Privacy Policy

Last updated: October 26, 2026

Files you upload

When you use a conversion tool, your file is uploaded to our server over HTTPS, processed, and stored temporarily in a private storage directory that is not publicly browsable. Temporary files are automatically deleted after 24 hours by a scheduled cleanup job (uploads, processed outputs and scan-session images are all swept).

Files are processed entirely on our server - your documents are never sent to any third-party API or external service for processing. If you are logged in, your file history is visible only to your account. Guest files are tracked by an anonymous token stored in a cookie and are also deleted on the same schedule.

Document scanning sessions

When you use Scan with Phone, a temporary session links your computer and phone via a QR code that contains only a random token - never document contents. Scanned page images are stored temporarily in the session folder and are deleted when the session expires (30 minutes), when you finish generating the PDF, or when the scheduled cleanup runs.

Information you provide

• Account data (optional): name, email address, and a bcrypt-hashed password. We never store plaintext passwords.
• Contact form: name, email, subject and message - stored so we can reply to you.

Information collected automatically

• Conversion history records (tool used, file sizes, timestamps, IP address) used for quota enforcement and abuse prevention.
• Rate-limit records tied to your account or anonymous guest token.

Cookies and local storage

We use a session cookie (login/CSRF), a guest-identity cookie (fair-use quotas), and browser localStorage for your light/dark theme preference. See the Cookie Policy for details.

Advertising and analytics

The site includes ad slots prepared for Google AdSense. When ads are enabled on your plan and Google's ad code is active, Google may set or read cookies to serve and measure ads - see Google's ad policies. We do not currently run any analytics or tracking scripts of our own.

Data security

Passwords are hashed with PHP's password_hash (bcrypt). Uploads are validated by real MIME-type inspection, stored outside any executable path, and served only through an authenticated download endpoint. Sessions use HttpOnly, SameSite=Lax cookies.

Your rights

You may delete your uploaded files at any time from your dashboard (registered users), request account deletion, or ask what data we hold about you by contacting us.

Children's privacy

Files Office is a general-purpose utility and is not directed at children under 13. We do not knowingly collect personal information from children.

Contact

Questions about this policy? Reach us via the contact page.