Privacy policy

Who is responsible for your data

PDF Reword is run by LLC NextForge, which decides how your personal information is used and is accountable for it. For any question or request about your data, write to support@pdfreword.com. This address also reaches the person in charge of the protection of personal information (Quebec).

What we collect

• Your account email and password. The password is stored only as a strong hash (argon2id); we never know it.
• The account’s plan (Week Pass or Pro), its term and who gave it. If you asked to hear about the paid plans, that wish and when: we write once, when they come, and you can take the wish back in the same place.
• If you sign in with Google: the ID of your Google account and the email Google has verified. Google may also send your name and profile picture; we do not keep them.
• The documents you open, their versions and edits, the images you insert, and the names of your documents and folders.
• The signatures and seals you save: the images and any names, company names or tax and company ID numbers you type into them.
• The email addresses of the people you share a document with, and their role.
• Technical data: the full IP address a request comes from, browser type, the time and address of the request, the server’s response and the request ID.
• Where you are signed in: for each sign-in, the browser and system, the address without its last part, how you signed in (password or Google), and when you signed in and were last active; and a random ID of each browser you signed in from (in the pe_device cookie; we keep only its hash).
• If you turn on two-step verification: the secret of your authenticator app, encrypted, and the recovery codes, as hashes we cannot read back; while a sign-in waits for its code, the account, how you signed in, a hash of that sign-in’s token, the browser and system, the address without its last part and the page’s language (to email you if the code never comes); when the last such email went.
• If you press “Reword” or “Translate”: the text of the paragraphs being reworded or translated and your instruction, only while the AI writes the suggestion. We do not keep them; the server log holds only their length.
• Error reports from the editor in your browser: the error message, the page without its address parameters and the editor version. Document content never goes into them.
• Anonymous counters: how many times a day the home page or a tool page was opened, a file was chosen, a document was opened, a first edit was made, an account was created and a document was downloaded, and for a page of the site that was opened, which page it was and where the visit came from in one word (search, social, direct, campaign tag); for a new account, where it was offered in one word (download, print, “My documents”, sign-in); how many times a task (sign, merge and so on) was picked in “My documents”; how many paragraphs were changed and where their text came from in one word (typed, replaced by search, an AI action such as fix, shorten or translate), how many paragraphs the AI wrote a suggestion for, and in how many documents its text was applied; how many times the note about the paid plans was shown and why in one word (download, print, export, AI and so on), and how many times someone asked to hear about them. A counter does not know who it was: no cookies, no IP address, no identifiers. A browser with Global Privacy Control or Do Not Track turned on does not send them; new accounts, changed paragraphs, AI suggestions and requests to hear about the plans are counted by the server itself when they happen, likewise with nothing about the person or the document.

Why we use it

• To provide the service: open, edit, save and return your document, and show it to the people you shared it with.
• To reword a paragraph or translate a document with AI when you ask for it (“Reword”, “Translate”).
• To send account emails: email confirmation, password reset, notices about a document shared with you and about an email change.
• To protect the service and its users: limit request rates, find and fix failures, investigate abuse and attacks through server logs, show in your account where you are signed in, and email you when someone signs in from a new device.
• To see from the anonymous counters at which step people struggle, and make the service better.

We collect only what these purposes need and use it only for them. By creating an account and using the service, you consent to this use; you can withdraw your consent at any time by deleting your account. We do not sell your personal information, do not share it for cross-context behavioral advertising, do not show ads, and do not use your documents to train AI models.

Cookies, browser storage and Do Not Track

We set only the cookies the service needs to work: pe_session (signing in to an account) and pe_guest (documents without an account), both for up to 30 days, and pe_device: a random ID of a browser you signed in from, so we recognize it the next time (it lasts 400 days and is set only when you sign in). Page scripts cannot read them. While you sign in with Google, pe_oauth or pe_onetap is added for 10 minutes to protect the sign-in from forgery. If you turned on two-step verification, pe_mfa holds a sign-in waiting for its code, for up to 5 minutes. A visitor who is not signed in may be shown Google’s sign-in prompt (One Tap) in the editor and on the home page: the browser then loads Google’s script and talks to Google directly, under Google’s terms. Once you are signed in, Google’s script is not loaded. Browser storage keeps interface settings: language, theme, panels, the finished tour and a paragraph draft. There are no analytics or advertising cookies. We honor Global Privacy Control and Do Not Track: with either signal on, the browser sends no counters, and we do not track you across other sites in any case.

