Privacy policy
This page states what stupidPDF collects, what stays on your device, and which actions send data to someone else. It matches the tools that are on the site.
Short version
stupidPDF is a free PDF toolkit that runs in the browser at https://www.stupidpdf.com. There is no account and no paid plan.
PDFs and other files you drop into a tool are processed on your device. stupidPDF does not upload those files to its own server and does not keep a copy of them.
A few actions do send something off the device. Those cases are named below: hosting the website, page-view analytics, the AI tool, read aloud when a browser only has online voices, and the Suggest a feature form. Nothing else in the toolkit is a file upload.
Who this policy covers
This policy describes the public website and the tools on it. It is written so a client can see what the site does with information.
The site is published as stupidPDF. Opening https://www.stupidpdf.com, or any tool path on that host, is covered. Native shells of the same app follow the same file rules: processing stays on the device, and the web ad slot is not shown there.
Hosting
The website is served by Vercel. When your browser requests a page, Vercel receives ordinary request data: IP address, user agent, and the URL. That request carries the site itself (HTML, scripts, and images). It does not carry the PDF you later open in a tool.
Vercel acts as the host. Their handling of request logs is covered by Vercel. stupidPDF does not add your document to that request.
The OCR engine and its language files are part of the site too. The first time a scan needs them, the browser downloads them from www.stupidpdf.com, like any other script. That request names the engine file or the language (for example English), never your document. No other host is contacted by stupidPDF for OCR.
Some browsers (for example recent Chrome and Edge on desktop) have a built-in AI model that OCR can use instead. If the model is not on your device yet, OCR offers to get it and waits for you to press Download and use it. The browser then downloads the model from its own maker (for example Google for Chrome), not from stupidPDF. That download carries no document data, and it is the browser’s, so it follows the browser maker’s terms.
Fonts for text beyond Western European letters (Greek, Cyrillic, symbols such as ✓) work the same way. The first time a tool needs one, it is downloaded from www.stupidpdf.com. The request names the font file, never your document or its text.
Documents you open in a tool
Drop a file, or type text, and the work happens in the page you already loaded. PDF work runs in the browser, including in a web worker, using libraries that ship with the site. The finished file is held in memory so you can download it. Closing the tab drops that memory.
stupidPDF has no document database, no project history on a server, and no inbox of customer files.
If a PDF is encrypted, the page asks for the password in a dialog on your device. That password is used to open the file locally and is kept in memory until you close the tab, so other tools can open the same file without asking again. It is not written to the server and it is not saved in browser storage.
Passwords you set in Encrypt, Unlock, or a Workflow encrypt step stay in the page for that run. They are applied in the browser. They are not sent to stupidPDF.
Information that stays on the device
Resume text is saved in this browser under the key stupidpdf-resume after you download a resume PDF. The saved fields are layout, name, contact, summary, experience, and education. The next visit to /resume on that browser can refill the form. Another device does not receive it.
The AI tool can store a Gemini API key in this browser under the key stupidpdf-gemini-key, and only if you check “Save key in this browser”. Unchecking that box removes the key from local storage right away.
If you dismiss the install prompt, the browser stores stupidpdf-install-dismissed so the prompt stays closed. That value is only a flag.
OCR remembers the Reader you picked (stupidpdf-ocr-reader) and that you answered Not now to the built-in AI download (stupidpdf-ocr-ai-not-now). Both are short settings, not document data.
A service worker may cache the site’s own files (the app shell, scripts, icons, and, after first use, the OCR engine, the languages you used, and the fonts your text needed) so a later visit works offline. That cache is the website, not your PDFs.
You can remove all of the above by clearing site data for stupidpdf.com in the browser.
When information leaves the device
AI (/ai). This tool is the one that sends document text to a third party. You type your own Gemini API key. The page extracts text from the PDF on the device, then sends that text and your prompt to Google at generativelanguage.googleapis.com, model gemini-2.0-flash, with the key in a request header. The text included is capped at 20,000 characters, and the page says so when a document was cut. A scanned PDF with no text is refused and nothing is sent. The PDF file is not the body of that request. Google receives the prompt, the extracted text, and the API key. Google’s terms and privacy policy cover that call. If you do not run AI, this request does not happen.
