Privacy Policy

In one table

Every network connection the application can make, and what triggers it. Nothing else leaves your computer.

Send Feedback

The Feedback palette (Window › Feedback, Ctrl+Alt+F, the speech-bubble button on the canvas, or Help › Send Feedback…) lets you write to us. Nothing is sent until you press Send. When you do, the application posts one report to our feedback server at https://appsupport-gajv.onrender.com, a service we run on Render (Render Services, Inc., USA). The report contains:

• the text you wrote;
• the images you attached, if any (up to ten, 5 MB each, PNG / JPEG / GIF / WebP / HEIC). Nothing is attached unless you attach it, with the paperclip in the palette;
• a technical context: the application version and build, the Windows version and processor architecture, the computer’s host name, the display language (locale), the keyboard layout, the screen size and scale, and — if a document is open — the active tool, the zoom and the colour mode. Not the document, not its name, not its path.

If you are offline the report is queued in %LOCALAPPDATA%\PDFEData\feedback-outbox\ on your computer and sent the next time the application starts with a connection. You can delete that folder at any time and the queued report is gone.

The host name is included so that several reports from the same machine can be read together. It is the only identifier in a feedback report; there is no account and no e-mail address unless you type one in the text.

The same palette is also where you tell us that the AI assistant gave you an inappropriate answer: such a report carries one extra word (ai-content) so that we can tell it apart from an ordinary bug report.

Crash reports

If the application crashes, it writes a plain-text report on your computer (in C:\dumps if that folder exists or can be created, otherwise in your temporary folder), together with a memory dump. At the next launch the report is shown to you in the Errors window — always, because it is your machine and you should see it — and, if Send diagnostic logs automatically is on in Edit › Preferences… › Debug (it is on by default), the same text is also sent to the feedback server as one report. Turn the switch off and nothing is ever sent; the local files stay where they are and you can delete them.

The report contains the exception type and where it happened, the call stack with module names and offsets, the last window messages the application received, the active tool, and the same technical context as a feedback report. It does not contain the content of your documents. A crash is reported once: the file is consumed at the launch that reads it.

AI Console

The AI Console is an assistant that lives in the application and knows what the application can really do. It only talks to the network when you press Send. What happens depends on the engine chosen in Edit › Preferences… › AI:

Native (server) — the default, and the only engine in the Microsoft Store version

• On a PDF, the document is not sent. On a PDF this console advises in words rather than drawing, so what travels is your prompt and the reference images you attached — nothing else. The page you are looking at, its text and its pictures stay on your computer.
• The prompt goes to our AI proxy at https://appsupport-gajv.onrender.com, which forwards it to the AI provider it is configured with — one of Anthropic (USA), OpenAI (USA) or Google (USA) — and returns the answer. The provider processes the prompt under its own terms and privacy policy; we send it nothing that identifies you.
• The application sends a random device id with each request: a UUID generated the first time and stored in the Windows registry under HKEY_CURRENT_USER\Software\PDFEditorPro. It exists only so that the proxy can apply a daily request limit; it is not linked to a person, an account or a computer name.
• The console also fetches the proxy’s configuration (which model and prompt version are active) so that it can show them to you.

Your own key (Claude, OpenAI, Gemini) — direct-download version only

• The prompt, the images you attached and the conversation go directly from your computer to the provider you chose, with your key, under that provider’s terms. Nothing passes through our server, and there is no daily limit from us. Here too, on a PDF the document itself is not part of the request.
• Your API keys are stored on your computer only, encrypted with Windows Data Protection (DPAPI) for your user account — not readable by another user of the same PC, and not readable from a copy of the registry taken elsewhere. Test next to a key makes one request to that provider to check it.

Conversations are kept locally, one file per document, under %LOCALAPPDATA%\PDFEData\ so that you can reopen them; they are not uploaded anywhere except as part of a request you send.

Check for Updates

In the copy downloaded from this site, Help › Check for Updates… fetches https://www.rainbowfactory.uk/pdf-editor/updates/appcast-windows.xml with a plain HTTP GET and compares the version in it with the one you have. That is the whole exchange: the request carries no identifier, no document name and no machine name, and we do not log who asked. The background check follows the same rule and can be switched off.

If you choose to install an update, the application downloads the package from this site, checks its length, verifies its signature against the key built into the copy you are running, and refuses to install anything that does not verify. In the Microsoft Store version there is no update check at all — the menu item does not exist — because updates come from the Store, under Microsoft’s privacy statement.

