1. Security Architecture Overview
At PDFVintage, privacy and data security are engineered directly into the platform architecture. We operate on a zero-retention foundation: your sensitive documents belong strictly to you. This policy details how we isolate, process, and purge document data across our client-side and server-side conversion engines.
2. What Data We Collect — and What We Don't
- Document contents: never stored. Client-side tools never upload them at all; server-side tools hold them in volatile memory only for the duration of a single request.
- Account data (only if you create an account): your email address and optional display name in Firebase Authentication, plus a Firestore profile document (email, display name, creation date).
- Local preferences: your light/dark theme choice, stored in your own browser's localStorage.
We do not run advertising trackers, we do not sell data, and we do not build behavioural profiles.
3. Document Execution Model
- Client-Side In-RAM Execution: Around 40% of our 50+ tool suite (including PDF merging, splitting, rotation, page deletion/extraction/reordering, watermarking, signing, image format conversion, compression, resizing, cropping, text extraction, and CSV/JSON/images-to-PDF generation) executes 100% inside your Web browser memory using WebAssembly & HTML5 memory APIs. Your files never touch any external server.
- Document Understanding Engine (IDM AST): Our proprietary Internal Document Model parses document primitives in RAM into an abstract syntax tree. Output formats (DOCX, Markdown, HTML) are generated dynamically without permanent database records.
- Server-Side Cloud Run Processing: For heavy conversions requiring server rendering — PDF to Word/Excel/CSV/PPT/HTML/Markdown/XML/EPUB, Office and e-book formats to PDF (Word, Excel, PowerPoint, ODT, ODS, ODP, RTF, HTML, Markdown, EPUB, XML), the Tabula table-extraction engine, the Docling AI OCR suite, and PDF protect/unlock/repair/grayscale — files are transmitted over TLS 1.3 encrypted HTTPS channels directly to isolated container instances.
4. Google's Ecosystem & Third-Party Processors
PDFVintage runs transparently on Google's cloud ecosystem. This means that when a server-side tool processes your document, that processing is performed by isolated containers on Google Cloud Run (region: us-central1), your account session is handled by Google Firebase Authentication, and your account profile lives in Google Cloud Firestore. Each processor operates under its own enterprise security terms:
- Google Cloud Run & Firebase — conversion infrastructure, authentication, and profile storage (covered by the Google Cloud Data Processing Amendment).
5. Access & Payments
PDFVintage is completely free. All 8 Docling OCR tools process unlimited pages at no cost — there are no payments, page packs, credits, or subscriptions of any kind, and we never ask for a card. OCR tools simply require a free account so usage can be attributed to you.
6. Automatic 5-Minute Auto-Purge
All temporary files stored on server container storage (`/tmp`) during server-side execution are automatically destroyed and permanently purged after 5 minutes by automated container lifecycle processes. No file copies, database records, or permanent backups are retained.
7. Technical Security Safeguards
- End-to-end transport security using 256-bit SSL/TLS 1.3 encryption.
- Same-origin API proxy routing preventing browser token exposure.
- Strict memory boundaries (25 MB per file upload).
- Sandboxed execution environments per conversion job.
8. GDPR, CCPA & Australian Privacy Principles
PDFVintage strictly complies with GDPR, CCPA, the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and global data privacy standards. Because we operate under a zero-retention policy and do not profile or sell user documents, your file data remains completely private. You may request access to, or deletion of, your account data at any time by emailing us — account deletion removes your Firebase Authentication record and Firestore profile.
9. Contact & Security Inquiries
For questions regarding our security architecture or compliance documentation, contact our team at support@pdfvintage.app.