Privacy Policy

1. Who we are

Docshar (docshar.vercel.app) is a free set of online PDF tools and a PDF editor. It is run by its founders, Shagun Badsar and Harsh Kumar, from Gurugram, Haryana, India. Docshar is not a registered company. In this policy, "Docshar", "we", "us" and "our" mean the founders operating the service, and "you" means anyone who uses it.

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules 2011"), we are responsible for the personal data described in this policy. You can reach us through our Contact page or by phone at +91 86849 27457.

2. Summary

• Your PDFs are processed in your browser. When you use a PDF tool or the editor, the file is opened and changed by code running on your own device. Your files are not uploaded to Docshar's servers.
• AI features are optional. If you use Docshar AI, what you type or say is sent to Google Gemini to produce an answer. When you use chat, summaries or AI Edit in the editor, the text of the pages of the open document is sent too. Passwords you give in a command-bar request (for example “protect with password …”) are masked in your browser and not sent. We ask for your consent before the first AI request.
• We keep AI usage records (which feature, which model, token counts, time and a salted hash of your IP address) to run daily limits and control costs. The hash is a pseudonymous identifier, not your name or your IP address itself. We do not store your document contents.
• Accounts and paid plans are optional. You can use the free tools without an account. If you create one, we keep your email address, name and sign-in details (section 3.7). If you buy a plan, Razorpay handles the payment; we never see or store your card, UPI or bank details (section 3.8).
• We count operations, not files. When you are signed in, we record which tool you ran, when, whether it worked and the number, size and page count of the files, so we can apply your plan's limits. We never receive the file names or contents (section 3.9).
• Third-party advertising: To support our free PDF tools without paywalls, Docshar integrates Google AdSense to display non-intrusive advertisements on select pages. Google and third-party vendors use cookies to serve ads based on prior visits. Your PDF files and document text are processed entirely on your device and are NEVER shared with advertisers (section 14).

3. What we collect

3.1 When you use the PDF tools and editor

The tools run in your browser. The PDF, image, Word or HTML file you select is read into your browser's memory, processed there and offered back to you as a download. Docshar's servers do not receive the file or its contents. How large a file can be depends on your plan (see Pricing). When you are signed in, your browser tells our server a few facts about each job before it runs, so we can check your plan's limits (see section 3.9). The file itself still stays on your device.

Some tools need extra code that your browser downloads when you use them. For example, the OCR (text recognition) tool downloads the open-source tesseract.js library and its language data from the jsDelivr content delivery network. Your file is not sent with these downloads; recognition runs on your device.

3.2 When you use Docshar AI (optional)

Docshar AI includes the command bar ("Tell Docshar what to do"), the "Ask AI" panel in the PDF editor (Chat, Edit and Rewrite) and "Fill with AI" on the Fill & Sign tool. When you send an AI request, the following is sent from your browser to our server and from there to Google Gemini (Google's AI service):

To protect the service from abuse, our server also uses your IP address briefly in memory to apply a short-term request limit. It is not written to our database.

3.3 AI usage records

For each AI request we store a usage record in our database: the AI feature used, the AI model, the number of input and output tokens, an estimated cost, the time of the request, and an identifier made by applying a salted SHA-256 hash to your IP address. We store the hash, never the IP address itself. The same IP address always gives the same hash, so these records are pseudonymous rather than anonymous: they do not contain your name or IP address, but records from the same IP address can be linked to each other. We do not store your questions, the AI's answers or any document contents in this database.

3.4 Voice input

Voice input in Docshar AI uses your browser's built-in speech recognition. Docshar does not record or receive the audio; we only receive the recognised text if you send it as an AI request. Depending on your browser, the audio may be processed by the browser's maker. In Google Chrome, for example, speech recognition may be processed by Google. Reading answers aloud also uses your browser's built-in speech features.

