Last updated: August 30, 2026
ACE PDFMD ("we", "us", "the Site") provides free and paid PDF, image, and Markdown tools at acepdfmd.com. This policy explains what happens to your files and your data when you use the Site.
Many tools on this Site (page organizing tools such as Merge, Split, Rotate, Crop, Organize, Extract, Watermark, Page Numbers, Delete Pages, Flatten PDF, and JPG to PDF, among others) run entirely inside your browser using JavaScript. Your files never leave your device for these tools โ there is no upload, no network request containing your file, and no server-side copy, ever.
Other tools (conversions, OCR, compression, and similar advanced operations) require server-side processing. For these:
/tmp, an
ephemeral, in-memory filesystem that is never persisted to disk and is wiped whenever
the server instance restarts.Pro subscriptions are processed by Lemon Squeezy, who acts as the Merchant of Record for all paid transactions on this Site. When you upgrade to Pro, you are taken to a secure Lemon Squeezy checkout page (or overlay) โ your card number, billing address, and other payment details are entered directly into Lemon Squeezy's systems and are never transmitted to, processed by, or stored by ACE PDFMD. We only receive a webhook notification confirming your subscription status (active/cancelled) and the email address you checked out with, so we can grant Pro access to your account.
This Site groups cookies and equivalent browser storage into three categories. Only the first is on by default โ the other two require your explicit opt-in.
Most of what this Site stores is not a cookie. Your settings are
kept in your browser's own localStorage, which never leaves your device
and is never sent to our servers with a request. The entries we write are:
acepdfmd_cookie_consent_v2 (the consent choice recorded below),
acepdfmd-theme (light/dark), acepdfmd_lang (interface
language), acepdfmd_user and acepdfmd_token (your sign-in
session, only if you have an account), and pdftools_pending_job (a
reference to a conversion still running, so a page reload does not lose it). You can
clear all of them at any time from your browser's site-data settings; the effect is
the same as clearing cookies. Where this policy says "cookies" below, it means
cookies and this local storage together.
ace_anon_id, a random anonymous
identifier set for visitors who are not logged in) used to enforce fair-use limits and prevent
abuse; payment processing cookies set by Lemon Squeezy during
checkout (needed to complete a purchase โ see below); and security /
anti-bot cookies (for example a reverse-proxy/CDN bot-mitigation cookie
such as Cloudflare's __cf_bm, and CSRF-protection tokens where used) that
protect the Site and its users from abuse. None of these are used for advertising or
cross-site tracking, and they cannot be disabled โ the Site cannot function or stay
secure without them.Lemon Squeezy (our payment processor and Merchant of Record) may also set its own cookies when you visit its checkout pages directly, governed by Lemon Squeezy's Privacy Policy.
Global Privacy Control (GPC). If your browser or a browser
extension sends a Global Privacy Control signal (the Sec-GPC: 1 request
header, exposed to the page as navigator.globalPrivacyControl), we treat
it as a standing opt-out of advertising and of any "sharing" of personal information
for cross-context behavioural advertising โ automatically, on every page, with no
banner to click. Advertising cookies stay off for as long as the signal is present,
and turning them on is not offered while it is: choosing "Accept All" still records
advertising as off. GPC is an advertising opt-out and not a general consent signal, so
it does not by itself switch off first-party analytics; you can decline those
separately with the controls described here.
You can control or clear cookies in your browser settings at any time. A consent prompt is shown on your first visit with three clear choices: Accept All, Reject Non-Essential, or Customize (individual toggles for Advertising and Analytics) โ we do not default optional categories to "on" and make you dig for a way to turn them off. Where a certified IAB TCF v2.2 consent platform is active instead (see above), that platform's own popup and preference controls apply, and generally provides more granular, geography-aware choices (for example, showing the prompt only where required and not to visitors in jurisdictions where it isn't). Either way, you can change your choice at any time using the persistent cookie-settings button on the page or the Cookie Preferences link in the site menu.
