF2WEB account. We store your normalized email address, account identifiers, account timestamps and display name when supplied.
Verification records contain an email-associated identifier, a keyed representation of the code, attempt count and expiry. The code itself is included in the verification email. We limit failed attempts and replace old codes when a new one is requested. Code expiry is not a promise that every related database record is physically erased at that exact time.
Google sign-in requests only basic identity scopes: openid, email and profile. We may store your Google account identifier, name, email address, verification status and profile-image URL. It does not request Gmail or Drive access. Our current account-storage controls do not persist Google access, refresh or ID tokens. PDF2WEB maintains its own session, including session identifiers and expiry, and may record IP address and browser information.
4. Cookies, browser storage and request information
Essential authentication cookies maintain your session. Your browser may store sharing history and deletion credentials so you can manage earlier shares. Keep deletion credentials private; clearing browser data can remove them.
Request IP addresses are used for rate limits and upload verification. Sending limits use keyed identifiers for recipients, IPs and daily budgets. Hosting and email providers also process technical information under their own policies. Clearing browser history is separate from deleting an account, cloud file or subscription.
5. Subscriptions and payment records
When a payment method is available and you choose it, account email and order references are shared with that payment provider. Card details are entered on the provider's hosted checkout, not in PDF2WEB's interface.
We retain provider, customer, checkout, subscription, payment and event references, plan, interval, status, confirmed paid-through date, cancellation or payment-reversal indicators and timestamps. These records support subscription access, duplicate-payment prevention, order reconciliation and support. Providers keep their own transaction records.
6. Service providers
- Cloudflare hosts the site and request processing, stores uploaded PDFs in R2, and stores application records in D1.
- Google provides optional sign-in and the Gmail service used by our support mailbox.
- Resend receives the recipient address, verification-code email and sender/reply-to details for delivery. PDF files are not included in these messages.
- Creem or PayPal handles payments if that method is available and selected. The provider's own terms and privacy notice apply.
These providers may process information in countries other than yours. This policy does not promise that all data stays in one particular country or establish a retention period for third parties.
7. Retention and deletion
New Free shares expire after 12 hours. Expiry prevents further file access; physical removal by cleanup processes can happen later. Earlier uploads can follow their original expiry settings.
Pro files have no 12-hour expiry. After an ordinary paid-period lapse, existing Pro links have a 30-day access grace period from the last confirmed paid-through date and are then paused. A confirmed payment reversal or full refund can pause access earlier. Pausing access does not delete the stored object. The current service has no fixed automatic deletion deadline for expired Pro files; an authenticated owner can still delete their files. Keep your originals.
A successful file deletion removes the cloud object and its document record. Account, authentication, payment and support records have different purposes and do not all follow the file expiry schedule. We retain records needed to provide the service, address disputes, prevent abuse and satisfy applicable obligations. Contact support to request access, correction or deletion; we will explain any information that must be retained. There is no single fixed deletion schedule covering every record type.
8. Your choices and contact
You can read locally without an account, choose whether to upload, delete files you are authorized to manage, and cancel renewal using the provider's controls. Email zendex717@gmail.com for access, correction, deletion, privacy or abuse reports. We may request enough information to verify ownership. Do not email passwords, card security codes or unnecessary identity documents.
We will update this page when the described practices change. Applicable privacy rights are not limited by this policy.