How long we keep it

• Documents without an account: up to 24 hours after the last action with them, then they are deleted.
• Account documents: until you delete them. Deleted documents stay in the trash for 30 days, then they are gone for good.
• Your account: until you delete it in the account settings.
• Sign-in details (browser, address, times): while the sign-in lasts, up to 30 days, or until you sign out on that device. The hash of a browser ID: as long as the account exists, but no longer than 400 days after the last sign-in from that browser.
• Two-step verification, if you turn it on: until you turn it off or delete the account. A sign-in waiting for its code: up to 15 minutes (5 for the code and 10 more for you to come back with it before we email you about a sign-in without the code). When the last email about a sign-in without the code went: one day.
• Backups are encrypted and kept in a separate store; deleted data disappears from them within 35 days.
• Server logs (the full IP address, time, address and ID of each request) have a fixed size: new records push out the oldest, so a record is kept until a newer one overwrites it. We read the logs only to investigate failures and abuse.
• What the AI (Reword, Translate) cost against your plan’s limit: a sum in fractions of a dollar under the account ID. Kept until the end of the calendar month and one more day.
• Our record of what the service’s administrators did with an account or a document (blocking, a changed email, quota or plan, a document opened at your request or on a complaint, a deletion), with the account’s email and the reason: one year, also after the account is deleted, so we can answer for those actions.

Who we share it with

Only with the providers the service cannot run without: server hosting, a network that delivers the site and protects it from attacks, an email service for account emails, and backup storage. They act as our service providers: they process the data on our instructions and may not use it for themselves. Their servers may be outside your state, province or country, so your data may be processed under the laws of another country, where courts and authorities may be able to access it. We will send the current list of providers and where they process data on request to support@pdfreword.com. If you choose to sign in with Google, Google (Google LLC) receives from your browser what the sign-in needs and handles it under its own privacy policy; from Google we receive only your Google account ID and email. If you press “Reword” or “Translate”, the text of those paragraphs and your instruction are sent to Anthropic (Anthropic, PBC, USA), whose Claude model writes the suggestion or the translation. Anthropic processes them as our service provider under its commercial terms: it does not train its models on them and keeps them only for a limited time to provide the service and prevent abuse. We disclose data to government authorities only when the law requires it.

Categories of personal information (California)

• Identifiers: email address, IP address, and your Google account ID if you sign in with Google.
• Customer records: the names, company names and ID numbers you type into signatures and seals.
• Internet or other network activity: request times, browser type, error reports, and the browsers and devices you signed in from.
• Sensitive personal information: your account sign-in (email and password), and whatever the documents you upload contain. We use it only to provide the service you asked for, which the law allows without a “limit the use” option.

We collected these categories in the last 12 months from you and your browser, for the purposes above, and disclosed them only to the service providers above. We have not sold or shared any of them, and we have no actual knowledge of selling or sharing the data of consumers under 16. We do not collect precise geolocation and do not draw inferences or build profiles about you.

Your rights

• Know what personal information we hold about you and get a copy: “Account” → “Download my data” gives you all your documents, signatures and account data in one archive.
• Correct it: change your email and password in the account settings.
• Delete it: documents in “My documents”, the account with everything in it in the account settings.
• Opt out of the sale or sharing of your personal information, targeted advertising and profiling. We do none of these, so there is nothing to opt out of; a Global Privacy Control signal is honored all the same.
• Withdraw your consent, or object to or restrict the processing of your data.
• Not be treated differently for using any of these rights.

For anything the account settings do not cover, write to support@pdfreword.com from your account email, so we know the request is yours; an authorized agent can write for you with your signed permission. We answer within 30 days (45 days under the CCPA) and tell you if we need more time and why. If we decline a request, you can appeal by replying to our answer; we decide on an appeal within 45 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner (in Quebec, the Commission d’accès à l’information), to the California Privacy Protection Agency, or to the attorney general of your state.

Security

The site works only over HTTPS. Document storage cannot be reached from the internet directly: only the server hands out files, after it checks that they are yours or shared with you. Backups are encrypted with a key that is not on the server. If a breach of your data creates a real risk of significant harm to you, we will tell you and the regulators as the law requires.

Children

The service is not meant for children under 14, and we do not knowingly collect their personal information. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

We will tell you about significant changes in advance by email or on the site. The effective date is at the top of this page.