Privacy Policy
Last updated: August 2026
VitePDF ("we", "us") provides PDF tools that run almost entirely in your own browser. This page explains, tool by tool, exactly what data is or isn't processed, who our processors are, and what rights you have. We're not a law firm — if you need a formal legal opinion on your own use of VitePDF, talk to a lawyer.
1. The short version
- Most tools: nothing is collected. When a tool runs in your browser (the default for every tool), your file is processed on your own device and never sent to us. We have no way to see it, and it's gone the moment you close the tab.
- Signing in: only needed for Premium. We use Firebase Authentication (Google) to manage your email and account.
- Paying for Premium: handled entirely by Stripe. We never see or store your card details.
- A few Premium tools (higher-fidelity Word/PowerPoint/Excel/HTML conversion, unlock, password protect) briefly upload your file to our conversion server to do the conversion, then delete it immediately afterward.
2. Data processed by client-side tools
The large majority of VitePDF's tools — merging, splitting, reordering, rotating, watermarking, compressing, signing, redacting, and more — run using JavaScript executing directly in your browser. Your file is read into your browser's memory, processed there, and offered back to you as a download. At no point does it travel over the network to any server we operate. We do not, and cannot, see the contents, filename, or any data about these files.
3. Account and sign-in
Signing in is only required to manage a Premium subscription — it is never required to use any free tool, including the free tier of our server-side conversions. When you sign in, we use Firebase Authentication, a service provided by Google, to manage this. Firebase stores your email address and a unique account identifier. We use this identifier to look up your subscription status; we don't use it for anything else.
4. Payments and Premium subscriptions
If you subscribe to Premium, payment is processed entirely by Stripe using its Managed Payments product, which also acts as the merchant of record. Stripe collects your billing name, email, and payment details directly — we never receive or store your card number. We do receive, from Stripe, confirmation of your subscription status (active, canceled, etc.) and whether you selected personal or business use, so we can grant or remove Premium access on our end.
5. Server-side conversion (Premium tools only)
A handful of tools — higher-fidelity PDF↔Word/PowerPoint/Excel conversion, HTML-to-PDF, unlocking a password-protected PDF, and password-protecting a PDF — need real document- or browser-rendering software that can't run in a browser tab, so they use our conversion server. When you use one of these tools' server mode, your file is uploaded, converted, and returned to you, then deleted immediately after the response is sent. We do not store, back up, inspect, or use these files for any other purpose, and free-tier use of these tools (up to a size limit — see our pricing page) doesn't require signing in at all.
6. Cookies and similar technologies
VitePDF's own code does not set tracking cookies and does not use any analytics or advertising trackers. Firebase Authentication's SDK stores a small amount of data in your browser's local storage (not a cookie) purely to keep you signed in between visits; this data isn't shared with any third party for advertising or tracking purposes. Our infrastructure provider, Cloudflare, may process standard connection-level data (like your IP address) as part of operating its network and protecting the site from abuse — this is separate from, and does not involve, any cookie-based tracking.
7. Who we share data with
We use a small number of service providers ("processors") to run VitePDF:
- Google Firebase — authentication and account management.
- Stripe — payment processing and subscription billing.
- Cloudflare — content delivery network and security (DDoS protection, bot mitigation).
- Our own conversion server — processes files for the handful of server-side Premium tools described above.
We don't sell your data, and we don't share it with anyone for advertising purposes.
8. International data transfers
Google, Stripe, and Cloudflare are US-based companies with global infrastructure. Where your data is transferred outside the European Economic Area or UK, these providers rely on mechanisms such as the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework, to provide an adequate level of protection.
9. How long we keep data
- Files processed by client-side tools: never stored by us at all — they exist only in your browser's memory while the tab is open.
- Files uploaded to our conversion server: deleted immediately after conversion; typically within seconds.
- Account data: kept for as long as your account exists. You can request deletion at any time (see Section 10).
- Payment records: retained by Stripe as required for accounting, tax, and fraud-prevention purposes.
10. Your rights
If you're in the EEA, UK, or a jurisdiction with similar protections, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your account and associated data.
- Object to or restrict certain processing.
- Receive your data in a portable format.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us using the details in Section 13.
11. Children's privacy
VitePDF is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we'll delete it.
12. Changes to this policy
We'll update the "Last updated" date at the top of this page whenever we make changes. For significant changes, we may also provide additional notice.
13. Contact us
Questions about this policy or your data? Reach us at [email protected].