Privacy Policy.

Our promise in plain English

DocShop exists because most document converters wait until you've uploaded your file to show you the real price. We don't. We also don't read your files, train on them, or sell your data. This page explains exactly what we do and don't do.

• We delete your file within 1 hour. An automatic job removes every upload and result once it is 55 minutes old.
• We never read your file. Conversion runs in an isolated container with no human access.
• We never train on your file. We don't have AI models; we never will.
• We never sell your data. We don't collect anything to sell.

What we collect

From everyone (anonymous or signed-in):

• IP address (for rate limiting, retained 24 hours)
• Browser fingerprint hash (for rate limiting)
• Conversion metadata: tool used, file size, format, timestamp, status

From signed-in users additionally:

• Email address
• Conversion history (90-day retention for Pro) — see "What we don't keep" below for what is and isn't stored
• Stripe customer ID (for billing)

Anonymous Firebase accounts. When you first visit DocShop, we create an anonymous Firebase Auth identity (no email, no password, no third-party provider). This is the default state for every visitor — it's how we apply the daily free-tier limit and store your conversion files. The anonymous identity carries no personal data; it is a randomly-generated Firebase uid. When you sign in with Google or an email link, the anonymous uid is preserved and your conversion history carries over too.

Anonymous identities that have not been active for 30 days are deleted by an automated job (see "What we don't keep" below). If you'd like us to delete yours sooner, the "Delete my account" link on the /account page applies to anonymous identities too — we just need the firebase uid we was using (we don't have an email address to look it up by).

We never collect file content. Once your conversion completes (or after 1 hour, whichever comes first), the file is deleted.

What we don't keep

A filename can identify an organisation, a member, or a document by name (for example, a club directory export named Password_Card_20260926_201206_435069_ClubName_2026.pdf). Even after the file itself is deleted, the name alone is sensitive. Because of that, we treat original filenames as a privacy concern on three surfaces:

• Email body. Conversion-ready emails do not include the filename — only the tool used and the download link. The signed download link still serves the file with its real name.
• Conversion history. We store a short stable hash of the filename (f_<8hex>.<ext>) in your account history instead of the original. Re-uploading the same file produces the same hash, so the history list still collapses duplicates. The original name is never written to our database.
• File contents. Already deleted in 1 hour; the storage layer enforces this with a scheduled job and a 1-day storage lifecycle as a safety net.

The hash is one-way and tied to your user id — it cannot be reversed to recover the original filename, and another user uploading a file with the same name will see a different hash in their own history.

Cross-border data

Your files are processed in Google Cloud data centers in the United States. By using DocShop, you consent to this transfer. Google Cloud maintains equivalent or stronger security certifications than most Canadian data centers, including ISO 27001, SOC 2, and SOC 3.

Your rights

• Access: Download your data as JSON from account settings.
• Correction: Update your email and preferences at any time.
• Deletion: Delete your account with a 7-day grace period from account settings.

Cookies and analytics

We use Google Analytics 4 (GA4) on the marketing and legal pages of this site (/, /pricing, /about, /privacy, /cookies, /terms, /contact) and on the free analyzer tools (/tools/pdf-check, /tools/pdf-safety, /tools/pdf-page-count). GA4 is configured inside our own Firebase / Google Cloud project, processes data in the United States, and routes traffic through a strictly anonymized-IP pipeline.

The analyzer tools run entirely in your browser via pdfjs — your file is parsed client-side and never sent to our servers. GA4 on those pages records anonymous aggregate hits (page view, "PDF size check completed" with a verdict label like too-large, and a coarse file-size bucket like 25-50MB). It never receives your file, its filename, its page count, or any other metadata about the contents of the document.

DocShop runs GA4 in consented-out mode by default:analytics_storage: 'denied' withads_data_redaction and anonymize_ipenabled. GA4 records an anonymous aggregate hit so we can see which pages are getting traction, but it sets no cookies (_ga, _ga_*, etc.) and does not track you across sessions or sites. Because no personal data is stored on your device, no cookie-consent banner is required or shown.

If we ever add a feature that does need cross-session analytics (e.g. remarketing, signed-in personalization), we will ship a real consent banner at that time. Until then the GA4 config above gives us the data we need without the banner.

We do not load Google Analytics, Facebook Pixel, or any other third-party tracker on conversion tool pages (the pages where you upload a file and we convert it — the tool routes like /merge-pdf, /compress-pdf, /split-pdf, etc.) or on /account and /sign-in. File contents, filenames, and conversion results never leave our Firebase project — the privacy promise on conversion pages is unchanged.

Contact

Questions or concerns: support@docshop.co