Cookie policy

Last updated: October 12, 2026

1. What cookies and local storage are

Cookies are small text files a website asks your browser to keep. They can remember a sign-in session, preferences, or — on ad-heavy sites — track you across the web.

Local storage is a similar browser feature that stores data on your device without sending it back to a server on every request. Functionally it does many of the same jobs as cookies, with slightly different rules.

This policy covers both.

2. Our approach

400Tools is built to work without tracking. Our PDF tools run in your browser and need no session at all — you can open any tool and process documents without us storing anything in your browser.

Storage is used only when strictly necessary: to keep you signed in (if you choose to sign in) and to run the checkout when you buy Premium.

3. Strictly necessary storage

The table below lists everything 400Tools-related that may be stored in your browser. There are no optional categories to consent to — if it's here, it's required for a feature you actively chose to use.

• Authentication session — when you sign in, our authentication provider (Supabase) stores a session token in your browser's local storage (key pattern sb-…-auth-token). It keeps you signed in and proves your identity to your own account. Cleared by signing out, or by clearing site data.
• Interface preferences — small pieces of local storage remembering UI choices (such as a dismissed notice) so the site behaves consistently between pages. No personal data, no cross-site use.

These are exempt from cookie-consent banners under GDPR rules because they are strictly necessary to provide a feature you requested (signing in, using the interface). We still document them here for full transparency.

4. Third-party cookies

Two of our infrastructure providers may set their own cookies in your browser, only in connection with their specific features:

• Paddle (payments) — when you open the Premium checkout, Paddle's secure checkout may set cookies on its own domain to maintain the checkout session, prevent fraud, and remember your region/tax settings. These exist only during and shortly after checkout. Paddle is the merchant of record; see Paddle's cookie policy.
• Supabase (authentication) — provides the sign-in flow. Session data is held in local storage rather than cookies (see section 3).

Content delivery networks that serve our JavaScript libraries (cdnjs, jsDelivr) do not set cookies when delivering static files — they receive your IP address as part of serving the file, the same as any website loading scripts from a CDN.

5. Advertising cookies (Google AdSense)

400Tools displays ads served by Google AdSense. When ads are shown, Google and its partners may set cookies in your browser to serve, measure, limit the frequency of, and personalize advertising. Examples of cookies that may be set include:

• NID / __Secure-* — store your preferences and information, such as your most recent searches and ad personalization choices.
• IDE / test_cookie (Google DoubleClick) — used to register and report website visits and ad impressions, and to measure the effectiveness of ads.
• DSID / _drt_ — used to link activity across devices where you have signed in and consented to personalized ads.
• _gcl_au / conversion cookies — used by Google and advertisers to measure how well ads convert to actions on our site.

Google's use of advertising cookies enables it and its partners to serve ads based on your prior visits to this site and/or other sites on the Internet. These cookies do not give Google or us access to your documents or your 400Tools account — ads never see the files you process.

Your choices for advertising cookies

• Google Ads Settings — manage ad personalization directly with Google.
• Industry opt-out tools — opt out of many vendors' personalized ads at once via aboutads.info (US) or youronlinechoices.com (EU, EDAA).
• Google's cookie controls — see Google's Cookie policy and How Google uses data when you use our partners' sites or apps.
• EU/EEA/UK visitors — advertising cookies and personalized ads are only enabled after you give consent through our consent management control. You may withdraw consent at any time; ads shown without consent are non-personalized.

6. What we do not use

• ❌ Our own advertising or retargeting cookies
• ❌ Third-party analytics cookies (Google Analytics, Mixpanel, etc.)
• ❌ Social media embeds that track you
• ❌ Fingerprinting scripts
• ❌ Tracking pixels from ad networks other than Google AdSense

The only advertising cookies on 400Tools come from Google AdSense when ads are displayed and where required consent has been given (see section 5). There is no other tracking network on the site.

7. How to manage cookies

You are always in control:

• Clear site data — clearing cookies and site data for 400tools.com in your browser settings removes the sign-in session and preferences. You'll be signed out.
• Block cookies — you can block cookies entirely in your browser settings. Every PDF tool will still work; only account sign-in requires storage.
• Private/incognito windows — using a private window means nothing persists after you close it.
• Ad personalization opt-outs — use Google Ads Settings, aboutads.info, or youronlinechoices.com to control personalized advertising cookies.
• Browser guides — Chrome · Firefox · Safari · Edge

8. Do Not Track & opt-out signals

We do not track users across sites for our own purposes. Where advertising cookies from Google AdSense are used, you can control them via the opt-outs in section 5. We honor Do Not Track and Global Privacy Control signals for non-essential cookies: if your browser sends these signals, no advertising or optional cookies are set. If we ever add optional analytics, we will update this policy and honor these signals before any such tool is enabled.

9. Changes to this policy

If our use of cookies or local storage ever expands (for example, adding privacy-respecting, first-party analytics), we will update this page and the "Last updated" date before those changes take effect, and where required we will ask for consent first.

10. Contact

Questions about this policy or anything else data-related? See our Privacy Policy for contact details and your rights, or Security page for vulnerability reporting. You can also reach us through the Contact page.