3.5 Website analytics and hosting logs

We use Vercel Web Analytics to count page views. It does not use cookies and gives us only aggregated statistics (such as pages visited, referring sites, country, browser and device type), not a profile of you. Like any website host, Vercel also processes technical information such as your IP address, browser type and the pages you request in order to deliver the website, keep it secure and keep short-lived server logs.

3.6 When you contact us

If you email or call us, we receive your email address or phone number and whatever you choose to tell us. We use it only to answer you and keep a record of the conversation.

3.7 Your account (optional)

You need an account only to buy a paid plan or to get the larger free allowance for registered users. When you create an account we keep:

• your email address and, if you give it, your name;
• whether your email address has been verified, and when the account was created;
• if you choose Sign in with Google: the basic profile details Google shares with us for sign-in, which are your name, email address, whether Google has verified that email address and, where available, your profile picture. We do not get your Google password or access to your Google Drive, Gmail or contacts;
• if you sign up with an email address and password: your password, which is stored only in hashed form by our authentication provider. We never see it in plain text.

Sign-up, sign-in, sessions, email verification and password-reset emails are handled by Neon Auth, a service of Neon, Inc. Your sign-in session is kept in a cookie set by docshar.vercel.app.

3.8 Payments

Paid plans are one-time purchases processed by Razorpay (Razorpay Software Private Limited). You enter your card, UPI, net banking or wallet details in Razorpay's checkout, not on Docshar, and Razorpay processes them under its own terms and privacy policy. Docshar never receives or stores your card number, UPI ID, bank account or wallet details.

For each purchase we store: the plan, the amount and currency, the Razorpay order ID and payment ID, the payment status (for example paid, failed or refunded), the receipt number, the dates, and, if a payment fails, the reason Razorpay gives. This is linked to your account so that we can activate your plan, show your receipts and handle refunds.

3.9 Usage records for plan limits

Plans include a number of operations (see Pricing). To count them, when you are signed in and run a tool, your browser sends our server: the tool used (for example "compress"), the number of files, their total size, the largest page count, and a random identifier for that job. When the job ends, it reports whether it succeeded or failed. We store this with the time, which plan or credit was used, and your account. We keep daily counters of how many operations you have used.

We never receive your file names, file contents, page images or text through these records. You can see your recent usage in your account and delete your usage history at any time.

Without an account, the daily limit for guests is counted only in your browser's local storage (see section 9) and is not sent to us.

4. What we do not collect

• We do not receive or store the PDF and other files you process with the tools or the editor.
• We do not need your name, email or phone number to use the free tools. We ask for an email address only if you create an account, which is required for paid plans.
• We do not receive or store your card, UPI, net banking or wallet details. Razorpay handles them.
• We do not record your file names, file contents or document text in usage records.
• We do not share your document contents, uploaded files, or file names with advertising networks or third-party advertisers. Third-party advertising partners (such as Google) collect standard device, browser and cookie data for advertising purposes, but have no access to your documents.
• Apart from your account password, which is stored only in hashed form by Neon Auth (section 3.7), we do not knowingly collect sensitive personal data or information (such as financial information or health records) as defined in the IT Rules 2011. Payment details are collected and processed by Razorpay, not by us. Passwords you type into the Protect or Unlock tools are used only inside your browser. Passwords you give in a command-bar request (for example “lock with …”) are masked before the request is sent, so they do not reach our server or Google Gemini. Please do not type passwords into the editor chat or AI Edit, which are not masked.

5. Why we use data

• To provide AI features you ask for: sending your request and, where needed, your document's text to Google Gemini and showing you the answer.
• To run fair-use limits: the free daily AI allowance (up to 20 requests per day per browser, plus a server-side limit per visitor) depends on the browser counter and the pseudonymous usage records.
• To keep the service working and affordable: understanding which AI features are used and what they cost, preventing abuse and fixing problems.
• To run your account: signing you in, verifying your email address, resetting your password and showing your plan, usage and receipts.
• To sell and deliver paid plans: creating Razorpay orders, confirming payments, activating passes and credits, issuing receipts, handling refunds and disputes, and keeping accounting records.
• To apply plan limits: counting operations and checking file, page and merge limits using the usage records in section 3.9, and preventing abuse such as account sharing or attempts to get around limits.
• To improve the website: aggregated page-view statistics.
• To reply to you when you contact us, and to meet legal obligations, such as keeping payment records required by accounting and tax laws.

