Last updated: October 12, 2026
1. Overview
400Tools ("we", "us") provides free online PDF tools at 400tools.com. This policy explains what information we collect when you use 400Tools, how we use it, and the rights you have. We designed 400Tools around a simple principle: your documents belong to you, and we collect as little data about you as possible.
You can use every free tool without creating an account. An account is only required if you purchase Premium or want your settings synced across devices.
2. Data we collect
Information you provide
- Account information — if you sign up, your email address and an authentication credential (passwords are stored hashed by our authentication provider, never in plain text).
- Billing information — if you purchase Premium, your subscription status and limited billing details. Full payment card data is entered on and handled by our payment processor (see Payments); it never touches our servers.
- Support messages — if you contact us, the content of your message and your email address so we can reply.
Information collected automatically
- Anonymous technical logs — standard server logs (IP address, browser type, pages visited, referring site, timestamps) used to operate and secure the service. These logs do not contain document contents or file names.
- Usage events — anonymous events such as "tool X completed successfully" used to understand which tools are reliable and worth improving.
- Advertising data (when ads are shown) — when Google AdSense ads are displayed on our pages, Google collects standard ad request data such as your IP address, browser/user agent, and the page URL. This data is collected by Google, not by us; see Third-party services for details and opt-outs.
Information we do not collect
- We do not collect the contents of your documents.
- We do not collect file names for browser-processed tools.
- We do not buy or enrich data about you from brokers, advertisers, or social networks.
3. How we use your information
- To provide the service: process your requests, deliver results, and keep tools running reliably.
- To manage accounts and subscriptions: authenticate you, sync Premium status, and handle billing.
- To provide support: answer messages you send us.
- To protect the service: detect abuse, spam, and attacks, and prevent unauthorized access.
- To improve the product: aggregated, anonymous usage statistics (e.g., which tools fail most often) so we can fix and prioritize work.
We do not use your information for our own advertising, and we do not sell or rent it to anyone. 400Tools may display ads served by Google AdSense; those ads are personalized by Google using data collected via cookies as described in sections 5 and 6. We never share your documents or your account information with advertisers.
4. Your files and documents
This is the most important section. The majority of 400Tools tools run entirely in your browser using client-side JavaScript engines (such as pdf-lib and pdf.js). For these tools, your file is opened, processed, and saved on your own device — it is never uploaded to us, and we have no technical ability to access it.
A small number of operations require server-side computation. When that happens:
- Your file is transferred to our processing servers over encrypted HTTPS connections.
- It is processed in an isolated worker solely to produce your result.
- It is permanently and immediately deleted once the result is delivered — there is no retention period, no backups, and no way for anyone, including us, to retrieve it afterwards.
In all cases:
- We never read, review, or manually access your documents.
- We never use your documents to train artificial intelligence or machine-learning models.
- We never sell, share, or publish your documents or their contents.
- You retain full ownership of your files and results. We claim no rights over them.
5. Cookies
We use a minimal number of cookies and local storage entries (full detail on our Cookie Policy page):
- Authentication cookies — keep you signed in to your account. Removed when you sign out.
- Preference storage — remembers interface choices (such as dismissed prompts) so the site behaves consistently.
- Advertising cookies (when ads are shown) — Google AdSense may set cookies in your browser (such as the DoubleClick DART cookie and related Google advertising cookies) to serve, measure, and personalize ads. This happens only where permitted by applicable law, including after consent for visitors in the EU/EEA/UK. You can opt out of personalized advertising via Google Ads Settings, aboutads.info, or youronlinechoices.com.
We do not use our own advertising cookies, cross-site tracking pixels, or third-party behavioral profiling. You can block or delete cookies in your browser settings; the tools themselves work without any cookies at all — only account sign-in requires them.
6. Third-party services
We rely on a small set of infrastructure providers, each chosen for a specific purpose. We do not permit them to use your documents for their own purposes.
