Privacy Policy

We provide tools for processing PDF files and URLs, and we do not require account creation for standard use.

Browser-Based Processing (Local Tools)

For many of our tools, such as Merge PDF, Split PDF, Organize PDF, Rotate PDF, Remove PDF Pages, PDF to Excel / JSON, Markdown to PDF, Password Protect PDF, and Browser Compression, all processing happens entirely locally within your web browser. When using these browser-based tools, your files are never uploaded to our servers and never leave your device.

Cloud Processing & File Deletion Policy

Certain tools require cloud infrastructure and do upload your file to our servers: Webpage-to-PDF, Server Compression, PDF to Word, and any job submitted through our public API (including PDF parsing and resume parsing). When you use these tools, your files are transmitted to our servers over an encrypted connection.

We adhere to a strict File Deletion Policy for file contents: files are stored only in temporary processing storage for job completion and download delivery. Downloads trigger immediate cleanup of the job files when the workflow completes, and any temporary server files that remain are swept from storage within 1 hour. We do not keep backups of your documents and we do not retain their contents.

We do retain a job recordafter the file itself is deleted. This record includes the original filename, file size, page count, a content checksum, the tool used, and the job outcome. We keep it to support your usage history, billing, and abuse investigation. It does not contain the contents of your document, but a filename can itself be sensitive — if that matters for your use case, rename files before uploading or use our browser-based tools instead.

Processor Role & DPA

When you upload documents containing third-party personal data, DocuShell acts as a data processor on your behalf. We process files only for the purpose you request, delete their contents within 1 hour, and do not access those contents for any other purpose. If you require a signed written data processing agreement (DPA) before sending regulated or contractually restricted data, contact us first so we can put one in place — do not assume one is already in force.

Where Your Data Is Processed

DocuShell is operated from India, and our servers are currently hosted in the United States (AWS, us-east-1). If you use DocuShell from outside the United States, including from India or the European Economic Area, your data is transferred to and processed there.

Service Providers

We rely on the following third parties to operate DocuShell. Each processes only what its function requires:

• Amazon Web Services — server hosting and transactional email delivery.
• Cloudflare — DNS, TLS termination, and protection against malicious traffic.
• Razorpay — payment processing for paid plans. Card details are handled by Razorpay and never reach our servers.
• Google — AdSense advertising, Analytics, and Google sign-in.
• Sentry — error monitoring. Receives technical diagnostics when something breaks, which can include the page you were on and the technical details of the error.
• OpenAI — used only by our AI-assisted evidence and answer features. Where those features are enabled, text extracted from the document you are asking about is sent to OpenAI to generate and check the answer. Our standard PDF tools do not use OpenAI and do not send anything to it.

Advertising & Third-Party Cookies

DocuShell is a free service supported by advertising. We use Google AdSense to display ads on our website. Google and other third-party ad vendors use cookies to serve ads based on your prior visits to this site and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to DocuShell and/or other sites on the internet.

You may opt out of personalized advertising by visiting Google's Ads Settings. You may also opt out of third-party vendor use of cookies for personalized advertising by visiting www.aboutads.info.

Analytics

We use Google Analytics to collect aggregated, anonymized information about how visitors interact with our website (pages visited, time on site, browser type). This data helps us improve our tools and content. Google Analytics uses cookies that do not contain personal document data. For more details on Google Analytics data practices, see the Google Privacy Policy.

Cookies

For complete details on the specific cookies we set, how to manage your cookie preferences, and how to opt out of non-essential tracking, please read our Cookie Policy.

What We Collect

Without an account: most tools work without signing in. We do not ask for your name or email to use them, and for browser-based tools we have no technical ability to access your files because they never leave your device.

With an account: we store your email address, and your name and profile picture if you sign in with Google.

Anti-abuse signals: to enforce free-tier limits and prevent automated abuse, we derive a device fingerprint from your browser and store it, along with hashed IP addresses, hashed email addresses, and browser user-agent details. These signals are linked to your account when you have one, and are retained for anonymous visitors to track free-trial usage. We also keep a limited record after account deletion, described below, so that deleted accounts cannot be used to reset free-tier limits.

Account Deletion & Retention

If you delete a registered account, we immediately disable access and revoke active sessions. We retain the account for up to 31 days to allow recovery and to prevent abuse. After that window, we anonymize personal identifiers (such as email, name, and linked OAuth IDs) and the account can no longer be reactivated.

Two things intentionally survive that anonymization. We keep a tombstone record containing hashed identifiers (email, device fingerprint, and IP) so that deleting and recreating an account cannot be used to reset free-tier limits. We also keep billing and invoice records for as long as tax and accounting law requires. Neither contains your document contents.

Children's Privacy

DocuShell is not directed at children under the age of 13. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of DocuShell after changes are posted constitutes your acceptance of the revised policy.

Contact

For privacy requests, policy questions, or abuse reports, please use our contact page and include enough detail for us to investigate.