Privacy

Effective 21 September 2026. bakepdf is operated by Oktobar (“we”), the controller of the data described here.

The short version. Almost every tool on bakepdf runs inside your browser. Your PDFs are not uploaded, not queued, not converted on a server and not deleted an hour later — they are never in our possession at all. There is no promise to keep here, only an architecture.

What we do hold

• Your account. Email address and a PBKDF2 hash of the proof your browser derives from your password — never the password itself. Kept until you ask us to delete the account.
• A counter. How many documents you have used today, or this month on a paid plan, and how many AI turns and model tokens. Not which tool, not which file, not what was in it.
• Files you deliberately save — encrypted, and not by us. Only when you press “Save to my library”. Before anything is uploaded, your browser encrypts the file and its filename with AES-256-GCM, using a key derived from your password that never leaves your device. What sits in Cloudflare R2 is ciphertext we cannot open. Files stay for the retention period of your plan, and for thirty days after a plan lapses so you can pull them out. See how that works, including what it does not protect you from.
• A salted hash of your IP, and a random name your browser gives itself, for signed-out visitors, so the three free documents a day mean something. The name is a random value in localStorage — not a fingerprint: nothing about your device is measured, so it cannot follow you anywhere else, and clearing your browser data deletes it. Both are hashed before they are stored, thrown away after forty days, and cannot be reversed into an address. Signing in replaces both with your account.
• Your plan. The Polar customer and subscription ids, the plan, its status and when the period ends. Never a card number — we do not see one.

The AI tools are the exception

Chat with PDF, Summarize and OCR cannot run locally, because they need a language model. For those three, the text extracted from your document — or, for OCR, images of the pages — is sent through our Worker to OpenRouter, which routes it to a model provider. We do not train on it and we do not keep it; the provider’s own retention policy is theirs, and if a document is sensitive enough for that to matter, do not use those three tools on it. Every other tool on the site is unaffected.

What “we cannot read it” means, precisely

One PBKDF2 pass over your password produces 64 bytes. The first half wraps your library’s encryption key and stays in your browser; the second half is sent to us as proof of who you are. They are independent halves of the same output, so the proof we store tells us nothing about the key. A recovery code, shown once at signup, wraps the same key a second time — we keep a hash of that code, never the code.

The consequence is real and we will not dress it up: if you forget your password and lose your recovery code, your library is gone. Not withheld — gone. We have nothing to recover it with.

Signing with your phone is the other exception

If you scan the QR code in the signature panel, the drawing your phone makes has to reach the computer somehow. It is posted to a single-use record in our database, held for at most fifteen minutes, and deleted the moment your computer collects it. It is a PNG of a signature and nothing else — the document it will be placed on never leaves your machine. Signing with a mouse or a stylus does not touch our servers at all.

Who else touches the data, and why

Each of these processes data on our instructions, for one purpose, and gets only what that purpose needs:

• Cloudflare runs the site, the database and the file storage, and sees every request the way any host does.
• Polar is the merchant of record for payments. It receives your email address when you open a checkout, and holds the card.
• Resend delivers the few emails we send, so it sees your address and the message.
• OpenRouter and the model provider it routes to receive the text or page images you send to the three AI tools.
• OriginStat counts page views. No cookies, no cross-site tracking, and no identifier for you: it keeps a small note in localStorage about the current visit, nothing that names you. If the analytics id is not configured, no script is loaded at all.
• Google Fonts serves the typefaces. Your browser fetches them from Google, which therefore sees your IP address the way any server you download from does. We intend to host them ourselves.

Nobody on that list is given your data for their own purposes, and your address is not sold, rented or shared beyond it.

Cookies and storage

One cookie, bp_session, and only after you sign in: it holds your session for sixty days and is marked HttpOnly, Secure and SameSite. There are no advertising or tracking cookies. localStorage holds the random device name above, the analytics note, and — while a tool page is open — your own file, so it can be handed from the front door to the tool. None of that leaves your browser except as described here.

Why we are allowed to

The account, the counter, the library and the payment records exist to provide the service you asked for. The visitor hashes and the rate limits exist to keep a free service free, which is our legitimate interest and costs you nothing identifiable. Mail about your account is part of the service; there is no marketing mail to consent to.

Your rights

Wherever you are, you can ask us what we hold about you, have it corrected, get a copy of it, or have the account and everything attached to it deleted — write to support@bakepdf.app from the account’s address and it is done within thirty days. Files in your library you can delete yourself, at once, from the account page. If you are in the EU or UK you also have the right to object to the processing above and to complain to your data protection authority.

Age

You must be at least sixteen to create an account. The tools that need no account process nothing about you beyond the visitor hash above, so they are open to anyone.

Mail we send

When you sign up: one link to confirm your address, and one welcome note. After that, only what your account needs — a receipt, a failed payment, a change to these terms. Everything comes fromnoreply@bakepdf.app and replies land at support@bakepdf.app. There is no newsletter and no product mail.

Changes

When this page changes, the date at the top changes with it. If a change affects what we hold or who we share it with, account holders hear about it by email first.