Privacy Policy

1. Overview

OxygenPDF ("we", "us", or the "Service") is a privacy-first PDF toolkit. This Privacy Policy explains what information we collect, why we collect it, and how we handle it across our website and our iOS app. The default is simple: your documents are processed on your own device and are not uploaded anywhere. A small number of features you choose to turn on are the exception — they send document data off your device, and section 3 names each one so you can tell the difference before you use it.

The data controller responsible for your information is Muhammad Habib Rohman, an independent developer operating OxygenPDF from Indonesia.

2. Information We Collect

We keep collection to the minimum needed to run the Service. These are the only categories of personal data OxygenPDF collects, and each one exists either to operate your account or to understand how the product is used:

• Account email address: When you create an account or sign in, our authentication and backend provider (Convex) stores your email address so it can sign you in, attach your plan and settings to your account, and keep your session secure. It is linked to your identity and used for app functionality, not for advertising or cross-app tracking.
• Account user identifier: Convex also stores a unique identifier for your account so it can associate your documents, conversations, entitlements and settings with you rather than with someone else. It is linked to your identity and used for app functionality.
• Product interaction: With your consent, PostHog records which tools and features you open so we can see what is used and fix what is not. This is linked to your account and user identifier, is used only for our own product analytics, and is never used to track you across other companies’ apps or websites.
• Other usage data: The same consented analytics stream carries supporting usage data such as page views, session context and captured errors. It is linked to your account, used only to understand and improve the Service, and never sold or used for cross-app tracking.

Preferences such as your interface settings and theme are stored on your device (in the browser, or in the iOS app’s local preferences). They stay on your device and are used only to remember your choices, so they are not listed above as collected data.

3. On-Device by Default, Cloud AI Only When You Opt In

Every standard PDF tool — merge, split, compress, convert, edit, sign, protect, redact and the rest — runs on your device, in your browser or in the app. Those tools do not upload, store, transmit, or retain your documents or their contents, because there is no server involved: the engines are shipped to your device, the file is read from local storage into that tab’s memory, transformed there and written back out as a download.

A small number of features are different, and none of them is required to use a PDF tool. Each is one you choose to turn on, and each sends document data off your device:

• Chat with PDF: When you start a chat, the whole document is uploaded to Convex cloud storage. From there it is sent to Mistral for OCR and to Mistral Large to answer your questions; longer documents also use OpenAI embeddings for retrieval, and the visual export options send page images to Replicate-hosted vision models. The document remains in cloud storage so the conversation can still cite it later.
• Cloud OCR engines: In the OCR tool, the Tesseract engine runs on your device. The engines labelled "Cloud" (Surya, GOT-OCR, Text Extract and Your model) send page images through our server to Replicate for processing, using the Replicate API token you provide. Your model additionally sends the model slug, version, image field and prompt you enter. Those pages leave your device only for the extraction you asked for.
• Cloud library (Pro): If you save a document to your account’s cloud library, the file is stored in Convex cloud storage so it is available the next time you sign in. Deleting it from the library also deletes the stored copy.

Signing in is also a cloud feature, though it involves no document data: it stores the account email address and user identifier described in section 2. If you never sign in and never turn on one of the features above, nothing about your documents leaves your device.

4. How We Use Your Information

We use the information described above to:

• Provide, maintain, and secure your account and the Service.
• Associate your plan, entitlements, and settings with your account.
• Understand product usage and diagnose issues so we can improve the Service.
• Respond to your support requests and communicate with you about the Service.

5. Third-Party Services

We rely on a small number of trusted providers to run the Service:

• Convex — Provides authentication and backend infrastructure, stores your account email address and user identifier, and stores in its cloud storage the documents and page images you upload to a cloud feature.
• PostHog — Provides product analytics for the usage data described above.
• Mistral AI — Performs OCR and generates answers for Chat with PDF, processing only the document and page content you give that feature.
• OpenAI — Generates the embeddings used to search longer documents in Chat with PDF.
• Replicate — Hosts the vision models behind Chat with PDF’s visual exports, and the cloud OCR engines in the OCR tool when you supply your own Replicate API token.
• Polar — Processes purchases made on our website.
• Apple and Google — Process in-app purchases made through a mobile app store (the App Store or Google Play). Payment card details are handled entirely by the payment processor; OxygenPDF never receives them and does not collect or store your full payment card information.

These providers process data on our behalf under their own terms, and only for the purposes listed. We do not sell your personal information, and payment card details never reach us.

6. No Tracking or Advertising

OxygenPDF does not track you across other companies' apps or websites, and does not use your data for third-party advertising. On iOS, we do not use the Advertising Identifier (IDFA) and we do not present the App Tracking Transparency (ATT) prompt, because we do not perform this kind of tracking.

Product analytics is consent-gated on every platform, the web and the iOS app alike. PostHog does not initialize until you accept, declining leaves the Service fully usable, and the tool pages never depend on it.

7. Data Retention

We retain your account information for as long as your account is active, and analytics data for as long as it is useful for understanding and improving the Service. A document you upload to a cloud feature — Chat with PDF, or the Pro cloud library — is kept in Convex cloud storage so that feature keeps working: a chat can still cite the page it answered from, and a library file is there the next time you sign in. Deleting a file from your cloud library deletes its stored copy. You can also ask us to delete your account and associated data, including any uploaded documents, as described below.

8. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, export, or delete the personal information associated with your account. To make a request, or to delete your account, contact us at support@oxygenpdf.com.

9. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. International Users and Governing Law

This Privacy Policy is governed by the laws of Indonesia, without regard to its conflict of law provisions. If you access the Service from outside that jurisdiction, you understand your information may be processed where we and our providers operate.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Your continued use of the Service after a change takes effect means you accept the updated policy.

12. The browser extension

The extension fetches the PDF you are looking at using your own browser session, hands it to a new OxygenPDF tab, and stops. The file never reaches a server, ours or anyone else’s.

• What it reads: The address of the tab you used it on, and the PDF at that address — including a PDF on your own machine, if you turn on your browser’s file-access switch. Nothing else on the page, and nothing until you ask.
• Where the file goes: Into your browser’s own storage for the seconds it takes to reach the OxygenPDF tab, then it is deleted. Anything a handover leaves behind is cleared within ten minutes.
• What we collect: Nothing. No analytics, no counters, no account, no error reporting. The extension makes no request to us at any point.
• What it remembers: The tools you pin in the popup, stored on this machine. Not synced, not sent anywhere, and gone if you remove the extension.
• What it never does: It does not run on pages you have not used it on, and it never reads what you are browsing.

What it asks for, and why

• activeTab: Read the address of the tab you used it on, so it knows which PDF you mean.
• contextMenus: Add one item to the tab’s right-click menu.
• scripting: Look for a PDF on the page you used it on, and show the result there.
• storage: Hold the PDF for the few seconds it takes to reach the OxygenPDF tab.
• alarms: Delete anything left behind if a handover never completes.
• offscreen (Chrome only): Download the file somewhere the browser will not interrupt part way through.
• Access to the site you are on: A PDF that only exists for your signed-in session has to be read from that site. The extension asks the first time it needs to, and names the site it is asking about. Turning it down leaves everything as it was.
• Access to local files: Opening a PDF that is already on your machine needs your browser’s own file-access switch, which is off by default and can only be turned on by you. The extension points you at it and reads nothing on disk until you do. Files you open this way are handled exactly like any other: held for seconds, then deleted.