Privacy policy

The short version

pdf9x is a free service operated by Vinn AI Tech Solutions LLC. We collect anonymous usage analytics by default so we can keep the tools working — you can turn that off below.

Tools labeled In your browser process your file on your device. Tools labeled Cloud upload your file over HTTPS to AWS S3, run it through an isolated Lambda, and delete it within 24 hours.

We can also keep a private copy of the files you run through our tools to help us spot bugs and decide what to build next. This is off by default. The first time you visit a tool you’ll see an optional opt-in banner. If you do opt in, files are stored privately in our cloud and are never sold or shared with third parties. You can change your mind anytime with the toggle below.

What we collect

Real-time usage analytics through Google Analytics 4. The events we send are limited to:

• page_view — which page you visited, your approximate region, device type, and referrer (collected by GA4 automatically).
• tool_file_added — which tool, and the number of files added. No file names, no file contents.
• tool_process_start — which tool, the number of files, and the total size in bytes.
• tool_process_success — which tool, and the number of output files.
• tool_process_error — which tool, and the error message returned by the runner. We do not send file contents.
• tool_download — which tool, and the output file name (which is generated by us, e.g. merged.pdf).

These events are used in aggregate to spot broken tools, measure adoption, and decide what to build next. They are tied to a Google Analytics client identifier set in a cookie, not to your name, email, or any account.

Files and cloud tools

Most tools on pdf9x run entirely in your browser — the file is read into memory on your device, processed locally, and the result is written back out. Nothing leaves your device unless you explicitly opt in to research-data sharing (see “Research-data sharing” above), in which case a private copy is uploaded to our research bucket. The default is off; you can change it anytime with the toggle above.

A subset of tools require server processing (compression, OCR, document conversion, password protection, and similar). For those:

• The file is uploaded over HTTPS to AWS S3 in our account.
• An isolated short-lived AWS Lambda function processes the file.
• The result is returned via a signed download URL that expires.
• Both the uploaded file and the output are deleted within 24 hours. Paid accounts (when launched) may retain outputs up to 7 days.
• We do not inspect, index, or share file contents.

Passwords supplied to tools like Unlock PDF or Protect PDF are used once by the worker and are never written to logs or storage.

Research-data sharing (the long version)

By default we do not keep copies of the files you run through pdf9x. The first time you visit a tool you’ll see an optional banner inviting you to opt in. Click Allow if you’d like to help us improve the tools, or No thanks to dismiss it without sharing. The toggle on this page does the same thing later.

• The choice is stored only in your browser’s local storage. Clearing site data resets it (and you’ll see the banner again).
• When you opt in, uploads run alongside your tool — the tool itself never blocks on the upload.
• Shared files are used to understand which features people need and to find tool bugs. They are not sold, shared, or published.
• You can change your mind anytime with the toggle above. Switching off stops future uploads; to delete files already collected, email us at founder@vinn.ai with a date range and we’ll remove matching objects.
• Do not opt in if you process sensitive content — medical records, tax returns, government IDs, financial statements, signed contracts. See the “Sensitive data” section below for why.

Sensitive data — please don’t

pdf9x is a general-purpose consumer tool. It is not designed for, certified for, or appropriate to use with regulated or sensitive data, including but not limited to:

• Protected Health Information (PHI) under the US Health Insurance Portability and Accountability Act (HIPAA), or health/medical information under any equivalent local law
• Payment card data subject to the Payment Card Industry Data Security Standard (PCI-DSS)
• Financial-account information subject to the Gramm-Leach-Bliley Act (GLBA), Indian DPDP Act, EU PSD2, or equivalent laws
• Government-issued identification documents (passports, driver’s licenses, national ID cards, social security cards, tax filings)
• Trade secrets, attorney-client privileged material, or other data subject to a confidentiality obligation

We do not hold, and have not pursued, HIPAA covered-entity or business-associate status, SOC 2, ISO 27001, or PCI-DSS certifications. We have not signed any Business Associate Agreement (BAA). If your use case requires any of those, please use a tool that does.

By uploading a file to a cloud tool you confirm that you have the legal right to upload it and that it does not contain the categories of sensitive data listed above. We are not responsible for your decision to upload data outside this scope.

Cookies and local storage

We use a small number of browser storage entries:

• Google Analytics cookies (_ga, _ga_*) — set when analytics is on.
• Google Ads cookies — when ad campaigns are active, Google may set additional cookies to measure conversions.
• localStorage pdf9x:analytics-opt-out-v1 — your analytics opt-out choice.
• localStorage pdf9x:rnd-consent-v1 — your research-data sharing choice (granted / denied).
• localStorage pdf9x:announcement-dismissed-v2 — remembers that you closed the top announcement strip.
• localStorage pdf9x:theme-v1 — remembers a light/dark choice from the top toggle.

Third parties

We use these third-party services to operate the site:

• Google Analytics 4 and Google Ads — usage analytics and ad attribution. Governed by Google’s privacy policy.
• Amazon Web Services (AWS) — hosting, S3 storage for cloud tool uploads and (when opted in) research uploads, Lambda execution. Governed by AWS’s data processing terms.
• Google Cloud Vision — when you run OCR PDF, each page is rendered to an image on our Lambda and sent to Google Vision’s document text detection API. Google may temporarily retain the image to operate the service. Governed by Google Cloud’s data processing addendum.
• Stripe — payment processing for credit purchases. Stripe handles card data directly; we never receive your card number. Governed by Stripe’s privacy policy.
• Google Fonts — Inter Tight is served by Google. Loading the font causes a request to Google that may include your IP address.

Your rights

You can opt out of analytics or research-data sharing at any time using the toggles above. Opting out stops new events / uploads from this device. Existing records can be deleted on request — write to us at founder@vinn.ai with enough detail (approximate date, device, region) that we can find the records.

If you reside in the EU, UK, California, or another jurisdiction with data-protection laws, you have rights of access, correction, and deletion under those laws. Contact us at the same email to exercise them.

Children

pdf9x is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We update this page when our practices change. The “Last updated” date at the top reflects the most recent revision. Significant changes will also be announced in the top banner.

Contact

Vinn AI Tech Solutions LLC. Reach us at founder@vinn.ai or via our contact page.