Privacy

The short version. Almost every tool on bakepdf runs inside your browser. Your PDFs are not uploaded, not queued, not converted on a server and not deleted an hour later — they are never in our possession at all. There is no promise to keep here, only an architecture.

What we do hold

• Your account. Email address and a PBKDF2 hash of your password. Nothing else, and no email is ever sent to it except when you ask us to.
• A counter. How many documents you have used today, or this month on a paid plan, and how many AI turns. Not which tool, not which file, not what was in it.
• Files you deliberately save — encrypted, and not by us. Only when you press “Save to my library”. Before anything is uploaded, your browser encrypts the file and its filename with AES-256-GCM, using a key derived from your password that never leaves your device. What sits in Cloudflare R2 is ciphertext we cannot open. See how that works, including what it does not protect you from.
• A salted hash of IP and browser for signed-out visitors, so the three free documents a day mean something. It is thrown away after forty days and cannot be reversed into an address.

The AI tools are the exception

Chat with PDF, Summarize and OCR cannot run locally, because they need a language model. For those three, the text extracted from your document — or, for OCR, images of the pages — is sent through our Worker to OpenRouter, which routes it to a model provider. We do not train on it and we do not keep it; the provider’s own retention policy is theirs, and if a document is sensitive enough for that to matter, do not use those three tools on it. Every other tool on the site is unaffected.

What “we cannot read it” means, precisely

One PBKDF2 pass over your password produces 64 bytes. The first half wraps your library’s encryption key and stays in your browser; the second half is sent to us as proof of who you are. They are independent halves of the same output, so the proof we store tells us nothing about the key. A recovery code, shown once at signup, wraps the same key a second time — we keep a hash of that code, never the code.

The consequence is real and we will not dress it up: if you forget your password and lose your recovery code, your library is gone. Not withheld — gone. We have nothing to recover it with.

Signing with your phone is the other exception

If you scan the QR code in the signature panel, the drawing your phone makes has to reach the computer somehow. It is posted to a single-use record in our database, held for at most fifteen minutes, and deleted the moment your computer collects it. It is a PNG of a signature and nothing else — the document it will be placed on never leaves your machine. Signing with a mouse or a stylus does not touch our servers at all.

Payments

Handled entirely by Polar, who are the merchant of record. We never see or store a card number. We store the Polar customer and subscription id so we know which plan you are on.

Analytics

Privacy-preserving page counts, with no cookies and no cross-site tracking. If the analytics id is not configured, no script is loaded at all.

Your rights

Delete any stored file from your account page. To delete the account itself, email us and it goes, along with everything attached to it.