Sign-in is handled by Firebase Authentication (Google). Your password is set and checked there, in your browser, and is never sent to our servers -- so we do not store it, hashed or otherwise. What we hold against an account is your email address, whether the account is Pro, the customer id Lemon Squeezy issues on a paid subscription, and the date the account was created: enough to operate the account and enforce usage limits, and nothing else.
Firebase Authentication is operated by Google LLC, which acts as our data processor for sign-in: it stores your email address, the password verifier it derives in your browser, and the sign-in metadata it needs (last sign-in time, email verification state, and the anti-abuse signals Google applies to authentication requests). It processes that data only to provide authentication to us, on our instructions, and not for its own purposes. Google's handling is described in Google's Privacy Policy and governed for our use by the Firebase Data Processing and Security Terms. We do not sell your personal information, and we do not share it with third parties for advertising or marketing.
We keep each kind of data only as long as the job it does requires, and the periods are enforced by automatic expiry rather than by anyone remembering to run a cleanup:
ace_anon_id, the random value used to apply fair-use limits to visitors
without an account, expires 30 days after its last use. It is not linked to your
identity and is not used for advertising.We are the controller of the limited personal data described in this policy. The providers that process it on our behalf do so as processors under a written contract that meets the requirements of Article 28 of the UK/EU GDPR โ including obligations to process only on our documented instructions, to keep the data confidential and appropriately secured, to engage sub-processors only under equivalent terms, to assist us with data-subject requests and breach notification, and to delete or return the data at the end of the service. Each provider's terms are public:
International transfers to these providers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated into the terms linked above. If you would like a copy of the data- processing terms that apply to your data, email [email protected].
Depending on your location, you may have rights under GDPR, CCPA/CPRA, or similar laws to access, correct, or delete your personal data (including a right to be forgotten). To exercise these rights, email [email protected] and we will act on verified requests within the timeframe required by applicable law. We will not discriminate against you (for example, by denying service, changing pricing, or providing a different quality of service) for exercising any of these rights.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (โCCPA/CPRAโ), gives you the rights described below with respect to your personal information.
Categories of personal information we collect. In the preceding 12 months we have collected the following categories of personal information, as defined by Cal. Civ. Code ยง1798.140:
ace_anon_id) for visitors who are not logged in.We do not collect sensitive personal information (as defined by the CPRA, e.g. government ID numbers, precise geolocation, or health data), and we do not use or disclose sensitive personal information for purposes beyond what the CCPA/CPRA permits without opt-in โ so there is nothing to limit here, and no separate โLimit the Use of My Sensitive Personal Informationโ control is needed.
We do not sell personal information for money. However, under the CPRA's broader definition, enabling Google AdSense's cross-context behavioral advertising cookies (an opt-in choice โ see Section 4) may be considered โsharingโ personal information with an advertising partner. You can exercise your right to opt out of this sharing at any time, with no need to create an account or verify your identity, in any of these ways:
None of these routes asks you to create an account, verify your identity, or confirm twice, and using one never degrades the service you get.
Your CCPA/CPRA rights. Subject to certain exceptions, you have the right to: (1) know what personal information we have collected about you and how it has been used and disclosed; (2) delete personal information we have collected from you; (3) correct inaccurate personal information we maintain about you; (4) opt out of the sale or sharing of your personal information (see above); and (5) not be discriminated against for exercising any of these rights. To submit a verifiable request to know, delete, or correct, email [email protected] from the email address associated with your account (this is how we verify the request is really yours); we will respond within 45 days as required by law, with one possible 45-day extension if reasonably necessary. You may also designate an authorized agent to make a request on your behalf by having them contact us at the same address with written proof of your authorization.
This Site is not directed at children and is not intended for use by anyone under 13 years of age (or the minimum age of digital consent in your jurisdiction, if higher). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.
You are solely responsible for the files you upload or process using this Site's tools, and must have the legal right to do so. If you believe content processed, stored, or displayed through the Site infringes your copyright, send a notice (identifying the work, the allegedly infringing material, and your contact information) to [email protected]. Because server-processed files are deleted automatically within the ephemeral-storage window described in Section 2, most reported material will already be gone by the time a notice is received; we will still review and act on requests as appropriate, including for any surviving account or log data.
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.
Questions about this policy? Email [email protected].