6. Consent and legal basis

Under the DPDP Act we process personal data on the basis of your consent or for certain legitimate uses the Act allows (such as when you voluntarily give us data for a specific purpose, for example by emailing us).

• AI features: before your first AI request, Docshar shows a notice explaining that what you type or say, and for chat, summaries and AI Edit the text of the pages of the open document, is sent to Google Gemini. AI requests are only sent after you choose "I agree, continue". If you choose "Not now", nothing is sent. Using the AI features is never required to use the PDF tools.
• Withdrawing consent: you can stop using AI features at any time. To reset your choice, clear this website's data in your browser settings; the notice will appear again before the next AI request. Withdrawal does not affect processing that already happened.
• Accounts and paid plans: when you create an account or buy a plan, you give us your details for that purpose (a legitimate use under the DPDP Act), and we process them to provide the account and the plan you bought. We keep payment records where the law requires us to.
• Contacting us: when you email or call, you give us your details for the purpose of getting a reply.

7. Service providers (data processors)

We use the following providers to run Docshar. Each only receives the data needed for its part of the service.

Google's handling of data sent to Gemini is governed by Google's own terms and privacy policy. Depending on the type of service, these may allow Google to keep data for a limited time (for example, to detect abuse) and, for unpaid services, to use it to improve Google's products. For this reason, please do not use the AI features with documents that contain sensitive personal information, such as identity numbers, bank details or medical records. All PDF tools work without AI.

Your browser's speech recognition is provided by your browser's maker (see section 3.4), not by Docshar.

8. Transfers outside India

Our providers store and process data outside India, mainly in the United States. Our database and account system (Neon and Neon Auth) are hosted in the United States (Amazon Web Services, us-east-1 region), so your account details, payment records and usage records are stored there. Payments are processed by Razorpay in India. By using the AI features you consent to your AI requests being processed outside India as described above. We will follow any restrictions on cross-border transfers notified by the Government of India under the DPDP Act.

9. Browser storage and cookies

Docshar uses your browser's local storage to remember a few things on your device:

• your answer to the AI consent notice;
• how many free AI requests you have used today;
• if you are not signed in, how many guest operations you have used today;
• a few interface preferences.

This information stays in your browser and is not sent to us. You can delete it at any time by clearing this site's data in your browser. Docshar may also store website files in your browser (a service worker cache) so that the tools load faster and keep working offline.

Sign-in cookies: if you sign in, docshar.vercel.app sets cookies that keep you signed in and protect your session. They are strictly necessary for your account to work, are not used for tracking outside the service, and are removed when you log out or when they expire. When you pay, Razorpay's checkout may set its own cookies under Razorpay's policies.

Advertising cookies: Google AdSense uses cookies to serve ads based on visits to Docshar and other sites on the web. These cookies allow Google and its partners to serve relevant ads, prevent ad fraud, and cap frequency. These cookies do not access your files or document contents. You can manage or opt out of personalized advertising as described in section 14.

