Your privacy comes first

1. Tools that run on your device

Most PDF tools (merge, split, extract, reorder, rotate, delete pages, page numbers, watermark, add text, add image, fill form, compress, images to PDF, PDF to images, preview, copy text, OCR), all business document generators and all templates run inside your web browser. Your file or the information you type is read and processed by your own device and is not uploaded to Docsora. We tested this by checking the network requests each tool makes.

The OCR tool downloads its free text-recognition software and language data from a public file server (jsDelivr) when you use it. Only that software is downloaded; your document is not sent.

If you tick "Remember my business details on this device" in a document generator, your business details are stored in your own browser (local storage) — not on our server. Untick the box to remove them. Unfinished documents are kept in your browser's session storage until you close the tab, so you don't lose your work if the page reloads.

2. Tools that use our server

Word to PDF, Excel to PDF, Password-protect a PDF and Remove a PDF password send your file over an encrypted HTTPS connection to our server. Before you upload, you choose:

• Process and discard (default): your file is processed in the server's memory and the result is sent straight back to you. Nothing is saved to our database or disk by Docsora. Very large uploads may be briefly buffered in a temporary system file by our web framework during the upload; that file is removed when the request ends.
• Keep for 24 or 48 hours: only the finished result is saved in our database's temporary file storage under a random name. You receive a private link containing a long random code; we store only a scrambled (hashed) version of that code, so we can't recreate your link. Your original file is never saved.
• Delete now: removes the kept result immediately.

Kept results are deleted automatically: a clean-up job runs every 15 minutes, and every download request also checks the expiry time first, so an expired file can never be downloaded. Expired files are therefore removed within about 15 minutes of expiry. Because kept results are stored in our database, a copy may remain in our hosting provider's routine database backups for a limited time after deletion; we don't control that backup schedule.

Passwords you type into the password tools are used only to process that file and are never stored.

3. Information we do collect

• Feedback you send: your message, the feedback type, the tool you selected and — only if you choose to give it — your email address. Used only to improve Docsora and reply to you.
• Anonymous usage counts: how many times each tool succeeded or failed each day, and a short error category (such as "damaged file"). These counts contain no file names, file contents, IP addresses or personal information.
• Administrator sign-in: the Docsora administrator signs in with Google. Visitors don't have accounts.
• Server logs: like most websites, our hosting provider records basic request logs (such as IP address, time and the page or API address requested). File contents, file names and retrieval codes are not included in these addresses.

We do not use advertising trackers, we have not added any analytics service of our own, we do not sell data, and we never use documents to train AI. Our hosting and delivery providers add the limited services described in section 4.

4. Third-party services

• Emergent — hosts the website and server. Its website script sets two cookies on this site: __emg_vid (a random visitor identifier, kept for up to one year) and __emg_sid (a random session identifier, kept for 30 minutes). They are used by the hosting platform and contain no document data.
• Cloudflare — delivers the website. Cloudflare Web Analytics records anonymous page-load information (such as the page address and how quickly it loaded). It does not use cookies for this.
• Google Fonts — provides the website's fonts (your browser requests the font files).
• jsDelivr — provides the OCR text-recognition software and language data when you use the OCR tool.
• Google sign-in (via Emergent) — used only for the administrator.

5. Limitations we want you to know about

• Docsora is a beta. We have built and tested these protections, but no system is perfect.
• Docsora has not had an independent security audit, and we make no claims of certification or compliance with specific laws (such as GDPR or PIPEDA). A legal review is planned before wider launch.
• Anyone who has your private 24/48-hour link can download that result until it expires. Keep it private.

6. Your choices and contact

You can use every tool without giving us any personal information. To ask about or delete feedback you've sent, or to report a privacy or security concern, use the feedback form (choose "Security concern").