Privacy policy
Last updated
BloomPDF is operated by Kabett (kabett.com), based in India. Kabett is the data controller for this site, and the data fiduciary under India's Digital Personal Data Protection Act, 2023. You can reach us at hello.kabett@gmail.com for anything on this page, including privacy questions and complaints.
The short version
Your PDFs and images never leave your device. Every tool on this site runs inside your browser, so there is no upload step and no copy of your file on any server of ours. We do not have accounts, so we hold no name, password or payment detail. The only personal data we handle at all is website analytics. Google Analytics runs only if you agree to it. Cloudflare's cookieless page counter runs either way, and is described below.
Your files
When you open a tool and choose a file, the file is read into your browser's memory and the work happens there, using WebAssembly and JavaScript running on your own machine. The result is written back to a file your browser downloads locally. Nothing about the file is transmitted to us: not the contents, not the filename, not the page count. Closing the tab discards it.
Because we never receive your files, we cannot read them, cannot recover them for you, and cannot hand them to anyone else.
Analytics, and your choice about it
We use Google Analytics 4 to understand which tools people use and which pages they arrive on, so we know what to build next. It is loaded only after you press Accept on the consent banner. Until you do, Google Analytics is blocked from storing anything, using Google Consent Mode with all storage signals set to denied. If you press Reject, that refusal is recorded and the tag stays blocked.
If you accept, Google Analytics sets cookies on your device and collects a limited picture of your visit.
| What | Why | How long |
|---|---|---|
_ga, _ga_<id> cookies | Tell repeat visits apart from new ones | Up to 2 years |
| Pages viewed, referring site, approximate location by country or city | Show which tools and sources matter | Up to 14 months in Google Analytics |
| Device, browser and operating system, screen size, language | Keep the site working on what people actually use | Up to 14 months in Google Analytics |
| IP address | Used by Google to derive approximate location, then discarded. Google Analytics 4 does not log or store IP addresses. | Not stored |
bloompdf-consent in local storage | Remembers whether you accepted or rejected, so we stop asking | Until you clear it |
We do not run advertising on this site, so the advertising signals stay denied even after you accept. We have not enabled Google Signals, and we do not use analytics data for ad targeting. We never sell or share personal data.
Changing your mind
Withdrawing is as easy as agreeing. Use the button below to reopen the choice at any time. Withdrawing stops future collection; it does not erase what was already gathered, though you can ask us to request that separately.
Cloudflare Web Analytics
Separately from Google Analytics, Cloudflare Web Analytics is enabled on this site. Cloudflare injects a small measurement script into every page at the edge, which reports page views and page load performance. It sets no cookies, reads nothing already stored on your device, assigns you no identifier, and does not follow you across sites.
Because it stores nothing on your device and cannot single you out, it runs without a consent prompt. That is the same distinction the consent banner rests on: permission is about storing and reading things on your device, which Google Analytics does and this does not. If you would rather it did not run at all, an ordinary content blocker will stop it, and it changes nothing about how the tools work.
Hosting and server logs
The site is served by Cloudflare from its global network. Like any web host, Cloudflare processes the technical details needed to deliver a page and to defend the site against attack and abuse, including IP addresses, request times and user agents. This happens for every visitor, including one who rejects analytics, because a site cannot be served or protected without it. We read this only in aggregate. Cloudflare's own privacy practices are described at cloudflare.com/privacypolicy.
Legal bases
Under the UK and EU GDPR, we rely on:
- Consent (Article 6(1)(a)) for analytics. This is why nothing is measured until you press Accept, and why you can withdraw at any time.
- Legitimate interests (Article 6(1)(f)) for the server logs that keep the site available and secure. Our interest is running a working site that is not abused, weighed against a visitor's interest in not being profiled. We do not use these logs to build profiles.
Under India's DPDP Act, 2023, analytics is processed on your consent, which you give through the banner and can withdraw through the button above.
Who else sees the data
Google LLC, as the provider of Google Analytics, and Cloudflare, Inc. as the host. Both are established in the United States, so accepting analytics involves a transfer of data outside the UK, EU and India. Google and Cloudflare rely on the European Commission's Standard Contractual Clauses and the EU to US Data Privacy Framework for those transfers. We share personal data with nobody else, and we do not sell it.
Your rights
Depending on where you live, you have some or all of the following rights. To use any of them, write to hello.kabett@gmail.com.
- Ask what personal data we hold about you, and get a copy.
- Have inaccurate data corrected.
- Have data erased, and ask us to pass that request to Google.
- Object to processing, or ask us to restrict it.
- Receive data in a portable form.
- Withdraw consent at any time, without affecting what was lawful before.
- Complain to a regulator: your local supervisory authority in the EU, the Information Commissioner's Office in the UK, or the Data Protection Board of India.
A practical note. Analytics data is not tied to a name or an account, so in most cases we cannot connect a record to you as a person. If you write to us, tell us roughly when you visited and from where so we have a chance of finding anything at all. You can also block collection yourself with Google's opt out add on, or by rejecting the banner.
If you are in California
We do not sell or share personal information as those terms are used in the CCPA and CPRA, and we do not use it for cross context behavioural advertising. You have the right to know what is collected, to have it deleted, to correct it, and not to be treated differently for exercising those rights. Rejecting the banner has the same effect as an opt out signal. We honour Global Privacy Control where the browser sends it.
Children
The site is not aimed at children and we do not knowingly collect data from them. There is nothing here to sign up for. If you believe a child's data reached us through analytics, write to us and we will request its deletion.
Security
The site is served over HTTPS only. The strongest protection is structural rather than procedural: because your documents are processed in your browser and never sent to us, there is no store of user files to breach.
Changes
If this policy changes in a way that affects you, the date at the top of the page changes with it. If the change is material, such as collecting something new or adding a recipient, we will ask for consent again rather than rely on the old one.