Privacy notice

Last updated 2026-10-22.

This notice covers the Free PDF SDK website at https://freepdfsdk.mecorelabs.com: the home page, the live demo and the documentation. The SDK itself, once you install it in your own app, sends nothing to us; that is yours to describe to your own users.

#Who is responsible

Mecore Labs is the controller of the personal data described here. For any question about privacy, or to use your rights, write to privacy@mecorelabs.com.

#The short version

• Your PDFs never leave your device. The live demo opens files in your browser; nothing is uploaded.
• Analytics only if you accept. We use Google Analytics to count visits, but only after you click Accept. Decline, and nothing is sent to Google Analytics and no analytics cookie is set.
• No accounts, no forms, no advertising. We don't sell or share personal data, and we don't use it for advertising.

In this notice, "Google" means Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for the EEA and the UK, and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) elsewhere.

#Hosting

The site is served by Firebase Hosting, a Google service. To deliver pages, keep the service secure and give us traffic statistics, Google's servers process your IP address, the address of the page you ask for, your browser's user agent and the time. This is needed to show you the site at all. Google keeps these request logs for a few months, then deletes them. Our legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Google acts as our processor under its data processing terms.

#Analytics (only with your consent)

If you click Accept in the cookie banner, we load Google Analytics 4 (measurement id G-ZTJKQ1CLQ0), provided by Google. It tells us how many people visit and which pages they find useful.

• What is collected: the pages you view and when, the page you came from, how far you scroll, links you follow to other sites, files you download and searches on the site, your device type, operating system, browser, screen size and language, and an approximate location (country and city) worked out from your IP address. Google Analytics 4 does not log or store IP addresses.
• Cookies: _ga and _ga_<id> hold a random identifier so repeat visits count once. They are set for this site only and expire 13 months after you accept; later visits don't extend them.
• What we have turned off: Google signals, advertising features and ad personalisation.
• How long it is kept: data about visitors and their visits is kept for 2 months, then deleted. Aggregated reports with no link to any visitor (such as visits per month) are kept.
• Legal basis: your consent (Art. 6(1)(a) GDPR, and Art. 5(3) of the ePrivacy Directive for the cookies).
• It is voluntary: declining has no effect on how the site works.

Changing your mind: use Cookie settings at the bottom of any page. Declining there stops analytics straight away and deletes the analytics cookies. If your browser sends a Global Privacy Control signal, we treat it as declining and don't ask; only an Accept you give in Cookie settings while the signal is on overrides it.

#Stored in your browser, never sent to us

These items stay in your browser's local storage. They are needed for features you use, so they don't need consent. You can clear them in your browser's settings at any time.

#Other services the pages load

• Google Fonts: the site's typefaces are loaded from Google's servers, so your browser sends Google your IP address when a page loads. We do this so the site displays consistently (Art. 6(1)(f) GDPR). Google decides how long it keeps this data; see Google's privacy policy.
• Ko-fi (home page only): the donate button and the floating donate widget are loaded from Ko-fi (Ko-Fi Labs Limited, England and Wales), so your browser sends Ko-fi your IP address (Art. 6(1)(f) GDPR: letting visitors support the project). If you donate, Ko-fi handles that under its own privacy policy.

#Transfers outside the EU and the UK

Google may process data from hosting, Google Fonts and Google Analytics in the United States. Google LLC is certified under the EU–US Data Privacy Framework and its UK Extension, which the European Commission (and, for the UK Extension, the UK government) has found to give adequate protection (Art. 45 GDPR). Google's standard contractual clauses also apply. Ko-fi is in the United Kingdom, which the European Commission has found to give adequate protection.

#Your rights

Under the GDPR (and the UK GDPR) you have the right to:

• access the personal data we hold about you, and get a copy;
• have it corrected, or deleted;
• restrict how it is processed;
• receive it in a portable format;
• withdraw your consent at any time, without affecting what was done before you withdrew it.

Right to object: where we rely on our legitimate interests (hosting, Google Fonts, Ko-fi), you can object at any time, on grounds relating to your situation, by writing to privacy@mecorelabs.com.

To use any of these rights, write to privacy@mecorelabs.com. Analytics data is linked only to a random cookie identifier, not to your name, so we may not be able to find your data unless you give us that identifier. You can also complain to a data protection authority, in particular the one where you live or work, or where you think the problem happened.

We make no decisions about you by automated means, including profiling.

If you live in California or another US state with a privacy law: we don't sell or share personal information, and we honour Global Privacy Control signals.

#Changes to this notice

If what we do changes, we update this page and the date at the top. If we start asking for consent for something new, the banner asks you again.