Your PDFs are yours.

PdfTableKit is built to extract tables, not collect your PDFs.

PDFs are processed in your browser

Your selected PDF, text coordinates and grid output stay in your browser’s memory for the text-PDF path in this MVP. Closing the tab releases app memory; copies you download remain on your device.

What is stored in your browser

We use localStorage under pdftablekit.usage.v1 to store the local calendar date and random usage tokens for the daily free allowance. The counter is not sent to us. Optional sign-in uses a Secure HttpOnly account-session cookie. There are no advertising identifiers.

Ordinary website requests

Your browser downloads the website, pdf.js worker assets and scripts from the site’s hosting service. Hosting providers may receive ordinary request information such as IP address, browser details, requested URLs and access times under their own policies. PDF content is not uploaded for extraction in this MVP text path.

No analytics or payments

This MVP includes no analytics, advertising, third-party fonts or live payment processor. Optional Google sign-in loads Google Identity Services only when requested. Google receives ordinary connection information and handles authentication under its own policies; tool files are not sent to Google for sign-in. When the separate billing service is configured, Google credentials are verified server-side using Google public keys. A Secure HttpOnly session cookie expires after one hour; signing out clears it. Email and expiry are held in browser memory, not sessionStorage. The server records the Google subject and a once-only two-text-credit signup Gift in its test ledger. Files are not uploaded for authentication. Cloud processing, paid checkout and OCR remain Coming soon; local limits are unchanged.

Future OCR / cloud paths

If image/scan OCR or a cloud path is offered later, it will require explicit consent and an updated privacy policy before files leave your device for that path.

Operator details

PdfTableKit is a development MVP brand. Operator identity, a privacy contact and hosting details must be published before treating this as a contracted service.