Draft — pending legal review. This page is a starting point written from the app's actual technical behavior and common industry practice. It has not been reviewed by a lawyer and must not be relied on or linked publicly until it has. Bracketed text highlighted like [this] marks a decision or fact this document still needs.

Cookie Policy

Last updated: October 11, 2026

This page explains the cookies and similar browser storage PDFTime uses. It's deliberately short, because the list below is the complete list — we don't use advertising, analytics, or cross-site tracking cookies of any kind.

1. Cookies we use

All cookies we set are "strictly necessary" — the Service can't work correctly without them, so under most cookie-consent frameworks they don't require a consent banner. [Lawyer to confirm this classification is correct for applicable law before relying on it to skip a consent banner.]

Name	Set by	Purpose	Duration
`sessionid`	PDFTime (first-party)	Keeps you signed in between page visits.	Up to 2 weeks, or until you sign out.
`csrftoken`	PDFTime (first-party)	Security token that protects forms (like sign-in and upload) from being forged by other websites.	Up to 1 year.

2. Local storage (not a cookie)

We also store one small piece of information directly in your browser's local storage, which — unlike a cookie — is never sent to our servers:

Key	Purpose	Duration
`theme`	Remembers whether you chose light or dark mode, so we don't have to ask again.	Until you clear your browser's site data.

[Some cookie-consent frameworks (e.g. under the EU ePrivacy Directive) also regulate non-cookie local storage. Lawyer to confirm whether this use requires disclosure/consent beyond what's written here.]

3. Third-party requests

We don't load fonts, scripts, or any other resources from third-party servers — everything the page needs, including typefaces, is served directly from PDFTime.

4. Controlling cookies

Most browsers let you block or delete cookies in their settings. Because sessionid and csrftoken are required for sign-in and secure form submission, blocking them will prevent you from signing in or merging files while signed in — the anonymous merge flow (without an account) does not require an account session to function the same way, though the CSRF cookie is still needed for the upload/merge forms to work at all.

5. Changes to this policy

We may update this Cookie Policy if the cookies or local storage we use change. Check the "Last updated" date above.

6. Contact us

Questions about this Cookie Policy can be sent to support@pdftime.io.