Privacy Policy

This policy describes how ME & MY PDF handles information for the current product: anonymous PDF and JPEG processing in a browser, without user accounts. The service is operated by Atiq Ur Rehman. For privacy questions, contact Atiq.dev@hotmail.com.

Effective date: 11 September 2026.

Who operates this service

The operator of this service is Atiq Ur Rehman. For this service, the governing jurisdiction is Pakistan.

Information handled

ME & MY PDF does not require an account. The application handles the following in the course of processing a job.

Uploaded files

You may upload PDF files, and JPEG/JPG images on JPG to PDF. Those file bytes are stored only so the job can run and so you can download a result. Original filenames are kept as display metadata (truncated and stripped of control characters). They are not used as filesystem paths.

Job metadata

The application stores job records such as a job identifier, tool name, status, file sizes, timestamps, error codes, and similar operational fields. File contents are not stored in the database.

Browser and session information

An anonymous session remembers which jobs this browser created. The session is used to authorize status checks and downloads for those jobs. The application also uses a CSRF token to protect form and API requests from this site. There is no analytics or advertising system in this version, so this policy does not describe advertising cookies or profiling.

Access tokens

When a job is created, the application issues an opaque access token to the creating browser. A hashed form of that token is stored with the job. The plaintext token is not stored in the database and is not included in job status responses. Status and download require both the creating session and a matching token.

Operational logs

Server logs may include job identifiers, tool names, byte sizes, durations, attempt counts, and error categories. Logs are not intended to include file contents, PDF passwords, or Protect PDF secret envelopes.

This policy does not claim collection of names, billing details, marketing profiles, or account passwords, because those features are not part of the current product.

File processing

Files are uploaded so they can be processed by the selected tool. They are kept outside the public web root. Processing runs on this application’s private worker infrastructure, separate from the web request that accepted the upload. Results are not intentionally published as guessable public file URLs. Downloads are streamed after authorization checks.

These controls reduce accidental exposure. They are not an absolute guarantee against every form of misuse, misconfiguration, or attack.

Uploaded documents are processed to provide the tool you requested. They are not used to train machine-learning models in this product: OCR and AI features are not included.

Retention and deletion

Uploaded files and processing results are automatically deleted according to the service's current retention setting, which is currently 3600 seconds (one hour) . A scheduled cleanup process runs periodically, so deletion is not necessarily instant at the exact end of the retention period.

After files are removed, job metadata such as status, sizes, and error codes may remain. This policy does not claim that operator backups, if any exist, are automatically deleted, because backup handling is not documented as an automatic product feature.

If you need to ask about a file you uploaded, contact Atiq.dev@hotmail.com or use the Contact page.

Protect PDF

Protect PDF sends the password you enter so the worker can encrypt the PDF with AES-256. The password is not stored in PostgreSQL. It is not returned in API status responses.

The current job transport may temporarily carry that password in a private Redis message until the worker processes the job. Production deployments must restrict Redis so untrusted users cannot read those messages (localhost or an equivalent private network; authentication if Redis is not local).

You are responsible for remembering the password. This service cannot recover it.

Sessions and access

There are no user accounts in this version. Jobs are anonymous. The creating browser session owns the job list. Another browser without that session cannot download the result, even if it knows the job identifier, unless it also has the access token — and the application still requires session ownership.

Cookies currently used for the site to work:

• A session cookie (HttpOnly, SameSite=Lax) so the server can recognize this browser’s jobs. Production HTTPS deployments must mark that cookie Secure.
• A CSRF cookie so the browser can send trusted requests to this same origin.

There is no cookie-consent banner in this version because there are no analytics or advertising cookies to disclose beyond what is required for the service to function. Consent handling must be revisited before any third-party analytics or advertising is added.

Security

Current safeguards include private storage outside the web root, access-controlled downloads (session plus access token), input size and type limits, rate limiting on job creation, and worker isolation (HTTP handling is separate from PDF processing; workers do not bind a public HTTP port). The production service is served over HTTPS.

No service is 100% secure. You should keep your own copies of important files.

Third-party services

Document processing is performed by this application’s own HTTP layer and private workers. Uploaded files are not sent to a third-party conversion, OCR, or AI API.

This version does not use analytics, advertising, or payment processors. This policy does not list vendors that are not part of the current product.

Children’s privacy

ME & MY PDF is a general-purpose document tool. It is not directed at children. The application does not collect age. If you believe a child uploaded files here, contact Atiq.dev@hotmail.com or use the Contact page.

Changes

This policy may change as the product changes. The effective date shown above identifies the current version. Continued use after a posted change means the updated policy applies to later use of the service.

Contact

Questions about this policy can be sent to Atiq.dev@hotmail.com.