We read the privacy policies of 10 popular PDF tools. Here is what happens to your file
Every day, millions of contracts, bank statements, medical letters and ID scans get dropped into free online PDF converters. Almost nobody reads what the converter's privacy policy says will happen to them.
So we did. We read the current published privacy policies, terms and security pages of ten of the most popular PDF tools on the web, and pulled out the three answers that matter for a sensitive document: where does the file go, how long is it kept, and who is behind the service. Their own words, linked, in one table. The most surprising thing we found: for several tools, the advertised deletion window appears on tool or FAQ pages, while the privacy policy itself states no number at all.
How we did this
We picked the ten services before reading anything: the web tool suites that dominate search results and comparison lists for everyday PDF tasks. Popular adjacent tools we did not cover this round, such as Foxit's online tools, pdfFiller, DocHub and PDFescape, are candidates for a follow-up. On August 9, 2026 we then fetched each vendor's current privacy policy, terms and, where they exist, security or file-handling pages, and recorded only what those pages state. Where a policy is silent on a question, the table says "Not stated" rather than guessing, and every claim is labeled with the document it actually comes from, with a link. Policies change, and we want this table to stay accurate: if you represent one of these services and something here no longer matches your published pages, email support@pdfmergely.com and we will verify and correct it promptly.
One disclosure up front, because a comparison published by a competitor should say so plainly: PDFMergely is a PDF toolkit too. We think the fairest way to handle that is to quote every vendor's own words, link every source, and let you check the one claim we make about ourselves the same way, on the proof page.
The table
| Tool | Where your file goes | Stated deletion window | Company / jurisdiction | Notable | Source |
|---|---|---|---|---|---|
| Smallpdf | Yes, to its servers. Files are stored with Hetzner in the EU; Cloudflare handles US users. | 1 hour for logged-in users, unless saved to its file storage. Anonymous and e-sign recipient files are kept for an open-ended "reasonable period" that resets each time the file is opened. | Smallpdf AG, Switzerland | Processed files get a shareable link by default (can be disabled). | privacy policy |
| iLovePDF | Yes, to its servers, using cloud infrastructure partners. | Within 2 hours of processing, per its security page, which also states signed documents are kept up to 5 years. | ILOVEPDF S.L., Barcelona, Spain, per its terms | Files can be deleted manually from the download screen before the automatic window. | security page terms |
| Adobe Acrobat online | Yes: "Acrobat online services upload your files to Adobe cloud storage" (AWS-hosted, per its cloud-storage page). | Not stated as a number anywhere we could find: "within a short time period" when not signed in. Signed-in files are saved to your Adobe account. | Adobe Inc. (US); Adobe Ireland for most other countries | The content-analysis opt-out does not apply "when you are not logged in", per its content-analysis FAQ. AI features send content to Microsoft Azure OpenAI, and Adobe caches the extracted content on its own servers for 12 hours. | help FAQ cloud-storage page |
| Sejda | Yes: "Our servers process the files for you", per its homepage. Subprocessors named in the policy: DigitalOcean, Cloudflare, Fastly. | Not stated as a number in the policy, which says "permanently deleted after upload or processing". A 2-hour figure appears on its tool pages. | Sejda BV, Netherlands | Publicly shared output files are kept 7 days. "No backups are made." | privacy policy tool page |
| PDF24 | Yes, for the online tools: "All servers processing files are located within the EU", per the policy. Its tool pages say Germany. | "Usually deleted one hour after" upload, per the policy. | geek Software GmbH, Berlin, Germany | Its desktop app "works offline", per its FAQ; the web tools upload. | privacy policy FAQ |
| PDF2Go | Yes, to servers "located in Europe exclusively". Cloudflare is named as its CDN and security provider. | Downloads capped at 10; access blocked after 24 hours; files physically deleted within 72 hours. No backups. | QaamGo Web GmbH, Germany | The most specific file-handling policy in this table. | privacy policy |
| Soda PDF | Yes, files are uploaded; hosting vendors "such as Microsoft, Google and Amazon Web Services". | Not stated in the policy. A 24-hour deletion figure appears in the FAQ sections of its blog and tool pages. | Avanquest Software, France and Canada | Its California notice says some ad-vendor sharing "may be considered data selling". | privacy policy FAQ post |
| PDF Candy | Yes, to its servers. | 2 hours, stated in the privacy policy itself, covering inputs and outputs. | Icecream Apps Ltd, Cyprus | PDF-to-Word is processed by a named third party, Solid Documents. | privacy policy |
| Xodo | Mixed: "Most of our tools process your files entirely within your browser"; some upload. A per-tool table on its site says which. | About 1 hour for server-processed files, per its tool-privacy page. Not stated in the formal Apryse policy. | Apryse Software Inc., Canada | AI features may send documents to OpenAI and Google, per the Apryse policy. | tool-privacy page Apryse policy |
| TinyWow | Yes, to servers in the United States. | 1 hour after processing, stated in the policy. The window restarts if you feed the file into another tool. | TinyWow LLC, Tennessee, US, per its terms | Ads-supported; the policy names Google and Facebook as collecting device data for ads and analytics. | privacy policy terms |
Every row is taken from the vendor's own published pages, accessed August 9, 2026. Policies change; if you represent one of these services and something is out of date, email support@pdfmergely.com and we will correct it promptly.