MCP server

The application can act as an MCP server so that an AI client on your own computer — Claude Desktop, Claude Code, Codex, VS Code — can drive it. This runs entirely on your machine and there are two transports, both local:

• pdfeditor.exe --mcp-stdio: the client and the application exchange JSON messages over standard input and output. No socket is opened at all.
• The HTTP transport listens on 127.0.0.1 and nowhere else — never on a network card, never on 0.0.0.0 — and a request whose origin is not local is refused outright.

Both are governed by Allow external control in Edit › Preferences… › MCP Server. With that switch off, no tool can be called. What the AI client itself sends to its own provider is governed by the client’s policy, not by this one — and note that the MCP server works on its own document, opened by the assistant, not on the one in your window.

What stays on your computer

• Your documents. Pdf Editor Pro opens and saves files where you tell it to, and saving writes your changes onto the end of the original file. It never uploads a document — not to check it, not to render it, not to sign it. The only files that ever leave are the images you deliberately attach to a feedback message or to an AI prompt.
• Preferences (palette positions, options, recent files, the device id above) in the Windows registry under HKEY_CURRENT_USER\Software\PDFEditorPro, and application data (AI conversations, the feedback queue, update downloads) in %LOCALAPPDATA%\PDFEData\.
• Your signature library — the signatures, initials and signer profiles you drew, typed or photographed — kept between launches in the same application data folder. They are pictures on your disk; they are never sent anywhere.
• API keys for the AI engines, encrypted with DPAPI (direct-download version only).
• Digital IDs for certificate signing are read from your own Windows certificate store (“Personal”), by Windows, on your machine. A signed copy is written to a file you choose. Nothing about the certificate or the signature is sent to us.
• Crash reports as plain text and a memory dump, as described above.

Uninstalling the application does not delete these; you can remove the registry key and the folder yourself.

Camera and microphone

Two commands use hardware, and only when you choose them from the application:

• Take Photo… in the Signatures palette takes a single still frame from your webcam so that you can photograph a signature written on paper. The frame goes straight into the ink-from-paper cleanup and, if you keep it, into your local signature library. It is not written to a temporary file and it is not sent anywhere. With no camera attached the command is greyed with the reason.
• Record Sound… records from the microphone you pick and attaches the clip to the page as a sound note — that is, it becomes part of your document, on your disk.

Neither runs in the background, and neither starts by itself.

This website

This site is static pages. It sets no cookies of its own, runs no analytics and embeds no advertising. Fonts are loaded from Google Fonts (Google LLC), which receives your browser’s request for the font files. Links to Discord, the App Store, the Microsoft Store and GitHub lead to those services and their policies. Our hosting provider keeps ordinary server logs (IP address, requested page, time) for the operation of the site.

Retention, your rights, contact

Data controller: Rainbowfactory Ltd, London, United Kingdom (the company also trades as Rainbow Factory). Registered office: 24 Fitzroy Square, London, England, W1T 6EP. Company number: 14629999. E-mail for privacy requests: support@rainbowfactory.uk. You can also reach us on Discord.

Why we process it. Feedback and crash reports are processed to fix bugs and improve the application (our legitimate interest, and your request when you press Send). AI requests are processed to provide the feature you asked for. Update checks are processed to deliver the version you asked for. Nothing is used for advertising or profiling, and nothing is sold.

How long we keep it. Feedback and crash reports are kept on our feedback server for as long as the issue they describe is open, and at most 12 months. AI requests are not stored by our proxy beyond the daily request counter, which resets every day; what the AI provider retains is described in its own policy. The update feed is a public file and records nothing.

Where. Our feedback server and AI proxy run on Render (Render Services, Inc.) in the United States. AI providers are in the United States.

No usage analytics. This version of the Windows application collects no usage statistics of any kind: it does not count launches, does not count which features you use, and contains no analytics library. If that ever changes, it will be said here and in the changelog before it ships.

Your rights. Under the UK GDPR and, where it applies, the EU GDPR you can ask us what we hold about you, ask for it to be corrected or deleted, object to the processing, or complain to the Information Commissioner’s Office. Because reports carry no account and no e-mail address, a request should mention the host name and approximate date of the report so that we can find it. Write to the e-mail address above.

Children. The application is not directed at children and collects no personal data from anyone as part of normal use.

Changes. When the application gains or loses a network feature, this page changes with it, and the date at the top is updated. The changelog says which version introduced what.