OCR (/ocr). Nothing leaves the device. Text that is already in the PDF is copied on the device. A scan with no real text layer is read in the browser, either by the browser’s built-in AI model (when it is installed and reads the chosen languages) or by Tesseract.js, using an engine and language files served by stupidPDF itself (see Hosting). The built-in model runs inside the browser on your device and needs no network once it is installed. The page image is recognized locally. Neither stupidPDF, the browser maker, nor anyone else receives the scan or the text. Languages in the tool are English, Spanish, French, and German.
Speech (/speech). Read aloud uses the speech feature built into the browser. stupidPDF picks a voice that runs on the device when one is installed. If the browser only offers online voices, the page says so, and the browser sends the text being read to its maker’s voice service (for example Google in Chrome). Nothing is recorded or saved.
Suggest a feature. The link opens https://forms.gle/CeczpBUdm5VTUcv57 in a new tab. That form is a Google Form. Text you submit there is sent to Google, not into the PDF tools, and stupidPDF does not store the form on its own server.
Analytics
The website loads Vercel Web Analytics from its own address (/_vercel/insights). When a page opens, it sends a page view: the page path (for example /merge), the referring page, and the browser, operating system, and device type. It sets no cookie. It does not receive your PDF, its file name, the text inside it, or a password: tool pages never put those in the address. The app shells on phones and desktops do not send page views.
Analytics is about the website, not about the document you edit. You can block it with a browser or extension that blocks that script. The tools still run without it.
Advertising
An ad slot can appear under a tool when ads are turned on for the web build and the app is not running as a native shell. The slot is labeled as an advertisement. It does not receive your files.
The current slot is a placeholder. It does not load an ad network and it does not build an advertising profile from your documents. If that changes, this page will name the network and what it receives.
stupidPDF does not sell personal information and does not share document contents for advertising.
No account and no sale
You do not create an account. The site does not ask for a name, email, or payment card to use a tool.
We do not sell personal information. We do not have a file store to rent or share with data brokers. The third parties named in this policy receive only what their section describes, and only when that feature runs.
Children
stupidPDF is a general document tool. It is not directed at children under 16, and it does not knowingly collect personal information from them. A child who uses a tool still processes files on the device. Do not type a child’s private details into the AI tool or the Suggest a feature form.
How long information is kept
Document bytes exist in the browser tab until you close it or replace them. stupidPDF does not set a server retention period for files, because it does not store the files.
Resume text, a saved Gemini key, and the install-prompt flag stay in that browser until you clear site data or, for the key, you untick “Save key in this browser”.
Host and analytics logs are kept by Vercel under Vercel’s retention, not in a stupidPDF document archive.
A Gemini request is kept by Google under Google’s retention for that API. A Google Form submission is kept by Google.
Security
The site is served over HTTPS. Keeping the file on the device is the main protection: a server breach of stupidPDF would not yield a library of customer PDFs, because that library is not collected.
You should still treat the AI key as a secret. Leave “Save key in this browser” off on a shared computer. A saved key sits in local storage and can be read by anyone who can use that browser profile.
Encrypt protects a PDF with the password you choose. Unlock removes a password you already know and saves a copy. Neither tool sends the password to stupidPDF.
Redact deletes the selected text from every page’s content and replaces the old content, then reads the result back and tells you anything it could not remove, such as text in a font it cannot edit, in form fields, or in metadata. Text that exists only in a photo or scan is not found, because the scan is not OCR. Check the downloaded file before you send it.
Your choices
Skip /ai and no document text is sent to Gemini. OCR downloads its engine and language files from stupidPDF only when a scan needs them, and never sends the scan anywhere. Set OCR’s Reader to Tesseract, or answer Not now, and the browser’s built-in AI model is not downloaded or used.
Clear site data for this host to delete the resume draft, a saved API key, and the install flag.
There is no account to delete and no server file to request, because those records are not created. A privacy question can be sent through the public Suggest a feature form. That form is operated by Google. It is not a private inbox stored by stupidPDF.
Visitors in other countries
People open the site from many countries. The file work they do stays on their device, so stupidPDF is not the recipient of the document.
Where a feature does send data, the recipient is the one named above: Vercel for hosting and page-view analytics, Google for an AI call you start and for the Suggest a feature form, and the browser’s voice service when read aloud has only online voices. Those parties may process that data in the United States or other countries where they operate.
This page is the notice of those purposes. We do not use document contents to make automated decisions about you. The site does not ask you to create a profile.
Changes
This policy was published on 28 September 2026. If a tool starts sending data somewhere new, this page will be updated in the same change and the date will move. The home page and the tool screens are separate from this policy.