Security and privacy

PDF documents often contain personal and business data, so PDFowo is designed to keep your files on your own device. Below we explain how it works and how you can check it yourself.

Your files stay in your browser

Merging, splitting, editing, compressing and converting all run entirely in your browser. The content of your files is not sent to our server or stored anywhere, and it disappears from memory when you close the tab. The one exception is the editor autosave, which keeps a working copy only on your own computer.

Sending to your phone

The "Send PDF to phone" tool connects your computer and phone directly (WebRTC, DTLS encryption). The QR code contains a one-time key used to encrypt the connection setup data – the relay server does not know this key and never sees the file. The code only works while the page showing it is open.

Check it yourself

Open your browser’s developer tools (F12), go to the “Network” tab and use any tool. You will see that no request containing your file leaves the browser while you work. The browser only downloads the libraries the tools need, for example for text recognition or conversion.

Encrypted connection

The site is served over HTTPS (TLS) only. In addition, the browser receives security headers: HSTS (enforced encryption), protection against embedding the site in other pages’ frames, a policy restricting script sources (Content Security Policy) and disabled access to microphone and location. Only the document scanner opens the camera, and only when you choose to.

Account and payments

An account is optional — all tools work without one. We store your e-mail address and nickname with Supabase. Once you sign in, we also store your favourite tools and the signatures and tool settings you save there. Your documents themselves are never stored. Passwords are handled by the authentication provider and we cannot see them in plain text.

Third-party services

We use Cloudflare (hosting and traffic protection), Supabase (accounts), Stripe (payments) and libraries loaded from public CDNs. The hosting server sees standard technical connection data, like any website, but never the content of your files. When we show ads, we do so only after you consent. See the privacy policy for details.

Report a vulnerability

If you find a security issue, write to kontakt@pdfowo.pl. We will reply and try to fix it as quickly as possible. Please do not disclose details until it is fixed.