PDF Tools

What we do

PDF Tools (pdf.fluvion.cz) is a free online service for PDF file manipulation — compression, merging, splitting, rotation, reordering, conversion, watermarking, and password protection. The service is operated by PlayD4d.

Files you upload

• Your files are processed server-side on our infrastructure located in the EU.
• Files are automatically and permanently deleted within 15 minutes of upload.
• We do not read, analyze, index, or store the content of your files beyond the time needed to process them.
• Processed results (compressed PDFs, converted images, etc.) are also deleted within 15 minutes.
• We do not share, sell, or transmit your files to any third party.

Information we collect

We collect minimal data necessary to operate the service and prevent abuse:

• IP address — used for rate limiting and abuse prevention. IP addresses are not stored in our analytics database; only a one-way cryptographic hash (SHA-256, truncated) is stored, which cannot be reversed to recover the original IP.
• Request metadata — which tool was used, file size, page count, processing duration, and success/error status. This is used for service monitoring and performance improvement.
• Approximate location — country and city derived from your IP address using an offline database (DB-IP). This is stored only in aggregate form associated with the hashed IP, not your real IP address.

Cookies

We use a single technical cookie (pdft) to ensure fair usage limits. This cookie:

• Contains a random anonymous identifier (not linked to any personal information)
• Is HttpOnly (cannot be read by JavaScript), Secure (sent only over HTTPS), and SameSite=Strict
• Is used solely to differentiate users behind shared network connections (NAT) for fair per-user resource allocation
• Does not track you across websites
• Does not contain any personal information
• Expires after 1 year

We do not use any analytics cookies, advertising cookies, or third-party tracking cookies.

Third parties

• We do not use Google Analytics, Facebook Pixel, or any third-party tracking service.
• We do not embed any third-party scripts, fonts from external CDNs, or external resources. All assets (fonts, icons) are self-hosted.
• Donations are processed through Buy Me a Coffee, which uses Stripe for payment processing. If you choose to make a donation, their respective privacy policies apply. We do not receive or store any payment card information.

Data security

• All data is transmitted over HTTPS (TLS encryption) enforced via HSTS.
• Uploaded files are stored in a restricted directory (mode 0700) accessible only to the application process.
• File identifiers are cryptographically random tokens — file URLs are unguessable.
• Rate limiting, per-user quotas, and brute-force protection are in place to prevent abuse.
• The server is hosted in the EU on dedicated infrastructure with SSH key-only access.

Data retention

• Uploaded files: deleted automatically within 15 minutes.
• Analytics data (hashed IPs, tool usage, performance metrics): retained for up to 90 days, then automatically purged.
• Server logs: rotated automatically, retained for operational purposes only.

Your rights

Since we do not store personal data beyond anonymized hashes and we do not require user accounts, there is no personal data to access, correct, or delete. If you have questions or concerns, contact us at the email below.

Children's privacy

This service is not directed at children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will reflect the most recent revision. Continued use of the service constitutes acceptance of the updated policy.

Contact

For privacy-related questions, contact: playd4d@fluvion.cz