This policy describes exactly what happens to the data you send when you use PDF Hub (pdfhub.space). It is written to be readable rather than to satisfy lawyers — if anything here is unclear, please email narayanw100@gmail.com.
1. Who we are
PDF Hub is operated by the PDF Hub Team, an independent group based in India. There is no parent company, no data broker relationship, no advertising network buying access to your files.
2. What information we collect
a. Files you upload
Every PDF or image you submit to a tool page. See section 3 for exactly how long each type of file is kept.
b. Account information (only if you sign up)
Your email address and a bcrypt hash of your password. Optionally, a display name. We use this to authenticate you across sessions and to attach your usage history to your account.
c. Usage history (only if you are logged in)
For each tool you run while logged in, we record the tool name, the original filename, and a timestamp. We do not store the file content in this history — only the metadata so you can see what you did. You can delete individual entries or the whole history from your account.
d. Signature-request metadata
When you use "Send for Signature", we record who sent it, the recipient email, the message you wrote, the audit trail (sent / viewed / signed / declined events), and — because it is needed to complete the workflow — the PDF itself. See section 3.d.
e. Contact-form messages
When you write to us through /contact, we forward your name, email and message to our support inbox. We keep support conversations for the time it takes to resolve them.
f. Technical logs
Standard web-server logs (IP address, user agent, response codes) are kept for a short time to diagnose errors and to enforce rate limits.
3. How long we keep your data
Different features have honestly different retention. We list all of them here:
a. Regular tool uploads (merge, split, compress, rotate, convert, OCR, watermark, protect, unlock, PDF/A, HTML→PDF, edit, redact, sign-myself, and similar)
Your file is written to a temporary directory on the server, processed, and the directory is deleted by the operating system as soon as the request finishes — usually within seconds. No copy is written to our database.
b. Share links
If you generate a share link, the file bytes are stored in the database until the link expires (you choose 1–168 hours) or the first fetch after expiry, whichever comes first.
c. Workflow deliveries (workflows that end with an "Email result" step)
The processed file is stored so the recipient can download it. MongoDB automatically deletes the record 24 hours after creation via a TTL index.
d. Signature requests
The original PDF and the signed PDF are kept in the database until either you delete the request from your dashboard, or the expiry date you chose passes (default 14 days, maximum 60 days). Requests marked declined are kept for audit purposes until you delete them.
e. Account data
Kept as long as you have an account with us. If you want your account and its data removed, email us from the address you registered with and we will delete it.
f. Server logs
Retained on the hosting platform for approximately 14 days.
4. What we do not do
- We do not sell, rent or share the content of your uploads with third parties for advertising.
- We do not train machine-learning models on your uploads.
- We do not read your files by hand. Support staff would only inspect a file if you specifically ask us to as part of debugging a report you sent us.
- We do not embed third-party trackers that follow you across the web (see section 6 for the third parties we do use).
5. AI-based tools (Summarize, Translate)
For the two AI-based tools, PDF Hub extracts the text of your document on our server and then sends that text to a large-language-model provider (currently via the Emergent LLM proxy, which routes to providers such as OpenAI, Anthropic and Google). We do not send the raw PDF file — only the extracted text needed to answer your request. The LLM providers have their own data-handling policies; assume that any text you send to an AI tool leaves our servers. If a document is confidential, do not send it to the AI tools.
6. Third parties we use
- Resend — sends transactional email (signature invitations, workflow-completion notifications, contact-form messages). Resend sees the recipient's email address, the sender, the subject and the HTML body.
- Emergent LLM proxy — for AI tools only; sees the text you send to those tools.
- Google AdSense — used on some pages to display ads. AdSense may set cookies to measure ad performance and personalise ads according to Google's policies. See Google's advertising policies. You can opt out of personalised ads at Ad Settings.
- Google Fonts — served over CDN. Google Fonts receives your IP address when your browser downloads a font file.
- Hosting platform — the platform that runs the PDF Hub servers has access to server-level information as part of normal hosting.
7. Cookies
- Authentication cookie — set when you log in. HttpOnly, Secure, SameSite=None. Removed when you log out or when the session expires.
- Language preference — a small entry in localStorage (not a cookie) that remembers your interface language.
- Recent files list — kept only in your browser's localStorage; never sent to our server.
- Advertising cookies — set by Google AdSense on pages that show ads, subject to Google's policies.
8. Children
PDF Hub is a general-purpose tool site and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, email us and we will remove it.
9. Your rights
You can:
- Ask what data is associated with your account.
- Ask us to delete your account and its data.
- Ask us to correct information you provided.
- Object to specific uses (though most uses are strictly required to run the tool you asked for).
Send requests from the email address that owns the account to narayanw100@gmail.com. We aim to respond within one working week.
10. Security
Traffic between your browser and PDF Hub is encrypted with HTTPS. Passwords are stored as bcrypt hashes; we never store or transmit plain-text passwords. Signature payloads are capped in size to reduce abuse. No system is perfectly secure — if you notice a vulnerability, please email us privately before disclosing it publicly.
11. Changes to this policy
If we materially change how we handle data, we will update the "Last updated" date at the top and — for signed-in users — surface a notice inside the app. Trivial edits (fixing typos, adding clarifying examples) will happen without a notice.
12. Contact
Email narayanw100@gmail.com or use the contact page.