Privacy policy

Information we handle

Documents and results

When you upload a PDF, we handle the file, its displayed filename, page count, document structure, audit findings, improvement instructions, generated files, and Accessibility Improvement Reports. These records are needed to run the service and let you review the result.

Account and order information

If you sign in with Google, we store your Google account identifier, email address, and a PDF Hound user identifier. If you optionally ask us to email an audit or fix update, we associate that address with the order for service messages, not marketing. Guest purchases use a random claim code stored in your browser. We also keep order status, credit balance, credit movements, and Stripe transaction references. PDF Hound does not receive or store your full payment card number.

Credit-return feedback

When you ask for your credits back, we collect a required reason category and any optional details you provide. Both are stored with the order so we can complete the return, respond to support questions, and understand where the fix or review experience needs improvement. The category is also recorded in our operational decision log and may be included in product analytics; the optional details are not sent to product analytics or copied into the operational decision log. Do not include passwords or sensitive personal information in the optional details.

Technical and analytics information

We use an IP address or signed-in user identifier to apply rate limits and prevent abuse. Server request logs (timestamp, path, status, IP address, user agent) are kept for up to 30 days. When analytics is enabled, PostHog receives page views and the app's own named events, along with browser and device details, a pseudonymous in-memory identifier, and the signed-in account identifier. Autocapture, session replay, heatmaps, surveys, experiments and feature flags are turned off; document text, filenames and element attributes are masked. Review, admin, and guest-payment capability values are removed from recorded URL properties.

How we use information

We use the information described above to:

• check, fix, validate, and deliver the PDF you submit;
• show document status, preserve account balances, and process purchases or credit refunds;
• process requests to return credits and improve fixes and review tools using the feedback submitted with those requests;
• secure the service, limit abuse, troubleshoot failures, and provide support; and
• understand aggregate product usage and improve the workflow.

Relevant document content may be processed by the Google Gemini API to classify layouts, describe meaningful images, recover reading order, or independently verify semantic evidence. When Gemini vision is the selected OCR provider, it may also transcribe scan-like pages and independently verify that transcription. PDF Hound enables this document processing only with an operator-attested paid Gemini service configuration under which submitted content is not used to improve Google products. When Google Cloud Document AI OCR is selected, scanned or image-based pages may instead be sent to its Enterprise OCR processor for transcription; Gemini may still process relevant page content for the semantic tasks described above when enabled. OCR evidence can include recognized text, location, language, confidence, and verification results needed for review. PDF Hound does not use customer files to train AI models.

Service providers

Depending on which features are configured or used, information may be processed by:

• Railway hosts the application and its active document storage (region: US);
• Google Gemini (Google Cloud, US) for paid-service semantic processing and optional vision OCR, and optional Google Cloud Document AI OCR using its Enterprise OCR processor;
• Google Cloud Storage (US) as the encrypted disaster-recovery backup destination only; backups are never read during normal service;
• Google Sign-In for optional account sign-in;
• Stripe for checkout and payment processing;
• Resend for transactional email (receipts, fix-ready and credit-return messages);
• Cloudflare Turnstile for automated abuse prevention; and
• PostHog (US) for cookieless product analytics: page views and named events only, with no session replay.

These providers process information under their own terms and privacy notices. We disclose information only as needed to operate the requested feature, comply with law, or protect the service and its users.

Retention and deletion

Active document files: free-audit PDFs and generated files are automatically removed from the active service after 30 days. Paid files remain active while you are still looking at the result or your credits are on their way back; downloading the result or a completed credit return starts a fresh 30-day retention period. Downloaded results remain downloadable during that period; results whose credits came back do not. Active-file deletion is enforced by storage lifecycle controls and the scheduled local retention sweep.

Saved review progress: while you review a fix, changes you have made but not yet applied are saved with that document so you can close the page and come back to them. They are removed when you apply them, when you download the result or have your credits returned, and when you delete the document. Anything left is removed with the document's other records on the same 30-day schedule.

Disaster-recovery copies: encrypted, access-restricted backups may retain a document copy for up to 35 additional days after it leaves the active service. Backup copies are not available through PDF Hound and are used only to recover from data loss. Any restored data is retention-swept before the service can expose it again. Backup schedules and storage lifecycle rules enforce the 35-day maximum; backups are not locked or versioned beyond it.

Service records: some structured audit, fix, order, and job records may remain after the underlying files are deleted for reliability and operational evidence. These records do not keep the uploaded or generated file available.

Longer-lived records: account records, credit balances, credit transaction history, payment references, transactional email delivery logs, support leads, cost records, and operational decision logs are not included in the active-file deletion policy. They are retained to preserve balances, delivery idempotency, transaction integrity, security, support, and business records, subject to applicable legal requirements.

Credit-return feedback: the reason category and optional details are part of the associated order record, and the category may also remain in operational decision logs and product analytics. These records are not covered by the 30-day document-file deletion policy and do not currently have a fixed automatic deletion period. You may request deletion as described below; we may retain limited transaction, security, or legal records where permitted or required.

Browser storage: PDF Hound stores session details, guest claim codes, recent document names, and workflow status in your browser so you can resume work. These remain until you remove an item, sign out where applicable, clear site data, or the browser removes them. Analytics sets no cookies: PostHog runs with in-memory persistence, so its identifier lasts only for the current page and nothing analytics-related is written to cookies or local storage.

Security

Document files are encrypted during transfer and at rest. Access to review results uses signed-in ownership or hard-to-guess capability links and tokens. We also use request limits and optional bot checks to reduce abuse. No internet service can guarantee absolute security, so keep a source copy of every document you upload.

Your choices and requests

You may use the free audit without an account, remove locally listed items from My PDFs, clear PDF Hound site data in your browser, or sign out to end the local session. Depending on where you live, you may also have rights to access, correct, delete, or receive a copy of personal information.

Delete a PDF yourself: every PDF listed for your signed-in account can be deleted from My PDFs, whether it was a free audit, a declined upload, an unpaid quote, or a delivered fix. Without an account, a fix can be deleted from its own download page, and you can ask us to delete any document. Deletion removes the active uploaded PDF, generated files, and per-document records immediately; a paid order keeps a small record without document content so the credit history still balances. A fix that is still running or waiting for your decision must finish, or have its credits returned, before it can be deleted.

Account deletion: send a request to hello@pdfhound.com from the address on the account. We respond within 7 days and confirm when the account, its documents, and its personal information have been removed. Other privacy requests go to the same address. We may need to verify that you control the relevant account, email address, claim code, or review link. Some transaction and security records may need to be retained where law permits or requires it.

Changes to this policy

We may update this policy as the service changes. The date at the top will change when we publish a material revision.