- Supabase — account authentication and database. Stores your email and hashed credentials, protected by row-level security. Supabase privacy policy
- Paddle — merchant of record for payments and subscriptions. Handles all billing data. Paddle privacy policy
- Google AdSense (advertising) — 400Tools displays ads served by Google. Google, as a third-party vendor, uses cookies to serve ads on this site. Google's use of advertising cookies (including the DoubleClick DART cookie) enables it and its partners to serve ads based on your visits to this site and/or other sites on the Internet. You may opt out of personalized advertising by visiting Google Ads Settings. You may also opt out of a variety of third-party vendors' cookies simultaneously via aboutads.info/choices and youronlinechoices.com. For details on how Google uses data when you use our site or apps, see How Google uses data when you use our partners' sites or apps. See also Google's Cookie policy and Google's Privacy Policy.
- Content delivery networks (e.g. cdnjs, jsDelivr, Paddle's CDN) — deliver the JavaScript libraries that power the tools. These providers receive your IP address as part of serving a file, the same as any website hosting scripts externally.
Web beacons and pixels
Advertising partners such as Google may use web beacons (small transparent images or script calls) in combination with cookies to count page views, ad impressions, and conversions. These beacons do not access your documents or personal account data.
EU/EEA/UK consent (GDPR)
For visitors in the EU, EEA, and UK, we use a consent management mechanism so that advertising cookies and personalized advertising are only enabled after you give consent. Until consent is given, any ads shown are non-personalized. You can change or withdraw your consent at any time through the cookie settings control on the site, or via the Google and industry opt-out links above.
Sharing with Google
We do not share personally identifiable information with Google for advertising purposes. Google may associate an ad request with a pseudonymous identifier set in your browser; your account email, documents, and file contents are never transmitted to Google.
7. Payments and billing
All payments are processed by Paddle, acting as the merchant of record. Paddle is a PCI DSS Level 1 certified payment provider. Your card number, expiry, and CVC are entered on Paddle's secure checkout and are never transmitted to or stored on our servers. We receive only the subscription state (active, past due, canceled) needed to unlock Premium features.
Payments are charged in USD. You can cancel your subscription at any time from the billing portal; access continues until the end of the paid period.
8. Data retention
- Documents — never retained. Deleted immediately after server processing; never uploaded for browser-processed tools.
- Account data — kept while your account exists. Delete your account at any time and the associated profile data is removed.
- Support messages — kept as long as needed to resolve your request and for a short period afterwards for context.
- Technical logs — kept for a short, rolling period (typically no more than 30 days) for security and debugging, then deleted or aggregated.
- Billing records — Paddle retains transaction records as required by tax and accounting law. We store only the subscription status on our side.
9. Data security
We protect the data we do hold with industry-standard measures:
- HTTPS/TLS encryption on every page and API connection.
- Hashed passwords with modern algorithms via our authentication provider — we never store plain-text credentials.
- Database row-level security isolating each user's data.
- Payment data handled exclusively by a PCI DSS Level 1 provider.
- Minimal collection as a strategy — the safest data is data we never gather.
More detail is available on our Security page.
10. Your rights
Depending on your location (including the EU/EEA under GDPR and California under CCPA/CPRA), you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your account and associated personal data.
- Export your data in a portable format.
- Object to or restrict certain processing.
- Withdraw consent where processing is consent-based.
- Non-discrimination — we never degrade service for exercising your rights.
To exercise any of these, contact us using the details in the Contact section. We respond within the timeframes required by applicable law (30 days for GDPR requests).
11. International transfers
400Tools is accessible worldwide, and our infrastructure providers may process data in countries other than your own, including the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses with our providers. By using 400Tools, you acknowledge these transfers as necessary to operate the service.
12. Children's privacy
400Tools is not directed at children under 13 (or under 16 in the EU/EEA), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
13. Changes to this policy
We may update this policy as the service evolves. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify signed-in users. Continued use of 400Tools after an update constitutes acceptance of the revised policy.
Questions about this policy, your data, or a privacy request? Use our Contact page or write to the addresses listed there. We answer every privacy request.
For security vulnerabilities, please use the responsible disclosure process described on our Security page instead.