10. How long we keep data

• Your files: not kept by us at all. They stay in your browser's memory until you close or reload the page.
• AI usage records: kept for 12 months. We delete older records periodically, so a record may remain for a short time after it is 12 months old.
• AI requests at Google: kept by Google only as its own terms allow (see section 7). We do not keep a copy of your questions, the answers or document text.
• Account details: kept while your account exists. To delete your account, write to us through our Contact page from the email address of your account, with the subject "Delete my account". We delete your account details and usage records, except what we must keep by law (see the next point).
• Payment records: kept for as long as required by law, for example under accounting and tax laws, even after your account is deleted. Razorpay keeps its own records as the law requires it to.
• Usage records for plan limits: you can delete your usage history from your account at any time. Otherwise we keep it while it is useful for showing your history and handling questions about your plan, and we may delete records older than 12 months. Daily operation counters are kept only as long as needed to apply your limits.
• Hosting logs and analytics: kept by Vercel for the limited periods set by its service.
• Emails and messages: kept for as long as needed to deal with your request and keep a reasonable record of it, after which we delete them.

11. Your rights

Under the DPDP Act and applicable Indian law, you have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• correct, complete or update your personal data;
• erasure of your personal data, unless we must keep it by law;
• withdraw consent at any time (see section 6);
• grievance redressal through our Grievance Officer (section 16); and
• nominate another person to exercise your rights in case of death or incapacity.

To make a request, write to us through our Contact page with the subject "Privacy request". If you have an account, please write from its email address so we can confirm the request is yours; you can also see your plan, usage history and payments in your account and delete your usage history there. Because we store only a salted hash instead of IP addresses, we may need some information from you (for example, the IP address you used and the approximate dates) to find any AI usage records linked to you. We will use that information only to handle your request. If we cannot reasonably identify records relating to you, we will tell you.

Please contact our Grievance Officer first. If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.

12. Children

Docshar is meant for adults. If you are under 18, please use Docshar only with the consent and supervision of a parent or lawful guardian, who should also decide whether you may use the AI features. Accounts and paid plans should be created and bought by an adult. We do not knowingly collect personal data of children, do not track children and do not show them targeted advertising. If you believe a child has sent us personal data without such consent, contact us and we will delete it.

13. Security

We protect data with reasonable security practices suited to the small amount of data we handle, in line with the IT Rules 2011. These include processing files on your device instead of our servers, encrypted HTTPS connections, storing a salted hash instead of IP addresses, storing account passwords only in hashed form, leaving payment details to Razorpay, checking Razorpay's signatures before activating any plan, restricting access to our database and service keys, and using established providers for hosting and storage. No system is perfectly secure, however. If a personal data breach occurs that affects you, we will inform you and the authorities as required by law.

14. Advertising and Google AdSense

Docshar displays advertisements served by Google AdSense on select public pages. This revenue allows us to maintain and improve our 36 PDF tools and keep them free for everyone without paywalls on essential tasks. We maintain strict privacy boundaries regarding advertising:

• Document Isolation: The PDF editor and PDF utility tools run entirely inside your web browser. Google AdSense and third-party advertising scripts have zero access to the files you upload, preview, convert, compress, sign, or edit.
• Third-Party Cookies: Google, as a third-party vendor, uses cookies (such as the DoubleClick cookie) to serve advertisements on Docshar. Google's use of advertising cookies enables it and its partners to serve ads based on your prior visits to Docshar and/or other sites on the Internet.
• Opt-Out and Choices: You can opt out of personalized advertising at any time by visiting Google Ad Settings. You may also opt out of third-party advertising cookies by visiting aboutads.info or Your Online Choices (for European users).
• Browser Controls: Most browsers allow you to block third-party cookies or configure cookie preferences in your browser settings. If you block advertising cookies, contextual ads may still be shown, but they will not be tailored based on past browsing.

15. Changes to this policy

We may update this policy as Docshar changes. The "Last updated" date at the top shows when it last changed. If a change materially affects how we use your personal data, we will show a notice on the website before it takes effect.

16. Grievance Officer and contact

In accordance with the IT Rules 2011 and the DPDP Act, our Grievance Officer is:

• Grievance OfficerShagun Badsar
• EmailWrite to us through our Contact page
• Phone+91 86849 27457
• LocationGurugram, Haryana, India

We acknowledge grievances promptly and respond within 30 days of receiving them.