Privacy Policy

FileHook is built around a simple stance: we want to do the editing, not own your data. Most tools run inside your browser and your document never becomes something we read. This page says what we actually collect, what runs on the page, and what we keep in your browser.

What we collect

Your file, usually not at all. Opening a PDF in the editor reads it straight into the tab. Nothing is uploaded, so there is nothing for us to hold. Three things do send the document to our server, because they can't work any other way: making a Share link, sending a document out for signature, and reading a scanned statement or receipt that has no text in it. Without an account, a Share upload sits in temporary cloud storage and is deleted two hours after you make it. There is no way to turn that off. If you are signed in, you can choose to keep the file instead, and then it stays in your account until you delete it. Documents sent for signature follow the rule under "Signature requests" below.

Nothing, if you only edit. Editing asks for no email, no name, no account.

Your account, if you make one. Some parts of FileHook do need an account: sending a document out for signature, the invite program, and a paid plan. If you sign up we store your email address and the records tied to it (your signature requests, your invite credits, whether your plan is free or paid). Card numbers never reach us. Our payment processor handles the payment and tells us only that it succeeded.

Support messages. If you email us or use the feedback button, we keep what you sent so we can reply.

Server logs. Our hosting and storage providers keep standard request logs (IP address, user agent, timestamp) for short periods to run the service and stop abuse. We don't sell them or build profiles from them.

Analytics, and the cookie choice

We always count what happens on the site, anonymously and with no cookies: page views, which tool you opened, and a few product events such as "a file was uploaded" or "a file was downloaded", along with your country, browser, and the site you came from. In this mode nothing is stored in your browser and nothing can recognise you when you come back. Two counters receive it: Google Analytics, running in its cookieless consent mode, and a lighter usage and page-speed counter from our hosting provider that never uses cookies. Google handles its share under its own privacy terms and may process it outside your country. We have switched off the Google feature that would link this data to your Google account, in our tag and in our Google Analytics settings.

The notice asks one thing. May Google Analytics set cookies named _ga and _ga_<id> in your browser, so a repeat visit can be told apart from a new one? Until you press Allow, no analytics cookie is set. Press "No thanks" and it never is. The anonymous counting described above continues either way.

What analytics never receive: your document, its text, its filename, or anything you typed into it. The events carry the name of the tool and nothing about the file. We leave filenames out on purpose, because a filename often carries a person's name or an account number.

Error reports run either way. When something in the app crashes, we send the error message, the stack trace, the page address, and browser details to an error monitoring service, plus a timing sample from about one in ten page loads. This is how we find out the editor broke, so it is not part of the analytics choice. It sets no cookies, records nothing about your document, and is not used to follow you around the web.

Change your answer

Your choice is stored in this browser. You can switch it here at any time, and switching off also clears the analytics cookies from this browser.

Cookies and browser storage

FileHook keeps most of its state on your device instead of on our servers. Here is the whole list.

Needed for the site to work

• Your answer to the analytics notice, so we stop asking.
• Your language choice, in a cookie named fh_locale, set only when you pick a language.
• Your sign-in session, if you have an account, so you stay signed in between pages.
• A daily count of finished files, because the free plan allows 10 a day across all the tools.
• Signatures you chose to save for reuse. For a visitor with no account these stay on the device and go nowhere else. If you sign in, they can be synced to your account so they follow you between devices.
• An invite code, if you arrived through someone's referral link, so the credit reaches the right person after you confirm your email.
• Small interface memories: whether you dismissed the install prompt, and how many Smart Fill runs you have used.
• The document you are moving between tools. When you click "continue editing" the file is held in your browser's own database for the hop, then deleted once the next tool picks it up.

Set only after you allow analytics

• Google Analytics' _ga and _ga_<id> cookies, which last up to two years unless you clear them.

Clearing site data in your browser removes every item above. The editor keeps working, it just forgets your saved signatures and your preferences.