What stood out
1. Nine of the ten tools upload your file; the tenth is mixed. Nine process web-tool files on their servers; Xodo is the one genuinely mixed model, stating that most of its tools run in the browser and publishing a per-tool list of which do not. Whatever else the policies differ on, the starting point is nearly universal: the document leaves your device.
2. The deletion window often is not where you think it is. This was the finding we did not expect. Sejda's "2 hours" and Soda PDF's "24 hours" appear on tool and FAQ pages, while the privacy policies behind them state no number at all. Xodo's one-hour figure lives on a dedicated tool-privacy page rather than the formal Apryse policy. And Adobe states no number anywhere we could find, just "within a short time period" for signed-out users. If a deletion promise matters to you, check whether the number appears in the privacy policy itself, because for several of these tools it appears only on marketing or help pages.
3. Being logged in changes your rights. Smallpdf deletes logged-in users' files within one hour, but anonymous users' files and e-sign recipients' files are kept for an open-ended "reasonable period" that resets every time the file is opened. Adobe's content-analysis opt-out applies to your account settings, and by its own content-analysis FAQ does not apply "when you are not logged in". The casual, signed-out user, the person most likely to drop in a one-off sensitive document, often has the weakest position.
4. Your file has a supply chain. The policies name more hands than most people expect: Hetzner and Cloudflare for Smallpdf, DigitalOcean, Cloudflare and Fastly for Sejda, AWS behind Adobe, "Microsoft, Google and Amazon Web Services" for Soda PDF. PDF Candy outsources an entire tool: its PDF-to-Word runs on Solid Documents, a named external processor. And AI features add another tier: Xodo names OpenAI and Google as providers that may process documents, and Adobe's AI assistant sends extracted content to Microsoft Azure OpenAI and caches it on Adobe's own servers for 12 hours.
5. Credit where due. Several of these policies are genuinely good disclosures. PDF2Go's is the most specific in the group: ten downloads, access blocked at 24 hours, physical deletion within 72, no backups, EU servers, all in the policy itself. TinyWow and PDF Candy put plain numbers in their policies. PDF24 keeps its infrastructure in the EU and offers a desktop app that works fully offline. The problem is not that these companies hide the ball; it is that the model itself requires you to trust the ball-handling.
How to read any PDF tool's privacy policy in two minutes
You do not need a law degree; you need three searches and one look-up. Open the policy and Ctrl+F for these:
- "delete": the retention window for uploaded files. A specific number ("within 2 hours", "after 24 hours") is a good sign. No mention of file deletion at all is the red flag.
- "third": third parties and subprocessors. Who else touches the infrastructure your file sits on?
- "train" or "machine learning": whether content can be analyzed beyond performing the conversion you asked for.
- The company's address: which country's law applies to the server your document is on.
And one test that beats all four: turn off your Wi-Fi. If the tool keeps working, your file is being processed on your device. If it stops, everything above applies to you.
The bottom line
None of the retention windows in the table are scandals; several are genuinely good practice, clearly stated. But every one of them is an answer to a question that only exists because the file left your device. The strongest privacy policy is the one that never has to apply.
That is the approach we take: PDFMergely processes files in your browser, so there is no upload, no server copy, and no retention window to trust. You do not have to take that on faith either. Watch the network tab while you work, or try Merge PDF with your Wi-Fi off.
Frequently asked questions
Which PDF tool deletes uploaded files fastest?+
The shortest stated windows among the ten tools we compared are about one hour: PDF24 ("usually"), TinyWow, Xodo for its server-processed files, and Smallpdf for logged-in users. iLovePDF and PDF Candy state two hours. But check where the number lives: for several tools the figure appears on tool or FAQ pages while the privacy policy itself states no window.
Do free PDF converters keep your files?+
Temporarily, yes, by their own accounts: every upload-based tool we read holds your file on its servers at least briefly, with stated windows ranging from about an hour to 72 hours, and longer exceptions for e-sign documents and some anonymous uploads. Signed-in Adobe users have files saved to their account storage rather than auto-deleted. Stated windows vary by service, and for some tools the policy itself states no number; we linked every claim to the page it comes from.
Is it safe to upload documents to a PDF converter?+
The reputable services publish real security practices, and for everyday files that trade is reasonable. For sensitive documents you are trusting the transfer, the deletion promise, and every named subprocessor in the file path. A tool that processes files in your browser removes that entire chain, which you can verify yourself rather than take on faith.
How was this comparison verified?+
We fetched each vendor's current privacy policy, terms and security or file-handling pages on August 9, 2026, and recorded only what those pages state, with a linked, labeled source for every row. Where a policy is silent we wrote "Not stated" rather than guessing. If you represent one of these services and your published pages have changed, email support@pdfmergely.com and we will verify and correct the table.