Privacy policy

Updated November 1, 2026. This policy covers the Write on PDF website, its online PDF editor and browser extension.

PDF editing and browser storage

PDF rendering, annotations, drawn signatures, image conversion and PDF export run on your device. Settings, annotation drafts, recognized text, text-editing drafts, comments, styles and saved signatures may be stored in your browser. Website data uses IndexedDB and is separate from extension storage. A PDF selected on the homepage is held temporarily in browser storage to pass it to the editor, then removed from that temporary store. The open document stays in memory. Passwords are used in memory to open and export protected documents.

Clear the site’s browser data to remove website drafts and signatures. Removing the extension removes its extension storage. Downloads and files saved to Google Drive are not removed by either action.

Optional Google Drive connection

Drive is optional. When you choose a Drive action, Google Identity Services asks you to sign in and grant access. We request access to the Drive files you choose or create with Write on PDF and permission to connect this app to Drive. We do not request permission to list or read all your Drive files, Gmail or contacts. Google provides your basic profile and email to create or restore your Write on PDF account in Firebase Authentication. Ordinary local editing does not create an account.

The browser reads the selected PDF’s contents, name, size and relevant file permissions directly from Google. Choosing Save copy to Drive uploads the exported PDF and its name directly to Google as a new file in My Drive. We do not change the source file or its sharing settings. These file transfers do not pass through our server. Google’s scripts and services process sign-in, file selection and Drive requests under their own policies.

Google Drive access tokens are used in tab memory. To remember your Drive connection, our server stores an encrypted Google refresh token linked to your Firebase user ID in Cloudflare D1. The browser never receives this refresh token. During sign-in, an encrypted handoff containing the Google credentials expires after ten minutes and is removed on completion or by periodic cleanup. An HttpOnly cookie binds this handoff to your browser. Firebase stores your account profile and persists its own authentication session in browser storage. Signing out clears the local session; your saved Drive connection remains available after signing in again. Disconnect deletes the saved Drive credential and requests Google revocation; you can also remove the app in Google Account connections. PDF drafts may remain in local browser storage until you clear them.

Information received from Google Workspace APIs is used only to provide the document actions you request. We do not sell it, use it for advertising or use it to train AI models. Write on PDF’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Optional cloud text recognition

Choosing Edit text asks for confirmation before uploading the selected page through our Cloudflare API to Claude on Google Vertex AI. This also applies to a PDF opened from Drive. Added editor notes and signatures, source annotations and form widgets, other pages and passwords are excluded. PDF reconstruction and export happen locally. To keep a Drive document entirely local during editing, do not enable this cloud action.

The scan API does not store or log PDF contents or recognized text. Cloudflare and Google process requests under their applicable service terms. To enforce the scan quota, Cloudflare D1 stores a daily keyed IP hash, day and attempt count. Raw IP addresses are not stored in that table; providers may process technical request metadata. Old quota buckets are removed by a periodic cleanup job.

Website requests and optional feedback

The website and extension include no analytics or advertising trackers. Fonts are bundled locally. Opening a PDF from another website requests the file from that website and may use the existing sign-in session. Our hosting provider may process technical request information to serve and protect the site.

Optional uninstall feedback stores the selected reason, optional comment, submission time and a random response ID in our Cloudflare-hosted database. PDF contents and browsing history are not attached. You can close the feedback page without answering. Do not include sensitive information in a comment.

Questions

For privacy or support questions, email wpdf@fonable.io. Do not send confidential documents or Google access tokens.