How we handle your files.
A minute-by-minute timeline of what happens to your PDF from the moment you upload it to the moment it is deleted. Concrete timestamps, concrete actions, no marketing.
You upload your file
Your browser sends the file to our Firebase Cloud Storage bucket over TLS. The bucket is in us-central1. The upload is encrypted in transit; storage at rest is AES-256 (Google-managed keys).
A worker picks it up
A Cloud Run container starts within a few seconds. The container is ephemeral — it spins up for your file and tears down when the conversion completes. No state, no shared disk, no human-accessible shell.
Conversion runs
LibreOffice, pdf-lib, or Ghostscript processes the file. We pass arguments; we do not parse or inspect the contents. If conversion fails, the worker logs the error code (not the file) and you get a clear error message.
You download the result
The converted file is written to the same bucket. You get a one-time download URL. The result file inherits the same 1-hour deletion timer as the upload — both will be gone at minute 55.
How to verify: The download URL expires 15 minutes after issue. You can download once, or after.
Automatic deletion
A Cloud Storage lifecycle rule deletes any object older than 1 hour. Both the upload and the result are gone. The deletion is policy-driven, not human-driven — there is no button Kyle can press to keep a file.
How to verify: You can check the policy yourself: storage-lifecycle.json in the public DocShop repo on GitHub.
Original filename is replaced with a hash
A filename can identify an organisation, a member, or a document by name. The moment your conversion is queued, we replace the original with a short stable hash (f_<8hex>.<ext>) for everything we keep — conversion history, share links, and the resulting email. The file you download still has its real name; only what we store is hashed.
IP rate-limit records expire
Rate-limit records used for spam protection age out after 24 hours. After that, there is no record of your IP address against your account.
Conversion metadata expires (Pro users)
For Pro and Max users, the conversion history (tool, file size, format, timestamp, and the filename hash) is kept for 90 days so you can re-download past results. After 90 days, the metadata row is deleted; only the aggregate counter stays.
Things that will not happen to your file.
- We never read the contents of your file.
- We never train AI models on your file. We do not have AI models.
- We never sell your data. We do not collect data to sell.
- We never share your file with third parties for any purpose.
- No human at DocShop can access your file — there is no human-accessible UI, no shell, no support workflow that pulls a file.
- We do not run advertising trackers (Facebook Pixel, Google Ads conversion tracking, etc.) on conversion tool pages.
How you can verify this yourself.
Cloud Storage lifecycle policy
storage-lifecycle.json in the public DocShop repo. The rule is "delete after 1 hour, prefix users/ or share/." Anyone can audit it.
Storage encryption
Google-managed encryption keys (GMEK) by default. AES-256 at rest. TLS 1.2+ in transit.
Worker isolation
Each conversion runs in a fresh Cloud Run container with no persistent disk. The container is destroyed after the conversion — there is no file left to inspect.
No third-party trackers
View source on any tool page (/merge-pdf, /compress-pdf, etc.). There are no scripts from facebook.net, google-analytics.com, doubleclick.net, or any other ad/tracker domain. Only first-party scripts.
Open-source code
The privacy policy, the lifecycle config, the analytics config, and every page on this site are in the public DocShop repo on GitHub. Anyone can submit a PR.
The short version: your file exists in our infrastructure for at most 55 minutes. The worker that processes it is destroyed when the conversion is done. The storage bucket is policy-deletion-only. No human can pull a copy.
For the lawyer-readable version, see the Privacy Policy.