Privacy Policy

1. Who we are

This policy describes how pdftoflipbook.io (“we”, “us”) processes personal data when you use https://pdftoflipbook.io and related worker hostnames. We act as the data controller for account, hosting, security, and website-measurement data described below.

Contact: support@pdftoflipbook.io · security issues: security@pdftoflipbook.io · privacy requests: privacy request form.

2. What this service does with documents

Local preview: Opening a PDF and converting it in the browser uses Mozilla PDF.js on your device. The original PDF file is not uploaded during that preview step.

Public hosting (Share): If you create a public link, we upload the rendered page images, file name, page count, file size, and a hash of the PDF to our Cloudflare storage so anyone with the link can view the flipbook. Treat a shared flipbook as public. Do not publish documents you are not allowed to share.

3. Personal data we collect

• Account data (if you register): name derived from your email local-part or the name you provide, email address, password hash, verification status, last login time.
• Authentication data: one-time email codes and password-reset tokens (hashed), and an HTTP-only session cookie after you sign in.
• Hosted flipbooks: the page images needed to show a shared book, the file name, page count, size, and view count.
• Security: a short-lived record of the network address and browser type, usually kept for up to 24 hours, so the converter cannot be flooded.
• Technical logs: our hosting provider may record the network address, country, page requested, browser type, and time, to keep the site online and stop abuse.
• Optional cookies: cookies that measure how the site is used, and cookies that show and measure ads. In the EEA, UK, and Switzerland these stay off until you accept them. Elsewhere they are on until you turn them off.
• Privacy requests: the name, email, and message you send through our request form.

4. Why we use the data (legal bases)

Where GDPR, UK GDPR, or similar laws apply, we rely on:

• Contract — creating an account, signing you in, sending verification or reset emails, and hosting a flipbook you asked us to publish.
• Legitimate interests — keeping the service secure, rate-limiting abuse, diagnosing outages, and basic server logs. You may object; see section 9.
• Consent — optional usage and advertising cookies in the EEA, UK, and Switzerland. You can withdraw that choice at any time from Cookie settings. Elsewhere those cookies are on until you turn them off the same way.
• Legal obligation — responding to valid law-enforcement or regulatory requests, and keeping records of privacy requests.

If you are in Brazil (LGPD), Canada (PIPEDA), or another region with similar rules, we use the closest equivalent grounds: providing the service you requested, security, and legal compliance. You can reject optional cookies at any time. Where the law requires a choice first (the EEA, the UK, and Switzerland), we wait for that choice.

5. Cookies

Details, retention, and how to change your choices are in the Cookie Policy. In the EEA, UK, and Switzerland, we do not set optional usage or advertising cookies until you accept them. In other countries those cookies are on so we can measure use and show ads, and you can turn them off at any time. A do-not-track signal turns those optional cookies off. A signal that asks sites not to sell or share information turns advertising cookies off. A choice you save overrides those defaults.

6. Who we share data with

We do not sell your email list. We share data only with the services that run this tool:

• Hosting and security provider — stores the site, accounts, sessions, and published flipbook pages, and helps block abuse. Processing can happen in more than one country.
• Email provider — sends sign-up codes, password resets, and replies to privacy requests.
• Measurement and advertising partners — only if you allow those optional cookies. They may process data in the United States and elsewhere under their own terms.

A public flipbook URL is accessible to anyone who has the link. We currently set user flipbook pages not to be indexed by search engines, but that is not a confidentiality guarantee.

7. International transfers

Our hosting, email, and optional measurement partners operate internationally. Transfers from the EEA and UK use those providers' standard transfer terms. Your data may be processed outside your country, including in the United States.

7.1 Cloudflare data residency

The site runs on Cloudflare Workers. Account data, OTP tokens, and flipbook metadata are stored in Cloudflare D1 (SQLite at the edge). Published flipbook page images are stored in Cloudflare R2 object storage. Session tokens and rate-limit counters are stored in Cloudflare Workers KV.

Cloudflare may replicate this data across its global network of data centres, which includes locations in the United States, Europe, and Asia-Pacific. Cloudflare's Data Processing Addendum (DPA) and Standard Contractual Clauses (SCCs) govern transfers from the EEA and UK. For details see Cloudflare Trust Hub.

Transactional emails (sign-up codes, password resets) are sent via Resend, which processes email delivery data in the United States under its own DPA.

8. How long we keep data

• Account records — until you delete the account or we close it for abuse.
• Session cookie / KV session — until you sign out or the session expires (about 30 days).
• OTP and password-reset tokens — minutes, then marked used or expired.
• Published flipbooks — until you ask us to delete them, or we remove them for policy or legal reasons.
• Rate-limit fingerprints — up to 24 hours.
• Consent choice — stored in your browser until you clear site data.
• Privacy-request emails — as long as needed to complete the request and show we handled it.

9. Your rights

Depending on where you live (including the EEA, UK, California, and other US state laws, Brazil, Canada, and similar regimes) you may have the right to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent. California residents also have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of “sale” or “sharing” of personal information for cross-context advertising.

We do not sell email addresses. Optional advertising cookies can count as “sharing” under some US state laws. Use Do not sell or share or reject advertising cookies to opt out of that use on this site.

You can close an account from Account. Anyone can submit a request via the privacy form or email support@pdftoflipbook.io. We may need to verify you control the email. You may complain to your local supervisory authority (for example an EU data protection authority or the UK Information Commissioner’s Office).

10. EEA, United Kingdom, and Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland:

• Optional usage and advertising cookies stay off until you accept them. Reject is on the same screen as Accept. You can change that choice later from Cookie settings in the footer.
• If you allow usage measurement, that measurement can include which pages were opened and how the page was used. It does not run when you reject optional cookies.
• We do not make automated decisions that produce legal or similarly significant effects about you.
• An email and password are required only if you choose an account. You can convert a PDF without an account. Without an email we cannot open an account or send a password reset.
• We aim to reply to privacy requests within one month. If a request is complex we may take up to two further months and will tell you why.
• You can lodge a complaint with the supervisory authority in your country of residence, or with the UK ICO if you live in the United Kingdom.

11. Children

The service is not directed to children. You must be at least 16 to create an account. We do not knowingly collect account data from anyone under 16. If you believe a child has registered, contact us and we will delete the account.

12. Security

Passwords are stored as one-way hashes. Sessions use HTTP-only cookies. All traffic is served over HTTPS with HSTS. Hosting runs on Cloudflare with security headers including X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. No method of transmission or storage is perfectly secure. Do not publish confidential documents you cannot risk being copied from a public link.

To report a security vulnerability, email security@pdftoflipbook.io.

13. Changes

We will update this page when our practices change and revise the date above. Material cookie changes may require a new consent choice.