Privacy Policy

§1Who we are

PDFCatalyst is operated by ICTechLabs, headquartered in Singapore. The data controller for the limited information described below is ICTechLabs Pte Ltd. Privacy questions: privacy@pdfcatalyst.com.

§2What stays in your browser (everything, today)

The PDF editor is a single-page application. When you open a file:

• The file is parsed in-browser by pdf.js.
• Edits and exports are produced in-browser by pdf-lib.
• The session (file bytes, annotations, page order, bookmarks, filename) is written to your browser's IndexedDB via a key in the URL (the ?s=… token).
• That URL is the only pointer to your work — it lives only in your URL bar and your IndexedDB.

You can verify this yourself: open your browser's DevTools, switch to the Network tab, and reload the editor. You will see no upload requests to PDFCatalyst's servers while you edit, save, or export.

§3What we collect on the server side (effectively nothing)

Static assets (HTML, JS, CSS, fonts) are served from Cloudflare Pages. As with any web hosting, Cloudflare's edge nodes log standard request metadata (timestamp, IP, user agent, request path, response status) for the purpose of delivering the site and mitigating abuse. We do not aggregate, profile, or join this data with anything else, and we have not added our own analytics or telemetry on top.

Cloudflare's processing is governed by Cloudflare's privacy policy.

§4Cookies and local storage

We use:

• IndexedDB — to persist your editor session (your files, edits, bookmarks). Purely local. Not sent anywhere.
• localStorage — to remember your language preference (EN / VI). Not sent anywhere.
• No cookies for tracking or advertising.

§5When that changes (paid tier, future)

Future paid features will require server-side compute and therefore an upload:

• Cloud OCR — to make scanned PDFs searchable.
• AI autofill — to detect form fields on flat scans.
• Unlock — to remove a password from a protected PDF (with your authorization).
• Cloud library — to sync your sessions across devices, end-to-end encrypted.

Each of these features will be opt-in, will display a clear "this file will be uploaded" confirmation before the upload, and uploaded files will be deleted within 60 seconds of processing. None of them are live in the v1 free tier.

§6Children

PDFCatalyst is not directed at children under 13 (under 16 in the EU). We do not knowingly collect personal data from children.

§7Your rights

Because the v1 free tier doesn't store any personal data on our servers, most data rights (access, correction, deletion, portability) apply only to data you control on your device. To exercise those rights:

• Delete everything — clear site data in your browser, or use the editor's Reset action.
• Export everything — open any session and click Export to download the PDF.
• Stop using PDFCatalyst — close the tab. There is no account to delete.

If you live in a jurisdiction with stronger data-protection law (EU/UK GDPR, Singapore PDPA, California CCPA), you may have additional rights regarding the limited server-side log data described in §3. Contact privacy@pdfcatalyst.com to exercise them.

§8International transfers

Static assets are served from Cloudflare's global edge network — the nearest edge node to you serves the page. No personal data is transferred to PDFCatalyst's servers in the v1 free tier (because none is collected).

§9Security

Browser-only execution removes most of the security surface — there is no server database to breach. The site is served over HTTPS exclusively. We will not ask you for a password (we don't have accounts), payment information (we don't take payment), or any sensitive personal data via PDFCatalyst.

§10Changes to this policy

When we change this policy (notably when paid features ship), we will update the effective date at the top and surface a notice in the editor for any material change.

§11Contact

Privacy questions: privacy@pdfcatalyst.com. Other: hello@pdfcatalyst.com.