What we don't do

• We don't read, search, or index the contents of your PDF, and we don't train any model on it.
• We don't build advertising audiences or run retargeting. We advertise FileHook on Google, so a Google Ads tag on this site counts which ad clicks led to a visit. It never sets ad cookies, and ad personalisation stays off for every visitor.
• We don't sell your data, and we don't hand it to data brokers.
• We don't put a watermark on your exports or hold your file hostage behind an email form.

Where your file lives

For most tools, on your device and nowhere else. The PDF is read into the tab and the finished file is written back out from the tab. It is never sent anywhere, so a slow connection makes no difference and an offline tab still works.

For the three cases that do upload (Share links, signature requests, and scanned pages with no text), the file sits in temporary cloud storage while the job runs. An automated cleanup removes a Share upload once its two hours are up.

Keeping a file

If you have an account, you can choose to keep a file you upload rather than let it go after two hours. A kept file stays in your account until you delete it. Deleting it removes the file from our storage; we keep only a record that the file existed, with its name, size and dates, so your file list still shows what you worked on.

Two things to be plain about. Keeping a file is not a backup: it is one copy in one place, and we do not keep a second one. If it matters to you, keep your own copy as well. And if you upload without an account, the two-hour deletion always applies and there is no way to switch it off.

We keep no archive and no "just in case" copy of anything, kept or not.

Editing itself is local either way. Keystrokes, font measurement, color sampling, and undo history all run in client-side JavaScript and never leave your tab.

Signature requests

Documents you send for signature work differently from the editor, because the file has to outlive your browser tab for the signer to open it. A document sent for signature is kept while the request is active and for 30 days after it completes or closes, then deleted. Neither the two-hour rule nor the keep option above applies to these files.

Each request also keeps an audit trail: the emails and names of the people on the request, and a record of when the document was sent, opened, agreed to, and signed. For signing events we record the signer's network address and browser details, because that record is what makes the signature verifiable later. The audit trail appears on a separate certificate of completion, available alongside the finished document, and is retained with the request record.

FileHook for Android

The Android app is the same editor, packed to run on your phone with no server behind it. This section covers the app only.

Your file stays on your phone. The app opens and edits a PDF on the device and never uploads it to us. The three upload features described above (Share links, signature requests, and reading scanned pages) are not in the app.

No account, no ads, no analytics. The app has no sign in, shows no ads, and carries no analytics or crash reporting. The cookie notice and the counters described above belong to the website and do not run in the app.

No permission prompts. The app does not ask for access to your storage, camera, microphone, contacts, or location. You pick a file, or send one from another app, and Android lets the app read that one file.

What the app keeps on your phone

• A copy of the files you opened recently (up to 12), so the home screen can reopen them.
• The signature you chose to save for reuse.
• A daily count of finished files, because the app allows 10 a day.

Clearing the app's storage in Android settings, or uninstalling the app, removes all of it. Android backup is turned off for the app, so none of it is copied to a cloud backup or moved to a new phone.

What the app sends

• The daily count. When your phone is online, the app tells our server that one file was finished, and asks how many have been finished today. That message holds no file, no filename, and nothing from inside your document. Our server sees the network address the message came from, as any server does. It stores a scrambled, one-way form of that address next to the count, and the scrambling changes every day, so the stored value is not your address and cannot be linked from one day to the next. We use it only to apply the daily limit and to stop abuse.
• Server logs. The same "Server logs" note above applies to that message: our hosting provider keeps standard request logs for a short period.

That is the whole list. With no connection the app keeps working and sends nothing.

Your rights

If you have an account, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete the account and its records. Email us and we will do it. Deleting the account removes your email, your saved signatures, and your invite records. Completed signature requests keep their audit trail, because that is the proof the signature was valid and the other people on the request rely on it too.

FileHook is not directed at children under 13 and does not knowingly collect their information.

Changes

If we update this policy, we'll change the "Last updated" date above. If we add a new kind of collection or a new third party, we'll ask for your analytics consent again rather than quietly reusing the old answer.

Contact

Questions, concerns, or a bug to report? Get in touch via the email listed on the homepage.

This policy is provided as-is and reflects the actual product today. If you need formal legal review for a specific compliance need, consult a lawyer.