Privacy Policy

• Most tools run entirely in your browser — your file is never uploaded anywhere.
• A small number of tools that need heavier processing upload your file to a server temporarily, and it is deleted immediately after the job finishes.
• You don't need an account to use any tool.
• We don't sell your data, and we don't use third-party advertising or tracking cookies.

Most tools — including PDF merge/split/compress, image conversion, OCR, audio conversion, and every developer utility — run entirely as code executing in your browser (using WebAssembly and browser APIs). The file you select never leaves your device: it's read locally, transformed locally, and the result is offered to you as a local download. We have no visibility into these files at all, and no copy of them ever exists on our infrastructure.

A few tools genuinely can't run in a browser (for example, Office document conversion, HTML-to-PDF rendering, and PDF/A archiving, which depend on server-side engines like LibreOffice or a headless browser). For these tools only:

• Your file is uploaded over an encrypted connection to process the job.
• It is used only to produce your converted result — never inspected, read, or used for any other purpose.
• It is automatically deleted from our storage immediately after the job completes (or after a short expiry window if the job fails), typically within minutes.
• Every such tool is clearly labeled on its page (☁️ “Uploaded to our server for processing, then deleted”) so it's never a surprise.

If you use the request-signature flow, the document you send is stored temporarily so the person you send it to can open and sign it via a private, expiring link. It is deleted after the signing workflow completes or the request expires. The signer's email address is used solely to deliver that link.

For certain uploads to server-processed tools, we may check the file against VirusTotal, a third-party malware-scanning service, before processing it — purely to protect our own infrastructure from malicious files. Files under our own size threshold for scanning are checked this way; larger files skip the scan and proceed directly to processing. This scan does not affect files that are processed entirely on your device, since those never reach our servers at all.

Creating an account is never required to use a tool. If you choose to sign up, we (via our authentication provider, Supabase) store your email address and a securely hashed password — we never see or store your password in plain text. An account only unlocks larger file-size limits and saved preferences; it does not change how your files are processed.

If you submit the contact form, your name, optional email address, and message are sent directly to our support inbox by email so we can read and respond to it. This submission is not stored in a database on our end — it exists only as the email it generates. If you don't provide an email address, we simply can't reply, but your message is still received.

We use only the minimal cookies required to keep you signed in if you create an account (managed by our authentication provider). We do not use third-party advertising cookies, and we do not currently run any third-party analytics or tracking scripts.

We rely on a small set of infrastructure providers to run Docomint, each only for what's described above:

• Supabase — authentication and temporary file storage for server-processed tools.
• VirusTotal — optional malware scanning for eligible server-processed uploads.
• Our email delivery provider — sending transactional emails (e-signature links, contact form messages).

We do not sell, rent, or otherwise share your data with advertisers or data brokers.

Files processed entirely on your device are never retained by us, because we never receive them. Files uploaded for server-side processing are deleted immediately after the job completes, and in any case no later than a short automatic expiry window. Account data (email address) is retained for as long as your account exists and is deleted if you delete your account.

Docomint is not directed at children under 13, and we do not knowingly collect personal data from them.

If we make a meaningful change to how we handle your data, we'll update this page and the date at the top of it. Continued use of Docomint after a change means you accept the updated policy.

If you have any questions about this policy or how your data is handled, please reach out via the contact page.